Updated 3.9.2026

This privacy policy describes how Korallifarmi Oy processes personal data in its online store, physical store, customer service, and other activities related to customer relationships, as well as how service providers used by Korallifarmi, such as Shopify, participate in personal data processing.

1. Data Controller

Korallifarmi Oy acts as the data controller for its customers' personal data in processing operations where Korallifarmi determines the purposes and essential means of processing personal data.

Korallifarmi uses external service providers to implement its online store and other services. These may process personal data on behalf of Korallifarmi as data processors or, in certain services, as independent data controllers in accordance with their own privacy policies and statutory obligations.

Each party is responsible for its own part of the personal data processing in which it acts as a data controller or data processor in accordance with applicable data protection legislation.

2. What personal data do we process?

We only process personal data that is necessary for the operation of the online store, physical store, customer service, and Korallifarmi's other business activities.

Processed data may include, for example:

• name;
• email address and phone number;
• billing and shipping address;
• order, purchase, payment, delivery, return, and complaint information;
• customer account information;
• content of messages sent to customer service, email, or the online store chat;
• images, videos, and other information provided by the customer that is necessary to resolve a customer service or complaint situation;
• technical information about website usage, such as IP address, device and browser information, and identifiers related to cookies and similar technologies;
• choices related to marketing, cookies, and other consents.

Actual payment card information is processed in the systems of payment service providers. Korallifarmi does not, as a rule, receive or store customers' complete payment card information.

3. What personal data is used for

Personal data may be processed for the following purposes:

• receiving and processing orders;
• handling payments, deliveries, pickups, and returns;
• maintaining the customer relationship and any customer account;
• customer service and answering customer inquiries;
• resolving complaints, warranty issues, and other problem situations;
• fulfilling statutory accounting, tax, and other obligations;
• maintaining the security of the online store and preventing misuse and fraud;
• developing the functionality, usability, and customer experience of the online store;
• marketing when there is a legal basis or the customer's consent.

4. Legal bases for processing personal data

The processing of personal data is based, depending on the situation, on one or more of the following grounds:

• contract performance, for example, order processing, payment, and delivery;
• legal obligation, such as requirements of accounting and tax legislation;
• Korallifarmi's legitimate interest, for example, customer service, business development, data security, and prevention of misuse;
• customer's consent, when processing requires consent, for example, for certain electronic marketing or the use of non-essential cookies.

Consent-based processing can be revoked at any time. Revocation does not affect the lawfulness of processing carried out before the revocation.

5. Shopify and other service providers

Korallifarmi's online store operates on the Shopify platform.

Shopify processes Korallifarmi's customers' personal data primarily on behalf of Korallifarmi as a data processor when Shopify provides Korallifarmi with technical functions for the online store, orders, customer accounts, customer service, or other Shopify services.

In certain Shopify services, Shopify may also process personal data as an independent data controller for its own defined purposes. In such cases, Shopify is responsible for such processing in accordance with its own privacy policies, terms of service, and applicable legislation.

Korallifarmi may also use other applications and service providers connected to the online store. The role of the service provider in personal data processing depends on the service in question: the service provider may act as Korallifarmi's personal data processor or, in certain situations, as an independent data controller.

Personal data may be processed as needed, for example, in connection with the following services:

• online store and customer account services;
• payment services;
• transport and logistics services;
• accounting and financial administration;
• customer service and communication;
• technical applications and integrations of the online store;
• analytics and marketing when there is an appropriate legal basis or consent for their use.

Service providers are given only the personal data necessary for the implementation of their service.

Korallifarmi strives to use service providers that offer appropriate data protection and data security guarantees. With data processors, processing is based on agreements or other appropriate arrangements required by applicable legislation.

6. Online store chat and AI assistant

Korallifarmi does not use the customer service AI assistant to make exclusively automated decisions about the customer that would have legal or similarly significant effects on the customer.

Any automated decisions by external payment, credit, or other service providers are subject to the terms and privacy policies of the respective service provider.

7. Disclosure of personal data

Korallifarmi does not sell its customers' personal data.

Personal data may be disclosed or made available for processing to external service providers when necessary for the implementation of the service ordered by the customer, the management of the customer relationship, the fulfillment of a statutory obligation, or the protection of Korallifarmi's rights.

For example, the necessary name, address, phone number, and other delivery information may be disclosed to a transport company for the purpose of carrying out the delivery.

Data may also be disclosed to a competent authority when required by law.

8. Transfers of personal data outside the EU and EEA

Some of the international service providers used by Korallifarmi may also process personal data outside the EU or EEA area.

When personal data is transferred outside the EU or EEA, the service provider must use a transfer basis in accordance with applicable data protection legislation and appropriate safeguards.

These may include, for example, the European Commission's adequacy decision on data protection, standard contractual clauses approved by the European Commission, approved binding corporate rules, or another transfer mechanism permitted by law.

9. Retention of personal data

Personal data is stored only as long as required by the purpose of its processing, the customer relationship, the handling of potential legal claims, or applicable legislation.

For example:

• information related to orders, payments, and accounting is stored for the period required by accounting and other legislation;
• customer account information is stored to maintain the customer account and customer relationship, unless there is a legal obstacle to deleting the data;
• customer service and complaint information is stored as long as the handling of the matter, any subsequent investigation, or the handling of legal claims reasonably requires it;
• data used for marketing is processed until the customer withdraws their consent or objects to marketing, unless there is another legal basis for storing the data.

Personal data included in accounting records is stored for at least the retention period required by accounting legislation.

10. Cookies and similar technologies

Korallifarmi's online store uses essential cookies and similar technologies for the operation of the online store.

Non-essential cookies and similar technologies used for analytics, personalization, or marketing are used when there is a legally required consent or other applicable legal basis for their use.

Customers can manage their cookie choices from the cookie settings of Korallifarmi's online store and withdraw their previously given consent.

The services and technologies used in the online store may change as the online store develops. Up-to-date cookie choices and available settings can be found in the online store's cookie settings.

11. Protection of personal data

Korallifarmi uses appropriate technical and organizational measures to protect personal data.

Access to personal data is restricted to those persons and service providers who need the information to perform their tasks or services.

The systems used by Korallifarmi utilize, depending on the service, for example, access control, authentication, encrypted network connections, and the service providers' own data security measures.

No data transfer over the internet is completely risk-free, but appropriate data security practices are always followed in the protection of personal data.

12. Rights of the data subject

Subject to the conditions of data protection legislation, the customer has the right to:

• receive information about the processing of their personal data;
• check their personal data;
• request the rectification of inaccurate or incomplete personal data;
• request the erasure of personal data;
• request the restriction of processing of personal data;
• object to the processing of personal data in certain situations;
• receive data they have provided transferred from one system to another when the conditions of the law are met;
• withdraw their consent at any time when processing is based on consent.

These rights are not absolute in all situations. For example, accounting or other data that must be stored by law cannot be deleted before the end of their statutory retention period.

Data protection requests can be sent by email to info@korallefarmi.com.

Korallifarmi may request reasonable additional information to verify identity before disclosing, modifying, or deleting personal data.

13. Right to lodge a complaint

If the customer believes that their personal data has been processed in violation of data protection legislation, they have the right to lodge a complaint with the competent data protection authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

14. Changes to the privacy policy

Korallifarmi may update this privacy policy, for example, as a result of changes in online store services, applications used, service providers, or legislation.

The up-to-date privacy policy will be published on this page, and the page will indicate the last update date.

15. Contact in data protection matters