Privacy Policy & Cookie Statement

Last Updated: October 8, 2026

1. Introduction & Who We Are (Data Controller)

This Privacy Policy & Cookie Statement describes how Kylmä Co. (Freshland OY, Company ID: Finland 2734907-7, “we,” “us,” or “our”), as the data controller, processes the personal data of our customers and visitors. This policy applies when you visit our website (kylmaco.com, the “Site”), make a purchase, create an account, subscribe to our newsletter, or otherwise interact with us.

Your privacy is a cornerstone of our brand. Our commitment to providing pure, natural products from Finland extends to how we handle your personal data: with respect, transparency, and the highest standard of care, in compliance with the General Data Protection Regulation (GDPR) (EU/EEA) and other applicable data protection laws.

Registered Address: Liikkalankuja 4 B 00950 Helsinki, Finland Company Registration Number: 2734907-7

For any questions or to exercise your rights, please contact our Data Protection team at privacy@kylmaco.com.

2. What Personal Data Do We Collect and Why?

We collect your personal data to provide you with the best possible service and shopping experience. The data we collect, our purpose for collecting it, and our legal basis under GDPR are outlined below.

3. How Your Personal Data is Collected

We use different methods to collect data from and about you:

• Direct Interactions: You provide data directly when you make a purchase, create an account, subscribe to our newsletter, contact customer service, or give us feedback.
• Automated Technologies or Interactions: As you interact with our Site, we automatically collect Technical and Usage Data through cookies, server logs, and other similar technologies.
• Third Parties: We may receive certain data from third-party partners like analytics providers or advertising networks.

4. Who Do We Share Your Personal Data With?

We do not sell your personal data. We only share it with trusted third-party partners who provide essential services to operate our business (“data processors”). We ensure these partners adhere to strict data protection standards and, where required, have data processing agreements in place.

• Logistics & Shipping Partners: To deliver your orders.
• Payment Service Providers: To securely process your transactions.
• IT Service Providers: For website hosting, maintenance, and e-commerce platform functionality (e.g., WooCommerce).
• Marketing Service Providers: For email marketing campaigns, if you have consented.
• Analytics Providers: To understand website usage and improve our services (e.g., Google Analytics). This data is often anonymized or aggregated.
• Professional Advisers: Including legal, accounting, and insurance services.
• Regulatory & Law Enforcement Authorities: When legally required.

5. International Transfers of Your Data

As Kylmä Co. works with service providers in several countries, your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA).

When we transfer your personal data internationally, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards:

• For transfers from the EEA: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries deemed to provide an adequate level of protection by the European Commission.

6. Data Security

We have implemented robust technical and organizational security measures to protect your personal data from accidental loss, unauthorized access, alteration, or disclosure. Our website utilizes SSL encryption (HTTPS) for secure data transmission. Access to your personal data is limited to employees and third parties on a strict “need-to-know” basis. We have procedures to handle any suspected data breach and will notify you and relevant authorities as required by law.

7. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including for satisfying any legal, regulatory, tax, accounting, or reporting requirements. For example, we keep order and transaction records, including receipts, for 6 years from the end of the year in which the financial year of the order ended. The Finnish Accounting Act (1336/1997) requires us to keep accounting vouchers, such as receipts, for 6 years. Data collected based on your consent (e.g., for marketing) is kept until you withdraw your consent.

8. Your Data Protection Rights

You have significant rights regarding your personal data. To exercise any of these rights, please contact us at privacy@kylmaco.com. We will respond to your request within the timeframe required by applicable law (e.g., one month under GDPR).

• For Residents of the European Economic Area (EEA) under GDPR:
  • Right to Access: Request a copy of your personal data.
  • Right to Rectification: Request correction of inaccurate data.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your data.
  • Right to Restrict Processing: Request a temporary halt to processing.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Object: Object to processing based on legitimate interests or for direct marketing.
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
  • Right to Lodge a Complaint: With the Finnish Data Protection Ombudsman or your local supervisory authority.

9. Children’s Privacy

Our Site is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to remove that information from our servers.

10. Cookie Policy

Our website uses cookies and similar technologies to enhance your browsing experience, provide essential functionality, and help us understand how you use our site.

What are Cookies? Cookies are small text files that are stored on your device (computer, tablet, smartphone) when you visit a website. They allow the website to “remember” your actions or preferences over a period of time.

How We Use Cookies: We use cookies for the following purposes:

• Strictly Necessary Cookies: Essential for the website to function correctly (e.g., enabling you to add items to your shopping cart, logging into your account, and maintaining security). These cannot be switched off.
• Analytical/Performance Cookies: These cookies, which we set only after you allow “Statistics” in our cookie consent banner, help us understand how visitors interact with our website by collecting information about how you navigate the site, which pages you visit, and if you encounter any errors. This helps us improve the performance and usability of our website.
• Functionality Cookies: These cookies allow our website to remember choices you make (e.g., your language preferences) and provide enhanced, more personalized features.
• Marketing/Targeting Cookies: These cookies record your visit to our website, the pages you have visited, and the links you have followed. We may use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose, but only with your explicit consent where required by law.

Third-Party Cookies: We may also use third-party cookies from trusted partners (e.g., Google Analytics for site analysis). These third parties may collect information about your online activities over time and across different websites.

Your Cookie Choices: You have the right to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. However, if you choose to decline cookies, you may not be able to fully experience the interactive features of our Site or other websites you visit. For more granular control, you can adjust your cookie preferences directly through our cookie consent banner, which appears upon your first visit or when you clear your browser’s cookies.

11. Payments

We accept card, Apple Pay and Google Pay payments through Stripe, and payments with Klarna. When processing payments, some of your data will be passed to Stripe or Klarna, including information required to process or support the payment, such as the purchase total and billing information. If you pay with Apple Pay or Google Pay, Apple or Google also processes the payment.

Please see the Stripe Privacy Policy for more details.

12. Other Information

-If you request a password reset, your IP address will be included in the reset email.
-If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

-For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

-If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

-Visitor comments may be checked through an automated spam detection service.

-While you visit our site, we’ll track:

• Products you’ve viewed: we’ll use this to, for example, show you products you’ve recently viewed
• Location, IP address and browser type: we’ll use this for purposes like estimating taxes and shipping
• Shipping address: we’ll ask you to enter this so we can, for instance, estimate shipping before you place an order, and send you the order!

We’ll also use cookies to keep track of cart contents while you’re browsing our site.

-When you purchase from us, we’ll ask you to provide information including your name, billing address, shipping address, email address, phone number, credit card/payment details and optional account information like username and password. We’ll use this information, for example, to:

• Send you information about your account and order
• Respond to your requests, including refunds and complaints
• Process payments and prevent fraud
• Set up your account for our store
• Comply with any legal obligations we have, such as calculating taxes
• Improve our store offerings
• Send you marketing messages, if you choose to receive them

If you create an account, we will store your name, address, email and phone number, which will be used to populate the checkout for future orders.

We generally store information about you for as long as we need the information for the purposes for which we collect and use it, and we are not legally required to continue to keep it. For example, we will store order information for 6 years from the end of the year in which the financial year of the order ended, because the Finnish Accounting Act requires us to keep receipts and other accounting vouchers for 6 years. This includes your name, email address and billing and shipping addresses.

We will also store comments or reviews, if you choose to leave them.

-Delivery
When we send your parcel with Posti Oy (Finland), we give Posti your name, delivery address, phone number and email address. Posti uses your phone number and email address for delivery notices. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

-Review invitations
After you place an order, we send your name, email address and order number to Trustpilot A/S (Denmark), together with the products you bought and later changes to the order status. Trustpilot may then email you an invitation to review your purchase. About 14 days after an order, we may also send you one email ourselves to ask for a review of the products you bought. The legal basis is our legitimate interest in asking customers about their purchase (Art. 6(1)(f) GDPR). You can object at any time by replying to our review email or by writing to privacy@kylmaco.com.

-Chat assistant
When you write in the chat on our site, your messages go to Anthropic, PBC (USA), whose AI writes the answers for us. If you ask about an order and give its order number and email address, the order details the chat looks up, such as the status, products and total, also go to Anthropic. We keep the conversation together with a random session code and either your customer account (if you are logged in) or a hashed form of your IP address. We delete it 30 days after you last use the chat. The legal basis is our legitimate interest in answering your questions (Art. 6(1)(f) GDPR) and, for questions about your order, the performance of our contract (Art. 6(1)(b) GDPR).

-Spam protection
Friendly Captcha GmbH (Germany) protects our forms, for example the contact form, against spam. When you start to fill in a form, your browser gets a small puzzle from Friendly Captcha’s server and solves it. For this, Friendly Captcha receives your IP address and technical data about your browser, but not the content of your message. The legal basis is our legitimate interest in protecting our forms against spam (Art. 6(1)(f) GDPR).

-Google Analytics and Google Ads
We use Google Analytics to count visits and see how visitors use our shop, and Google Ads to measure whether a visit from one of our Google ads leads to a purchase. Google can also use the visit to show you our ads later. These Google tags load only after you allow them in our cookie consent banner: Google Analytics under “Statistics” and Google Ads under “Marketing”. Google then receives data about your visit, such as the pages you view, your browser, device and IP address and, when you buy, the order number, the products and the order value. Our Google tags do not send your name, email address or postal address. The legal basis is your consent (Art. 6(1)(a) GDPR). You can change your choice at any time with “Cookie settings” at the bottom of every page. Learn more about what data Google collects and about its privacy policy.

-Pinterest Tag
If you allow “Marketing” in our cookie consent banner, we also load the Pinterest Tag of Pinterest Europe Ltd. (Ireland). Pinterest then receives data about your visit, such as the pages you view, your browser, device and IP address, and stores an ID in a cookie on your device. Pinterest can use this to measure visits that come from Pinterest and to show you our ads on Pinterest later. Pinterest may also process the data in the USA (Pinterest, Inc.). The legal basis is your consent (Art. 6(1)(a) GDPR). You can change your choice at any time with “Cookie settings” at the bottom of every page.

-To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.

The legal bases for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

13. Changes to This Policy

We may update this Privacy Policy & Cookie Statement periodically to reflect changes in our practices, legal requirements, or for other operational reasons. We will post the updated policy on this page and revise the “Last Updated” date. We encourage you to review this policy whenever you visit our website.

14. Contact Us

If you have any questions about this Privacy Policy & Cookie Statement, or wish to exercise your data protection rights, please contact us.