Privacy Notice

Privacy Notice

Updated 24 August 2026

This Privacy Notice explains how Kuulas hyvinvointi Oy processes personal data in connection with our beauty clinic, appointment booking, online store, Kuulas Skin Cycle service, customer service and marketing.

1. Controller and contact details

Kuulas hyvinvointi Oy
Business ID 3156814-1
Museokatu 5, 00100 Helsinki, Finland
Email: info@hoitolakuulas.fi
Tel. +358 10 517 9391

2. Data we process

  • Contact and customer information, including name, email address, telephone number, address and customer account details.
  • Appointment, visit and service information and details provided for treatments, consultations and Kuulas Skin Cycle. Health or skin-related information is processed only to the extent necessary for providing the service safely.
  • Order, payment, delivery, return and customer service information.
  • Marketing permissions, communication preferences and marketing usage information.
  • Reviews, feedback and information submitted through forms or chat.
  • Technical website information such as IP address, device and browser information, cookies, page visits, searches and advertising identifiers in accordance with your choices.

3. Sources of data

We mainly receive data directly from you when you make a booking, visit our clinic or online store, use our website, submit a form, attend a consultation, contact us or subscribe to marketing. We also receive technical information through cookies and similar technologies and necessary information from our service providers.

4. Purposes and legal bases

  • Contract: bookings, clinic and consultation services, online orders, payments, deliveries, returns and customer service.
  • Legal obligations: accounting, taxation, consumer protection and lawful authority requests.
  • Legitimate interests: managing customer relationships, developing services, preventing misuse, information security and permitted communications to existing customers. You may object to such processing.
  • Consent: electronic direct marketing where consent is required, optional analytics and marketing cookies, and special-category data where applicable. Consent may be withdrawn at any time.

5. Service providers and disclosures

We use service providers only as necessary to provide our services. Key providers include Phorest for bookings and customer management; Shopify for e-commerce; payment providers such as Paytrail, Klarna and Stripe; Packrooster and carriers such as GLS and UPS; Klaviyo, VanChat and Somenatiivi for communications, chat and forms; Google services for analytics and advertising; and Shopify applications such as Judge.me, Searchanise and LangShop. We may disclose necessary data to authorities where required by law and to a successor in connection with a business transaction, subject to appropriate safeguards.

6. Transfers outside the EU/EEA

Some international providers may process data outside the EU or EEA. We use an appropriate transfer mechanism, such as the European Commission's standard contractual clauses or an adequacy decision, together with necessary safeguards.

7. Retention

  • Customer, appointment and service information is retained for as long as reasonably required for the customer relationship, service delivery, safety and handling possible claims.
  • Order, payment and accounting records are retained for the statutory period; accounting material is generally retained for at least six years from the end of the year in which the financial year ended.
  • Marketing data is retained until consent is withdrawn or the data is no longer needed.
  • Form, chat and customer service messages are retained for the time needed to handle and reasonably follow up the matter.
  • Cookie retention periods are shown in the cookie settings and provider information.

8. Cookies and tracking

Necessary cookies support the online store, cart, login and security. Optional analytics and marketing cookies are used according to your choices. You can change your choices using the Cookie settings link on the website.

9. Security

We protect personal data with appropriate technical and organisational measures and restrict access to those who need it. Payment card data is processed by payment providers, and we do not normally store complete card details in our own systems.

10. Your rights

Subject to applicable law, you may request access, correction, erasure or restriction of your data; object to processing based on legitimate interests and to direct marketing; withdraw consent; receive eligible data in a portable format; and lodge a complaint with a data protection authority.

Contact info@hoitolakuulas.fi. We may request information to verify your identity. The Finnish supervisory authority is the Office of the Data Protection Ombudsman: tietosuoja.fi. You may also contact your local EU/EEA data protection authority.

11. Automated decision-making

We do not use solely automated decision-making that produces legal or similarly significant effects concerning you.

12. Changes

We may update this notice when our services or legal requirements change. The current version is published on this page, and significant changes will be communicated separately where appropriate.