Privacy Policy
Last updated: 2026-10-10
Template, have it reviewed. GDPR (EU 2016/679) privacy notice.
Controller
Bumba Clothing, 2929849-6, Pasuunatie 9, 00420 Helsinki, Finland. Contact: bumbavibing@gmail.com.
What we process and why
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Name, email, phone, shipping address, order contents | Fulfil and deliver your order, customer service | Contract, Art. 6(1)(b) | Bookkeeping: 6 years after the end of the financial year (Finnish Accounting Act) |
| Payment data | Payment, fraud prevention, processed by our payment provider (see below); we only receive status and last digits | Contract; legitimate interest (fraud) | As above |
| Messages to support, withdrawal notices | Answer you, handle withdrawals and complaints | Contract; legal obligation | 3 years |
| Bumba Guide chat messages | Answer your question in real time. Not linked to your identity unless you type an order number + email. | Legitimate interest (customer service) | Not stored by us beyond the session; usage counts only |
| Drop alert email | One-off notification when a drop goes live | Consent, Art. 6(1)(a), withdraw anytime | Until the drop + 30 days or until you unsubscribe |
| Pack Rewards (email, code, referrals) | Run the referral programme | Contract | While active + 2 years |
| Drop list email + your personal welcome code | New-drop emails (max twice a month) and the first-order discount you asked for | Consent, Art. 6(1)(a), one-click unsubscribe in every email | Until you unsubscribe |
| Reviews (first name + initial, rating, text, size/colour bought) | Publish buyer reviews; prove they come from real buyers | Legitimate interest (honest product info for other shoppers) | While the product is sold; deleted on request |
| Gift note | Printed on the packing slip | Contract | With the order (bookkeeping period) |
| Shop statistics: page and product views, add-to-cart, checkout, purchases, referring site, campaign tags, phone/desktop, language | Understand which products and campaigns work | Legitimate interest, Art. 6(1)(f) | 13 months. No cookies, nothing stored on your device, no IP address kept, a visitor is an anonymous hash that changes every day |
Processors & recipients
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). PayPal payments; receives order number, amount and the delivery address you entered.
- Stripe Payments Europe Ltd (Ireland), card and wallet payments.
- Banks, for bank transfers we see your name, account number and reference on our bank statement (kept for bookkeeping, 6 years under Finnish law).
- Printful Inc. and its EU production centres (Latvia, Spain), printing and shipping; receives name, address, phone, email and order items. Transfers to the USA are covered by the EU Standard Contractual Clauses.
- Google Ireland Ltd (Gmail), sends our order and drop emails; receives your email address and the email's content.
- Carriers chosen by the production partner, delivery.
- Anthropic (Claude AI), only if the AI features are enabled: Bumba Guide chat text and support messages for triage. Transfers outside the EU are covered by the EU Standard Contractual Clauses / EU-US Data Privacy Framework as applicable.
- Our hosting provider, [hosting provider, location].
Cookies & browser storage
Only what the shop needs to work or what you asked for (your cart, saved items). No advertising or tracking cookies, and our statistics don't use cookies at all, so there is no consent banner. Full list: Cookies & storage. Fonts and images are self-hosted, no third-party requests.
AI transparency
The Bumba Guide is an AI system; it says so in the chat window (EU AI Act, Art. 50). Support replies may be drafted with AI and are always reviewed by a human.
Automated decisions
None. No profiling, no personalised pricing.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. Email bumbavibing@gmail.com. You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local authority.