Privacy policy

Privacy statement

 This is the general privacy statement of Ruohonjuuri Oy/Happy Food Store (hereinafter referred to jointly as “Ruohonjuuri” or “we”; “our” or “us” also refer to the two companies jointly) regarding the processing of personal data in accordance with the General Data Protection Regulation (GDPR) of the European Union and other applicable data protection legislation, such as the Finnish Data Protection Act (1050/2018).

This privacy statement applies to the processing of personal data when we operate either under the name of Ruohonjuuri or in Sweden under the name of Happy Food Store. The purpose of this privacy statement is to describe practices such as the collection, processing, and storage of personal data by us in accordance with the applicable data protection legislation. Versions of this privacy statement have been made in the necessary languages.

  1. Controller and contact person

 Ruohonjuuri Oy/Happy Food Store (business ID: 0510981-4)

Mannerheimintie 7

FI–00100 Helsinki

Ruohonjuuri Oy / Ecommerce Manager/administration

Contact: tietosuoja@ruohonjuuri.fi

  1. Purpose and grounds of data processing

 Depending on the processing measure, the grounds for data processing are:

  • The necessity of personal data processing in order to fulfill the contractual or legal obligations we have entered into with you (for example, the purchase and delivery of products you have ordered from the online store);
  • Responding to your customer service requests on the basis of an agreement, consent, or legal obligation;
  • Your consent, for example, your consent to marketing for the purpose of subscribing to the newsletter, joining the Ruohonjuuri loyalty program, or participating in our campaigns or competitions;
  • A legitimate interest, agreement, or consent to develop our online store and business in the manner specified below; and/or
  • A legitimate interest when we process personal data as part of camera surveillance carried out to protect our staff or property. In addition, the processing of personal data that is recorded by security cameras is subject to the Act on the Protection of Privacy in Working Life (759/2004) and the Occupational Safety and Health Act (738/2002).

If we wish to collect your personal data for other purposes, we will separately ask for your prior consent to this and will inform you of the personal data processing at the same time.

  1. Personal data processed by Ruohonjuuri

The following types of data are collected and processed either by Ruohonjuuri or our partners: 

  • Customer information and contact information: Name, address, phone number, and login information (email address and password), the language of communication, e-marketing authorization, and purchase history from our online store and our other stores. When you place an order in our online store, we also collect information from you about the delivery and payment method. 
  • Customer service and order information: The information collected through contact with the customer, either by phone, email, or chat, that is needed to fulfill a service request. We use the  Gorgias system to process customer feedback and comments sent to us via chat or social media. We use the Cuuma service to handle correspondence by phone and email. Calls are recorded for training and quality control purposes. The caller is always informed of this at the beginning of the call.
  • Other communication with you: If you have left products in the online shopping cart, we may remind you that an order is incomplete. In this case, you do not have to collect the products again in the shopping cart. You may also be asked to participate in market research.
  • Marketing draws and campaign information: When you participate in one of our marketing draws or customer surveys, we may, depending on how the draw or survey is conducted, collect your contact information (email address, address, telephone number) for the purpose of sending a prize if necessary. The winner’s information will only be retained until the prize has been sent, and for the period required by law. It may also be disclosed to the relevant authorities for taxation or other purposes. Additional information is available as necessary according to the specific draw or marketing campaign.
  • Information related to using of the website: Information on website usage, such as page views, the addition of items to a shopping cart or wish list, ordering reminders for when products that are temporarily out of stock are again available, ordering information, delivery methods, payment methods, and login information. Some of this information may be personal information, such as the IP address of your device or your email address. We will link this information case-specifically to your user information. More information in our cookie statement.
  • Email marketing information/Custobar : The name, address, email address, and store (in the case of store-specific newsletters) provided when subscribing to newsletters, as well as information about email marketing events, such as message delivery and opening, clicks, and management of marketing authorization. If you have subscribed to the Ruohonjuuri newsletter and given your consent to marketing, we will use your information to send you a newsletter and personalize your digital marketing. The information used includes your email address, purchase history, information on newsletter delivery, opening and clicking, and online store browsing history. We use the information to target our advertising so that you are sent offers, for example, that are likely to be of most interest to you.
  • Website development information: We use the information we collect from customers to develop our products and services and improve our customer service. We analyze the browsing and shopping activities of online store users and use this information to develop our online store. We mainly use only aggregate or anonymized data for such analyses. Some of this data may be classified as personal data. Among such data is the IP address of the user’s device, date and time of use of the services, hardware and software used, type of internet browser, and information about the operating system, application version, and language settings of the user’s device. Read more in Google’s privacy statement. We use the Lucky Orange service to improve website usability and the customer experience. Lucky Orange can record cursor movements, cursor clicks, and scrolling functions, as well as the information entered on the website by the user. Read more in the Lucky Orange privacy statement.
  • Online store orders and self-management of the user account: We use personal data related to online store purchases to process and deliver orders and to enable users to manage their own accounts in the online store. The data is processed on the Shopify e-commerce platform. The order processing systems enable the collection, checking, and delivery of orders placed in the online store, as well as customer service. These systems can process all personal data related to online store orders.
    • Collection and order processing and logistics data: We use the information in various order printouts (address cards, etc.) in providing services such as the following: Order Printer Pro and Order Printer Templates, Order Tagger, Printrooster Order Printing, and PackRooster. For the purposes of delivering your order, we will provide our partners with your name and contact information. Among our logistics partners are Posti, PostNord, Budbee, Bring, GLS, and DHL, and subcontractors of these companies. The telephone number you provide when placing your order will be used for communications related to the delivery of the order, for example for the arrival notification. This information is also used for arrival notifications for goods to be collected from the store.
  • The Shopify e-commerce platform uses various applications to provide additional online store services. Additional elements include the ordering of Back in stock reminders, for example.  
  • Your information will not be saved until you subscribe for email notifications when products you are interested in that are temporarily out of stock become available again. The application collects the following information: email address, permission to send an email, the language of the browser used, and time zone. For more information, see the Back in stock privacy statement.
  • Yotpo Product Reviews & Photos and Yotpo Loyalty & Referrals customer loyalty program. The applications collect the following information: name, address, email address, phone number, IP address, purchased products, and the star rating you gave to a product if you wrote a product review, the text of the product review, and images and videos added to the review, as well as social media tracking and recommendations made through the system. In addition to collecting data about customers who make purchases in the online store and use the store’s loyalty system, we also collect data on the total cost of the purchases they make and the cones determined on that basis, as well as the earning principles and cones collected in other ways. For more information, see the Yotpo privacy statement. In writing a product review and attaching an image or video to it, the customer thereby consents to the use, at our discretion, of these materials in our online store to provide further information about the products in question, and on our social media accounts and in our marketing communications. The reviewer’s first name and the first letter of their last name will be displayed with the review.
  • Other digital marketing: Name, address, phone number, email address, location, IP address, browser information, and behavioral information such as browsing history, purchase history, and clicking on and opening newsletters. We use personalization in digital advertising outside the ruohonjuuri.fi website, for example in our marketing on social media channels. Once you have given your consent to receive marketing content from us, we may also show you targeted advertising on social media channels such as Facebook and Instagram. Digital remarketing is carried out via a variety of digital advertising networks and using advertising technologies such as cookies and tracking pixels. Read more in our cookie description. We use Channable and Segments tools to create product lists and target groups. Among the data processed are the user’s name, address, phone number, email address, location, IP address of the device, browser information, and browsing and purchase history. Read more from the Channable privacy statement and the Segments privacy statement, and read about Facebook’s privacy-related practices here.
  • Recordings from store security cameras: When visiting a Ruohonjuuri store, footage of you may be recorded by a security camera. Live footage is recorded of the surveillance area, and persons who are within the operating range of each security camera will be recorded and stored in the register. In addition to storing images, the date and time of the events and information on which camera the image was recorded is also stored in the register. Speech is not recorded. The purpose of the recording camera surveillance system is to protect property, prevent crime and provide assistance in the investigation of crimes that have taken place. An additional purpose of camera surveillance is to ensure and increase the safety of customers and staff. Persons who come within the scope of camera surveillance at the store are informed of this by labels indicating the use of recording security cameras.
  • Payment service providers: We use the services of external suppliers to process payments. We will provide your payment information to the payment processing company of your choice for processing. Our payment processing partners are Paytrail (online banking, credit card, and mobile payments) and Klarna, PayPal, and Stripe.  Depending on the payment method used, in addition to the customer’s name, address and order and payment information, their bank account number, personal identity code, or the last four digits of their credit card are also processed in connection with certain payment methods, in a manner to be independently determined by the service provider. This processing of personal data is necessary in order for us to provide the services you have ordered.  Read more about Paytrail, Klarna, Paypal, and Stripe.
  • IT partners and suppliers: Some of the systems have been installed for us locally, in which case only Ruohonjuuri’s own staff have access to the data. Others are cloud services, and in these cases, we transfer personal data to the service provider. In these cases, the service provider or IT supplier is a processor of personal data who processes it based on an assignment from Ruohonjuuri and in accordance with our instructions. Internally, we process customer data in our customer loyalty system, our enterprise resource planning system, our online store system, and our customer management and marketing system. We use Google office software and system services in our internal operations. Google is therefore a processor of personal data that we have authorized for this purpose. Read more in Google’s privacy statement.
  • Taxfree: Customers living outside the European Union can make tax-free purchases in Ruohonjuuri stores. The tax-free service is provided by Planet Payment, which will have access to the personal data needed to process your tax-free order. See the Planet Payment privacy statement.
  • Authorities: In some cases, we may be required to disclose your personal data as required by law or regulations, for instance in the course of a criminal investigation or legal proceedings at the request of an authority. Data from our camera surveillance register will not be disclosed to any party outside the European Union or the European Economic Area.
  1. More information about the recipients of personal data

 As specified above, we use the services of external partners or service providers to provide Ruohonjuuri with logistics services, payment solutions, IT services, or other digital services. As part of providing these services, Ruohonjuuri partners both inside and outside the EU and EEA may have access to your personal data. If personal data is transferred or disclosed, the security measures required by the applicable legislation must be followed. Such transfer or disclosure of personal data is carried out with a contracting party in accordance with standard contractual clauses established by the EU Commission, or the contractor is required to use standard contractual clauses established by the EU Commission, or the recipient country maintains an adequate level of data protection in the recipient country in accordance with the decision of the EU Commission, the company processing the data is subject to binding corporate rules, or there is some other legal ground for the transfer, such as the making, filing or defense of a legal claim.

  1. Date storage periods

By default, your customer data is retained in our customer management and marketing system for five years from the most recent date on which you were active. Activity is defined in the system as any of the following actions: purchasing from our online store or any of our other stores, browsing in the online store, and clicking on or opening a newsletter. The personal account section of our online store will retain the personal data you have provided for as long as your user account is active. If you subscribe to our newsletter, your contact information will be stored for as long as you wish to receive the newsletter. Customer service data is processed for the length of time required to handle the matter. The contact details of persons who have registered for marketing and campaign-specific draws will be deleted once the winner has been contacted and the prize has been delivered.

By default, when visiting our website, your visitor data is retained for 26 months for analysis and reporting purposes.

The average storage period for data generated by camera surveillance is 14 days. However, camera surveillance data may be retained for a longer period if required for the investigation of a crime, incident, or possible infringement, or if required for the filing of a legal claim or defense against such a claim. In such cases, camera surveillance data will be deleted at the latest when the judgment in a legal case in which the camera surveillance data was used is final, or the matter relating to the camera surveillance data has been conclusively settled.

  1. Protection of personal data

We make use of various administrative, organizational, technical, and physical safeguards to protect the personal data we collect and process. The personal data we process is stored on a system that is protected by security software within the operating system. A username and password are required to access the system. The system is also protected by firewalls and other technical means. Only Ruohonjuuri employees who are designated in advance for the purpose have access to and are authorized to use the data contained in the register stored in the system. The data contained in the register is kept in locked and guarded premises. We provide training to ensure our employees are knowledgeable about data protection matters.

We continuously evaluate our policies regarding the processing of personal data and the associated risks and implement measures in accordance with default data protection principles. If despite the aforementioned security measures, a security breach occurs that is likely to adversely affect personal privacy, we will notify the individuals affected as required by the applicable law, and will also notify the authorities as soon as practicable as required by the applicable data protection legislation.

  1. Your rights

Under the applicable legislation, every data subject has the right to

  1. More information about exercising your rights

 Data subjects cannot exercise all their rights without restriction in all situations. The exercise of rights is affected by various factors, such as the grounds for processing personal data. We will provide additional information case by case.

You have the right to request a register extract containing data about you from Ruohonjuuri Oy’s register free of charge once a year. In addition, you can exercise your rights. You can send a request for a register extract either via the electronic form on our website, in which case we will then contact you to verify your identity, or in writing. Requests made in writing must be signed by the person making the request. In the case of written requests, we ask that the subject of the request be clearly indicated in the letter, for example ‘Request to the Ruohonjuuri contact person for personal data.’

If you withdraw your consent, we will delete your personal data and discontinue the processing of it to the extent that your consent is required as soon as possible. However, please note that the same personal data may be used both on the basis of the consent of the data subject and if the processing of it is essential or required by legislation. For this reason, even if you withdraw your consent and the personal data processing related to this consent is consequently suspended, we may nonetheless retain the personal data for other purposes, such as to comply with statutory obligations to retain personal data.

All questions regarding our operations involving the processing of personal data or regarding the GDPR may be sent at any time to: tietosuoja@ruohonjuuri.fi.

  1. Right of appeal to a supervisory authority

 If you believe that your personal data is not being processed in accordance with the GDPR or other applicable legislation, you may lodge a complaint with the supervisory authority in the EU member state where you permanently live or work, or the EU member state where you believe the breach to have taken place. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman:

Office of the Data Protection Ombudsman
Address: Lintulahdenkuja 4, FI-00530 Helsinki

Telephone (exchange): + 358 29 56 66700
Email: tietosuoja@om.fi

More information is available on the website of the Office of the Data Protection Ombudsman.

  1. Amendment of the privacy statement

We reserve the right to make changes to this privacy statement from time to time, including as a result of updates to our privacy policies or changes in the applicable legislation. The latest version of this privacy statement is available on our website. The privacy statement was prepared on May 3, 2018. Last modified: March 11, 2024.