Privacy policy

This privacy policy explains how Wels Oy processes personal data in the Weldstore online shop (www.weldstore.fi) and what rights you have. It is based on the EU General Data Protection Regulation (EU) 2016/679.

This policy applies from 29 September 2026 and replaces the policy dated 15 December 2018.

1. Controller and contact details

Wels Oy (Weldstore), Business ID 2946792-3
Kirkkomäentie 5, 07880 Liljendal, Finland
Email: info@weldstore.fi
Phone: +358 40 483 0006

Please send questions and requests about data protection to info@weldstore.fi. We have not appointed a data protection officer, as the GDPR does not require one for our activities.

2. What data we process

• Contact details: name, delivery and billing address, email address and phone number.
• Order details: order number, products ordered, prices, delivery method and costs, order status and tracking details, and any returns, complaints and refunds.
• Payment details: payment method, payment status and transaction reference. We do not see or store your card number or online banking credentials; these are handled by the payment service.
• Customer account details: if you create a customer account, the account details, saved addresses, order history and the time of your last login.
• Business customer details: company name, Business ID, e-invoicing address and operator ID, and the contact person's name and contact details, when you register as a business customer or ask to pay by invoice.
• Customer communications: emails, messages sent through contact forms and other customer service communications.
• Marketing consents: newsletter subscription, the time consent was given and any withdrawal of consent.
• Back-in-stock notifications: if you ask to be told when a sold-out product is available again, your email address, the product and the time of the request.
• Withdrawals: if you withdraw from an order using the withdrawal function in the online shop (the “Withdraw from contract” button in the bottom left-hand corner of every page), your name, email address, order number and order date, the products concerned, any additional information you write, and the time the withdrawal was sent.
• Technical data: IP address, browser and device details, cookie identifiers, and the pages you view and the products you add to your cart. See section 10.

3. Where we get the data

• From you, when you place an order, create a customer account, subscribe to the newsletter, fill in a form or contact us.
• From your use of the online shop through cookies and similar technologies, where they are necessary or you have consented to them.
• From payment services, confirmation of whether a payment has succeeded.
• From carriers and suppliers, information on the progress of your shipment.

We do not obtain data from the Finnish Population Information System or from credit reference registers, and we do not carry out credit checks. If you choose a Klarna payment method at checkout, Klarna may carry out its own check as an independent controller.

4. Why we process data and on what legal basis

• Processing, delivering and taking payment for orders, returns and complaints, and related customer service. Legal basis: contract (Article 6(1)(b) GDPR). Without this data we cannot deliver your order.
• Invoicing business customers. Legal basis: contract (Article 6(1)(b)).
• Accounting, VAT and compliance with consumer protection and product safety legislation. Legal basis: legal obligation (Article 6(1)(c)).
• Running the online shop securely, preventing misuse, developing the service and compiling sales statistics. Legal basis: our legitimate interest in keeping the online shop secure and working and in developing it (Article 6(1)(f)).
• Establishing, exercising or defending legal claims. Legal basis: legitimate interest (Article 6(1)(f)).
• Newsletter and other electronic direct marketing. Legal basis: your consent (Article 6(1)(a)). We only send electronic marketing if you have consented to it. You can withdraw your consent at any time using the link at the end of every message or by contacting us.
• Non-essential cookies. Legal basis: your consent (Article 6(1)(a)).
• Withdrawal function. We process the details of your withdrawal so that we can receive it, identify your order, send you the confirmation required by law and handle the return and refund. Legal basis: legal obligation (Article 6(1)(c) and Chapter 6, section 14 a of the Finnish Consumer Protection Act) and contract (Article 6(1)(b)). The time of sending is stored because the confirmation must state the date and time the withdrawal was submitted.
• Back-in-stock notification. We send you one email when the product you asked about is available again. Legal basis: your request, i.e. steps taken before entering into a contract (Article 6(1)(b)). The notification is not a reservation, and we do not send you marketing on the basis of this request.
• Google customer survey. If you opt in on the order confirmation page, Google emails you a short survey about your purchase after delivery. Legal basis: your consent (Article 6(1)(a)). If you do not opt in, no data is shared.

5. How long we keep data

• Order, payment and invoicing data, together with withdrawals, complaints, warranty matters and other communications relating to an order: six years from the end of the year in which the financial year ended (Chapter 2, section 10 of the Finnish Accounting Act).
• Customer account: until you delete the account or ask us to delete it. We delete accounts that have not been logged into for three years. Order data linked to the account is kept as set out above.
• Business customers' contact person details: for the duration of the customer relationship. If the company has not ordered from us for three years, we delete the details, except for accounting records.
• Other customer service communications: two years from the contact.
• Marketing consents: until you withdraw your consent. A record of your marketing opt-out is kept for as long as needed to respect it.
• Back-in-stock notifications: until the notification has been sent, and no longer than 12 months from the request.
• Cookie data: for the lifetime of each cookie.

When the retention period ends, we delete the data or make it anonymous so that you can no longer be identified.

6. Who we share data with

We do not sell your personal data. We share data only with the recipients listed below and only as far as each of them needs it for its task. Service providers that process data on our behalf may use it only on our instructions and not for their own purposes.

Online shop platform

• Shopify (Shopify International Limited, Ireland): the platform that runs the shop, checkout, orders and customer accounts.

Delivering your order

• Suppliers who pack and ship your order. Products are mainly shipped directly from our suppliers, so your name, delivery address, phone number, the products ordered and any note you added to the order are sent to the supplier by email. Our suppliers are in Finland, Poland and Latvia, all within the EU. If an order is split between several suppliers, each receives only the details for its part.
• Printful: printing and shipping of Weldstore Streetwear products. Printful receives your name, delivery address, contact details and the products ordered.
• Carriers such as Posti: transport and tracking of shipments and arrival notifications.

Payments and financial administration

• Shopify Payments: card and mobile wallet payments (for example Shop Pay, Apple Pay and Google Pay).
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), if you pay with PayPal.
• Klarna (Klarna Bank AB (publ), Sweden), if you choose a Klarna payment method.
• Vipps MobilePay, if you pay with MobilePay.
• Invoicing and financial management system and our accounting firm: invoicing and bookkeeping.

Payment services process the details of the payment transaction as independent controllers under their own privacy policies.

Communications and marketing

• Shopify Messaging (part of the Shopify platform): newsletters and reminders about orders left unfinished at checkout. Shopify processes contact details, order data, and data on opened messages and clicked links.
• Microsoft 365 (Microsoft Ireland Operations Limited): our business email, used for customer service, messages from the online shop's forms and forwarding orders to suppliers.
• WhatsApp: if you contact us using the WhatsApp button in the online shop, your message and phone number are processed in WhatsApp (Meta) under its own terms.
• Google Customer Reviews: if you opt in on the order confirmation page, your email address, order number, delivery country and estimated delivery date are passed to Google, which sends the survey and calculates our shop rating from the answers. Google processes the survey data under its own privacy policy. The data reaches Google through the Shopify app Dawnify (Meggnoapps Pte. Ltd.).

Advertising and analytics (only with your consent)

• Meta (Facebook and Instagram): targeting advertising and measuring results with the Meta pixel.
• Google: website analytics (Google Analytics) and ad targeting and measurement (Google Ads). When you place an order, Google Ads receives your email address and phone number in hashed form (SHA-256) so that the purchase can be matched to the ad you clicked (enhanced conversions). Google does not see the data in plain text and processes it for this purpose on our behalf.
• Snapchat: ad targeting and measurement.

Other recipients

• Authorities, where required by law.
• Legal and debt collection services, if a debt has to be collected or a dispute is taken to court.

The withdrawal function is part of our online shop. Its data is sent via Shopify to our customer service email (info@weldstore.fi) and is not shared with anyone else.

7. Transfers outside the EU and EEA

Order data sent to our suppliers stays within the EU. However, some service providers belong to groups with operations outside the EU and EEA or use subcontractors there:

• Shopify: group companies are located in Canada and the United States, among other places. Shopify transfers data within the group under binding corporate rules and to other parties under standard contractual clauses.
• Printful: its parent company is in the United States, and data may also be processed there.
• Meta, Google and Snapchat: data is also processed in the United States. These services are used only with your consent (see section 10).
• Microsoft: data may be accessed from the United States, for example for maintenance and support.
• PayPal: payment transaction data is also processed in the United States.
• WhatsApp: the service provider may process data outside the EU.
• Dawnify (Meggnoapps Pte. Ltd.): the customer survey data passes through this service provider and may be processed in Singapore. Data is passed on only if you opt in on the order confirmation page.

These transfers rely on safeguards under Chapter V of the GDPR: a European Commission adequacy decision (for example the EU-US Data Privacy Framework), standard contractual clauses approved by the Commission, or binding corporate rules. Klarna and Vipps MobilePay describe any transfers in their own privacy policies. You can ask for more information about the safeguards at info@weldstore.fi.

8. How we protect data

• The online shop uses an encrypted connection (TLS), and data is stored in Shopify's secure service.
• Only people who need customer data for their work can access it, using personal user accounts.
• Orders are forwarded to suppliers by email (Microsoft 365). The message contains only the details needed for delivery, not payment details or purchase history.
• We report personal data breaches to the Office of the Data Protection Ombudsman and, if a breach is likely to result in a high risk to your rights, also to you.

9. Your rights

• Right of access: you can find out whether we process data about you and get a copy of it.
• Right to rectification: you can ask us to correct inaccurate data and complete incomplete data.
• Right to erasure: you can ask us to delete your data if it is no longer needed. We cannot delete data we are required by law to keep, such as accounting records.
• Right to restriction of processing: for example when you contest the accuracy of the data.
• Right to data portability: you can receive the data you have given us, which we process on the basis of consent or contract, in a machine-readable format.
• Right to object: you can object to processing based on legitimate interest on grounds relating to your particular situation. You can object to direct marketing at any time without giving a reason.
• Right to withdraw consent: for example for the newsletter or cookies. Withdrawal does not affect the lawfulness of processing before it.

Send your request to info@weldstore.fi. We may ask you to prove your identity. We will reply within one month; if the request is complex, we may extend this by up to two months and will let you know. Making a request is free of charge.

If you believe we are processing your data unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman: Lintulahdenkuja 4, 00530 Helsinki, Finland, phone +358 29 566 6700, email tietosuoja@om.fi, www.tietosuoja.fi. We would appreciate it if you contacted us first.

10. Cookies

A cookie is a small text file that a website stores on your device. We use the following cookies:

• Essential cookies keep your cart, enable login and checkout, store your cookie choices and keep the shop secure. They do not require consent.
• Analytics cookies show how the online shop is used. We use them only with your consent.
• Marketing cookies target advertising and measure its results. We use them only with your consent.

We ask for your consent through the online shop's cookie notice. You can accept or reject non-essential cookies equally easily or choose them by category. With your consent we use cookies and tags from Google Analytics, Google Ads, Meta and Snapchat, and measurement by Printful.

You can change your choice or withdraw your consent at any time by deleting the online shop's cookies in your browser, after which the cookie notice is shown again. You can also block cookies in your browser settings, but some features of the online shop may then not work.

11. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, and we do not profile you in a way that has legal or similarly significant effects on you. If you subscribe to our emails, we may tailor their content to your order history and remind you about an order left unfinished at checkout. You can stop this by unsubscribing via the link at the end of every message.

12. Changes to this policy

We update this policy when our activities or the law change. The current version is always on this page, and we will tell you separately about significant changes.

Updated 8 October 2026.