Privacy and Cookies

This notice explains how Kitka Climbing Oy processes personal data in connection with its business webshop, customer accounts, orders and enquiries. Updated 28 October 2026.

Controller and contact

Kitka Climbing Oy, Business ID 2710336-8, VAT FI27103368. Paakakatu 2, 90520 Oulu, Finland. For privacy requests, contact sales@kitkaclimbing.com or telephone +358 8 613 9195.

Information we process

We process information you provide, including contact-person name, business name, VAT ID, billing and delivery addresses, email address, telephone number, order contents, payment status and correspondence. An optional customer account also contains account and login information. Technical service and security records may contain IP address, device and request information, login events and delivery or error information for service emails.

Payment details entered in the payment service are processed by the payment provider. Do not send card numbers or card security codes to Kitka by email or in order notes.

Purposes and legal bases

• Processing and delivering orders, payments and customer-service requests: performance of a contract, or our legitimate interest in managing business-customer relationships when you act as your company’s contact person.
• Accounting and statutory record keeping: compliance with legal obligations.
• Customer-account operation, service security, fraud prevention and resolving technical or delivery problems: performance of the account service and our legitimate interests in providing a reliable and secure store.
• Optional marketing or non-essential tracking, if offered: the applicable separate consent. Refusing optional tracking does not prevent purchasing.

Business and delivery details required at checkout are needed to process the order. Without them we may be unable to accept or deliver an order. Creating a customer account is optional.

Recipients and service providers

Relevant data is used by the people handling sales, fulfilment, customer service and administration. Service providers may process the data needed for hosting and email, the WooCommerce store, payments, production, delivery, accounting, backups and technical support.

The store uses WooCommerce and WooPayments; card payments involve Stripe services. The site also uses Sirv for product media and has a Gelato integration for clothing fulfilment. Where such a provider is used for your order, the necessary order and delivery details are processed for that purpose. Hosting and technical services are supplied through Domain247. Carrier details depend on the shipment. Data may also be provided to authorities where legally required.

Provider information: Automattic / WooCommerce, Stripe, Gelato and Sirv. A provider may act as a processor or, for some of its own legal purposes, as a separate controller.

International processing

Some service providers operate internationally. When personal data is transferred outside the EEA, the applicable transfer mechanism must be used, such as an adequacy decision or the European Commission’s standard contractual clauses with any necessary additional safeguards. Contact us for information about the providers and safeguards relevant to your order.

Retention

Retention depends on the purpose of the record. Order and payment records needed as accounting evidence are retained for the statutory period: generally at least six years from the end of the year in which the accounting period ended. Accounting books and financial statements are generally retained for at least ten years from the end of the accounting period.

Account information is maintained for the account service; you can request closure of your account. Enquiries, technical records and correspondence are retained for handling the matter and any necessary follow-up, security, legal claims or statutory obligations. A deletion request does not remove records that must still be retained by law. Contact us for the retention criteria applying to a particular record.

Cookies and similar technology

The store uses necessary session and cart technology to remember your selections, support checkout and keep account sessions secure. Payment services and embedded product-media services may use technology needed to provide the function you request. You can manage cookies in your browser, but blocking necessary technology may prevent cart, login or payment functions from working.

Optional analytics and marketing are off until you choose them. Choose Essential only to continue without optional tracking, Accept all to allow the available optional categories, or Choose settings to choose analytics and marketing independently. You can change or withdraw your choice using Cookie preferences in the footer. Your choice is remembered for 90 days; refusing optional tracking does not prevent purchasing.

Marketing consent allows Meta browser advertising tracking and eligible customer-associated server events. Background and administrative events are not sent, so this does not provide complete conversion reporting. Store analytics is currently unavailable because a supported analytics destination has not been configured. The legacy Google Tag Manager container, standalone Tracks tracking, optional WooPay telemetry and order attribution remain disabled, including after consent.

Your rights

You may request access, correction, erasure, restriction or, where applicable, portability of your personal data. You may object to processing based on legitimate interests and to direct marketing. If processing is based on consent, you may withdraw that consent without affecting earlier lawful processing. Send requests to sales@kitkaclimbing.com. We may need to verify your identity before providing or changing personal data.

You may lodge a complaint with the Finnish Office of the Data Protection Ombudsman or another competent supervisory authority. We do not use this store to make solely automated decisions with legal or similarly significant effects about you.

Security and updates

Access to order and account data is limited to the people and providers who need it for the service. We use access controls, encrypted connections where applicable and backups to support security and continuity. We may update this notice when the store or processing changes. The current version is available on this page.