Our company, Fairytale Adventures Oy, is committed to protecting the privacy of users in accordance with the Personal Data Act (523/1999), the Act on the Protection of Privacy in Electronic Communications (516/2004), and other applicable legislation. The purpose of this privacy policy is to inform you about the type of information we collect from users of our website, how we use that information, and how we disclose this information to third parties. We also describe our cookie practices on our website and third-party websites in this privacy policy. By using the site, you agree to the processing of your personal data in accordance with this privacy policy.

DATA CONTROLLER

Company: Fairytale Adventures Oy (Business ID: 2599291-5)

CONTACT DETAILS FOR DATA PROTECTION ISSUES Contact Person: Petronella Grahn Phone: +358 40 2801 603 Email: [email protected]

REGISTER NAME Customer data register of Pomenia’s website

BASIS FOR KEEPING THE REGISTER A person has registered as a customer in the online store or participated in a Pomenia or Tinttu.com competition/sweepstakes, providing their email address.

PURPOSE OF THE REGISTER The purpose of the register is to maintain Pomenia’s customer register. The information may be used for the development of Pomenia’s operations and for statistical purposes, as well as for sending newsletters. Personal data is processed within the limits and requirements of the Personal Data Act. The register information may be used in Pomenia’s own registers for advertising purposes without disclosing personal data to third parties. Pomenia may use cooperation partners for maintaining customer and service relationships. Some of the register data may be transferred to the servers of cooperation partners for technical requirements. The data is processed only for maintaining Pomenia’s customer relationship through technical interfaces. Pomenia has the right to publish the information contained in the customer register as an electronic or written list unless the customer specifically prohibits it. The list may include, for example, address labels for direct mail or sending newsletters. The customer has the right to prohibit the publication of information by notifying Pomenia’s customer service via email at [email protected]. The newsletter can be unsubscribed from via a direct link in the newsletter.

INFORMATION INCLUDED IN THE REGISTER The personal data register includes the following information: Person’s first and last name Email address

DISCLOSURE OF INFORMATION Information is not disclosed outside Pomenia. Personal data is not transferred outside the European Union. The personal data of the registered individual is destroyed upon request.

REGISTER SECURITY The register is not disclosed to third parties. Electronic personal data is protected by commonly accepted technical means of information security, such as firewalls and passwords. Materials containing personal data in a non-electronic form are kept in premises where access is restricted from unauthorized individuals. Only designated employees of the data controller and companies acting on its behalf have access to personal data with the permission granted by the data controller.

REGULAR SOURCES OF INFORMATION Information is primarily collected directly from the customer through online store orders, return and other forms, email, or similar means. Additionally, we may receive additional information from our cooperation partners, such as credit service providers. We may also collect information from public sources and registers. We also collect information about website visitors, such as through Google Analytics. This information is collected to analyze and improve our website and target relevant marketing to visitors.

BASIS FOR USING PERSONAL DATA We ensure that there is always a legal basis for processing your personal data. We may process your data on several different legal bases. We process your data to fulfill a contract and comply with legal obligations. We also process your personal data based on our legitimate interests, which include providing our services and conducting and developing our business. Some personal data may also be processed based on your consent.

REGULAR DISCLOSURES OF INFORMATION Information is used only for managing customer relationships and is not regularly further disclosed to third parties. However, information may be disclosed in connection with technical administration of the online store (e.g., server or online store platform administration), order delivery, collection of unpaid invoices, and to authorities upon their request and within the limits of the law.

RIGHT TO INSPECT According to the Personal Data Act, everyone has the right to inspect what information concerning them has been stored in the personal register. Requests for inspection must be sent in a document signed by hand or verified in a corresponding manner, or presented personally at our office. Requests should be sent to the contact person mentioned above, who is also responsible for any additional information requests.

UPDATING INFORMATION Customers can contact our contact person mentioned above to update their information.

OTHER RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA Customers have the right to object to the processing of their data for marketing purposes. Requests for processing restrictions should be sent via email to the register’s contact person. Customers can decide on targeted marketing, additional services, and whether to receive different marketing messages.

DATA RETENTION AND DELETION Customer register information is retained for the duration of the customer relationship. However, retention periods for personal data may vary depending on the purpose and situation. We also periodically update your information. However, order, billing, and payment information are stored like other accounting material. Obsolete information is securely destroyed.

USE OF COOKIES We may use cookies to track visitor traffic and improve the quality of our service, which are stored on the user’s computer. The validity period of cookies is limited, and they do not cause harm to the user’s computer.

COOKIES AND GOOGLE ANALYTICS We use cookies on our website to provide the best possible user experience for visitors to the site. Cookies are short text files that the web server stores on the user’s terminal device. Cookies provide us with information about how users use our website. We may use cookies to develop our services and website, analyze website usage, and target and optimize marketing. Examples of collected data include: how the user arrived at our site, which subpage the user landed on, and how long the user spent on our site. Website users can give their consent or deny the use of cookies from their web browser settings. Most web browsers automatically allow cookies. Please note that blocking cookies may limit the functionality of our website. We use Google Analytics visitor tracking on pomenia.com pages. Google Analytics is commonly used on websites. It anonymously and statistically analyzes the number of visitors, providing information such as: • User’s IP address and browser type • From which web address and server the user came • From which domain the user came to the website. For more information about the service, please visit here. If desired, you can also block the use of the Google Analytics service.

COOKIES ON THIRD-PARTY SITES In addition to cookies used on our website, cookies are also used to target our advertising on third-party sites. We cooperate with companies specializing in online advertising technology. Based on the information collected through these partners’ cookies and other technologies, our advertisements can be targeted to those web users who are likely to be most interested in our advertisements, based on previous online behavior and other factors. In this targeting, behavioral information collected from websites outside our own website may also be used. Our partners and we may also collect information about the effectiveness of our advertisements sent. For this purpose, we may collect, for example, the following information: • information on how many times a particular ad has been displayed in the browser; • information on whether the ad has been opened • information on whether opening the ad led to purchasing a product in the online store

We reserve the right to change this privacy policy by informing about it on the website. We recommend that you regularly review the contents of the privacy policy. You can send inquiries related to this privacy policy to: [email protected]