Privacy Policy

Who is the controller and how can you contact us?

The controller of the personal data processed through this website is Keksi & Co, Kauppakatu 28, Lappeenranta, Finland. If you have any questions about this privacy policy, about your personal data, or if you wish to exercise your rights, please contact us at info@keksico.fi.

What personal data do we process?

We only process personal data that you give to us yourself through our website forms, such as workshop bookings, the Cookie & Wine Pairing, private events and custom orders, business enquiries, gift card orders and general contact messages. Depending on the form, this may include:

• your name and email address (required on all forms);
• your phone number, when a form asks for it (optional);
• the information relevant to your request, such as the number of participants, your preferred date, the recipient's name for a gift card, or your message to us.
• When you browse the website, we also process technical data to the extent needed to serve the site and keep it secure (for example your IP address when the embedded map loads).

Why do we process your data and on what legal basis?

We process the information you submit to handle and respond to your request — for example to confirm a booking, prepare a quote, process a gift card order or answer your question. The legal basis for this is steps taken at your request prior to entering into a contract, and our legitimate interest in managing our customer relationships (Articles 6(1)(b) and 6(1)(f) of the EU General Data Protection Regulation).

Technical data is processed on the basis of our legitimate interest in keeping the website functional and secure.

We do not use your data for automated decision-making or profiling, and we do not sell it or use it for direct marketing.

Where is your data stored?

When you submit a form, your request is saved in our website's secure database and, at the same time, sent by email to info@keksico.fi so we can respond to you from our own inbox. We keep this website simple: your data is used only to handle your request and is not shared with any third party for their own purposes.

The website and its database are hosted on a professional hosting platform that processes data on our behalf under a data processing agreement. Our email service may process data on servers located outside the EU/EEA, in which case processing is protected by appropriate safeguards such as the European Commission's standard contractual clauses.

Some pages embed a map from OpenStreetMap. When the map loads, the service receives information such as your IP address. For details on cookies and similar technologies, see our Cookie Policy.

How long do we keep your data?

We keep your enquiry for as long as needed to handle your request and any follow-up conversation with you. After that, we keep the data only if and for as long as bookkeeping legislation or our other legal obligations require, or for as long as necessary to protect our legal claims.

How do we protect your data?

Our website is served over an encrypted connection (HTTPS), and the database that stores form submissions is protected with access control so that only the website itself and we can read it. Access to the data is limited to the people at Keksi & Co who need it to handle requests.

Your rights

Under the EU General Data Protection Regulation (2016/679), you have the right to:

• access the personal data we hold about you;
• have incorrect or incomplete data corrected;
• have your data erased ("the right to be forgotten");
• restrict or object to the processing of your data;
• receive your data in a commonly used format and have it transferred to another controller.

To exercise any of these rights, contact us at info@keksico.fi. You may also withdraw your consent to our processing at any time, without affecting the lawfulness of processing carried out before the withdrawal.

If you believe your rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman, the Finnish supervisory authority (www.tietosuoja.fi).

Changes to this privacy policy

We may update this privacy policy if our processing of personal data changes or legislation requires it. The date at the top of this page always shows when the policy was last updated.