Privacy and Cookie Policy
Last updated: 21 September 2026
This policy explains how Muotoiluosuuskunta Unionin26, trading as U26 Shop, processes personal data when you visit our website, contact us, ask us to reserve or order a product, or subscribe to our newsletter.
1. Controller and contact details
Muotoiluosuuskunta Unionin26 (U26 Shop)
Business ID: 1452555-3
Unioninkatu 26
00130 Helsinki
Finland
Telephone: +358 40 163 9353
Email: info@u26shop.fi
Contact person for data protection matters: Pia-Mari Jull. You may use the contact details above for questions or requests concerning your personal data.
2. Personal data we process
Depending on how you deal with us, we may process:
- your name, email address, telephone number and any other information you include in a contact-form submission, email or other message;
- details needed to answer an enquiry or arrange a product reservation, order, collection, delivery, invoice, return or complaint;
- newsletter information, such as your email address, name if supplied, consent record, subscription status and, where newsletter measurement is enabled, delivery, opening and link-click information;
- technical information generated when the website is used, such as IP address, browser and device type, operating system, referring page, pages viewed, date and time, language choice, security events and server logs;
- privacy-reduced website usage statistics described in section 9; and
- cookie and consent choices.
Please do not include sensitive personal data in the free-text contact-form field unless it is necessary for your request.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries and communicating with you | Steps requested before entering into a contract, performance of a contract, or our legitimate interest in providing customer service |
| Handling reservations, orders, deliveries, invoices, returns and complaints | Performance of a contract, steps requested before entering into a contract, and compliance with legal obligations |
| Sending newsletters and other electronic direct marketing | Your consent. You may withdraw it at any time |
| Operating and securing the website and contact form, preventing spam and investigating misuse | Our legitimate interest in providing a functional and secure website |
| Producing limited, cookieless website statistics to understand and improve the site | Our legitimate interest in measuring and improving the website, subject to the safeguards in section 9 |
| Loading optional maps, videos and review content supplied by third parties | Your consent |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our rights |
Where processing is based on legitimate interests, we balance those interests against your rights and reasonable expectations and use only the data necessary for the stated purpose.
4. Sources of personal data
We normally receive personal data directly from you when you contact us, subscribe, visit the shop, or ask us to provide a product or service. Technical data are generated by your browser, our website platform, security services and analytics system when you use the site. We do not purchase contact lists.
5. Recipients and service providers
Personal data are available only to authorised members and personnel of the co-operative who need them for their work. We may also use the following providers:
- Webnode AG, Switzerland, provides the website platform, hosting and contact-form infrastructure and processes website data on our behalf.
- MailerLite Limited, Ireland, provides newsletter subscription, distribution and campaign-management services and processes subscriber data on our behalf.
- our email, IT support, accounting and other service providers where access is necessary to provide and secure their services;
- Google services used for reCAPTCHA, Google Maps, YouTube, Google Fonts and tag management, as described in sections 9 and 10; and
- Tripadvisor when its review content is loaded, as described in section 10.
Google and Tripadvisor may act as independent controllers for information they receive when their content is loaded or you use their services. Their own privacy policies then apply. We may also disclose data to an authority where required by law or to advisers where necessary for a legal claim. We do not sell personal data.
6. Transfers outside the European Economic Area
Webnode AG is established in Switzerland, which the European Commission has recognised as providing an adequate level of data protection. MailerLite Limited is established in Ireland and states that subscriber data are stored in the European Union. MailerLite and its subprocessors may nevertheless process limited data in other countries.
When optional content supplied by Google, YouTube or Tripadvisor is loaded, those providers may process data outside the European Economic Area, including in the United States. Where personal data are transferred to a country without an adequacy decision, the provider must use an applicable lawful transfer mechanism, such as the European Commission's standard contractual clauses, together with any necessary supplementary safeguards.
7. Retention periods
- Contact-form submissions, enquiries and ordinary correspondence: normally two years after the matter has been concluded. Information connected with a contract, complaint or legal claim may be retained for the corresponding longer period.
- Reservations and orders: for as long as necessary to perform the agreement and normally no longer than three years afterwards, unless the information forms part of accounting material or is needed for a complaint or legal claim.
- Accounting vouchers and related transaction records containing personal data: for the period required by Finnish accounting law, generally at least six years from the end of the year in which the relevant financial year ended. Accounting books and financial statements are retained for at least ten years.
- Newsletter data: until you withdraw your consent or unsubscribe. We may retain a minimal suppression record for as long as necessary to ensure that you are not added back to the mailing list or contacted contrary to your wishes.
- Records demonstrating marketing consent: while the consent is used and normally for three years after withdrawal or the last marketing message, unless a longer period is necessary for a dispute or legal obligation.
- Matomo raw visitor data: 180 days.
- Matomo aggregated reports: 12 months.
- Technical logs and backups managed by Webnode or another infrastructure provider: only for the period reasonably necessary to operate, secure and restore the service, or to meet a legal obligation, in accordance with the provider's documented retention arrangements.
We delete or anonymise information when there is no longer a lawful reason to retain it.
8. Contact form and reCAPTCHA
The contact form is provided through Webnode. It asks for your name, email address, telephone number and message. We use the information only to receive, answer and follow up your request and, where relevant, to manage a resulting reservation, order or other agreement.
The form uses Google reCAPTCHA to distinguish genuine users from automated spam and abuse. When you open or use the form, Google may receive technical information such as your IP address, device and browser information and interaction data. We use reCAPTCHA on the basis of our legitimate interest in protecting the form and website. If you prefer not to use reCAPTCHA, you can contact us by email or telephone instead. See Google's Privacy Policy.
9. Cookieless Matomo analytics
We use a self-hosted Matomo installation to produce limited statistics about use of the website. Matomo is configured not to set or read analytics cookies, to honour the browser's Do Not Track setting and to anonymise IP addresses before they are stored. We do not use a name, email address or other customer identifier as a Matomo user ID, and we do not use session recording, heatmaps or cross-site tracking.
The information may include a shortened IP address, approximate location derived from it, browser and device type, operating system, referring page, pages viewed, actions such as link clicks, and date and time. The data are used only to understand general website usage and improve the site. They are not disclosed to the developer of Matomo software.
You may object to this processing at any time by contacting us. Matomo will not track your visit when your browser sends a Do Not Track signal.
10. Cookies, consent and external content
Cookies are small text files stored by your browser. Similar technologies include local browser storage, pixels and identifiers. Necessary technologies may be used without consent where they are required to provide a function you request, maintain security or remember your privacy choice. Optional technologies and third-party embeds are used only after you give consent.
| Category | Purpose and providers | Typical duration |
|---|---|---|
| Necessary | Webnode session, security, form and consent-choice functions | For the browser session or for the period needed to remember the choice; normally no longer than 12 months |
| Language preference | preferred_lang remembers whether you selected Finnish or English |
12 months |
| Cookieless analytics | Self-hosted Matomo; no analytics cookies or local-storage identifiers | No information is stored on your device by Matomo |
| Optional external content | Google Maps, YouTube and Tripadvisor. Loading an embed transfers technical data to the provider and may allow it to set or read its own cookies, particularly if you are signed in to that provider | Provider cookies may last for the session or, depending on the provider and your account settings, for up to 24 months |
Webnode may use Google Tag Manager to manage scripts used by the website. Tag Manager is a delivery mechanism; whether consent is required depends on the particular service loaded through it. Webnode may also retrieve typefaces from Google Fonts, which discloses the visitor's IP address and basic browser information to Google for the purpose of delivering the font files.
Google Maps, YouTube videos and Tripadvisor review content remain blocked until you accept the optional external-content category. When you allow an embed, the provider receives your IP address and browser information and may collect interaction and account information under its own terms. You can change or withdraw your choice at any time using the Cookies link in the website footer. Withdrawal does not affect processing that occurred before it.
More information is available in Google's Privacy Policy, Google's cookie information and Tripadvisor's Privacy and Cookies Statement.
11. Newsletter
We send newsletters and electronic direct marketing only where we have an appropriate consent. Subscription information may be collected online, in the shop or at an event. We use MailerLite to maintain the subscriber list and distribute messages. Depending on the campaign settings, MailerLite may record delivery, newsletter opening and link clicks, together with technical information such as IP address, browser or email-client type and time of interaction, so that we can measure campaign performance.
Every marketing email contains an unsubscribe link. You can also withdraw consent by contacting us. Withdrawal does not affect the lawfulness of processing carried out before it. See MailerLite's Privacy Policy.
12. Your rights
Subject to the conditions in data protection law, you have the right to:
- receive information about our processing and obtain access to your personal data;
- have inaccurate or incomplete data corrected;
- have data erased where there is no lawful reason to retain them;
- restrict processing in certain circumstances;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies; and
- withdraw consent at any time, without affecting earlier lawful processing.
We do not use your data for decisions based solely on automated processing that produce legal or similarly significant effects.
To exercise your rights, contact us using the details in section 1. We may ask for information needed to verify your identity. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman, the Finnish supervisory authority.
13. Security and updates
We use appropriate organisational and technical measures to protect personal data. Access is limited to people who need the information for their duties, and our providers are required to protect data processed on our behalf. No internet service can be guaranteed to be completely secure.
We update this policy when our services or processing practices change. The current version and its update date are published on this page.