Privacy Policy

Velours Noir

Last updated and effective from: 1 September 2026

1. INTRODUCTION

Velours Noir is committed to protecting your privacy and processing your personal data responsibly and transparently.

This Privacy Policy explains how TonkaBrand Oy, operating under the brand Velours Noir, collects, uses, stores, shares and otherwise processes your personal data when you visit our online store, interact with us or purchase our products.

We process personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), and, where applicable, the UK GDPR and other relevant data protection laws.

2. WHO WE ARE

The data controller responsible for your personal data is:

TonkaBrand Oy
Trading as: Velours Noir

Business ID: 3531600-5
VAT ID: FI35316005

Kraatarintie 18 C 14
21110 Naantali
Finland

Email: officialveloursnoir@gmail.com

TonkaBrand Oy is registered in Finland.

3. PERSONAL DATA WE COLLECT

We may collect the following categories of personal data.

3.1 Information You Provide to Us

When you place or attempt to place an order, contact us, request a return or otherwise interact with us, we may collect information including:

• Full name

• Billing address

• Shipping address

• Email address

• Telephone number

• Order information

• Products purchased

• Return and refund information

• Communications with our customer service

• Information you voluntarily provide to us

Payment transactions are processed through third-party payment providers.

We generally do not receive or store your complete payment card details.

3.2 Information Collected Automatically

When you visit or use our Website, we and our service providers may automatically collect certain information about your device and activity, including:

• IP address

• Browser type and version

• Device type

• Operating system

• Approximate location derived from IP address

• Pages viewed

• Products viewed

• Actions taken on the Website

• Referring website or advertising source

• Date and time of visits

• Session duration

• Shopping cart activity

• Checkout activity

• Cookie identifiers

• Advertising and analytics identifiers

• Other information collected using cookies and similar technologies

3.3 Information From Third Parties

We may also receive personal data from third parties involved in providing our services, including:

• Shopify

• Payment service providers

• Shipping and logistics providers

• Analytics providers

• Advertising platforms

• Fraud prevention services

• Customer service and communication providers

The information received depends on the service concerned.

4. HOW AND WHY WE USE PERSONAL DATA

We process personal data only where we have an appropriate legal basis.

4.1 Processing and Fulfilling Orders

We use your personal data to:

• Process your order

• Confirm your purchase

• Process payment

• Arrange fulfilment and delivery

• Send order and shipping updates

• Provide tracking information

• Communicate with you regarding your order

Legal basis: Performance of a contract.

4.2 Returns, Refunds and Customer Service

We use your data to:

• Handle returns

• Process refunds

• Resolve complaints

• Handle defective or incorrect products

• Provide customer support

• Respond to enquiries

Legal basis: Performance of a contract, compliance with legal obligations and, where applicable, our legitimate interests in providing customer service.

4.3 Fraud Prevention and Security

We may process information to:

• Detect fraudulent transactions

• Prevent misuse

• Protect our Website

• Protect our customers

• Verify transactions

• Enforce our Terms of Service

Legal basis: Legitimate interests and, where applicable, compliance with legal obligations.

4.4 Legal, Tax and Accounting Requirements

We process and retain certain information where necessary to comply with:

• Accounting requirements

• Tax requirements

• Consumer protection legislation

• Regulatory requirements

• Other legal obligations applicable to us

Legal basis: Legal obligation.

4.5 Analytics and Website Improvement

Subject to applicable consent requirements, we may use analytics technologies to understand how visitors use the Website and to:

• Analyse Website traffic

• Measure Website performance

• Understand customer behaviour

• Improve our products

• Improve the checkout experience

• Improve our marketing and services

Legal basis: Consent where required by law; otherwise legitimate interests where legally permitted.

4.6 Advertising and Personalisation

With your consent where required, we may use cookies, pixels and similar technologies to:

• Measure advertising performance

• Attribute purchases to advertising campaigns

• Build advertising audiences

• Show advertisements that may be more relevant to you

• Measure interactions with advertisements

• Personalise marketing content

This may involve sharing certain identifiers, Website activity or purchase-related information with advertising and analytics platforms.

Legal basis: Consent where required by applicable law.

You may withdraw your consent through the Website's cookie and privacy settings.

4.7 Email and Other Direct Marketing

Where legally permitted, we may use your email address or other contact information to send information about Velours Noir products, offers and promotions.

Where consent is required, we will obtain it before sending marketing communications.

You can unsubscribe from marketing at any time using the unsubscribe mechanism contained in our communications or by contacting us.

Legal basis: Consent or legitimate interests, depending on the circumstances and applicable law.

5. WHO WE SHARE PERSONAL DATA WITH

We do not sell your personal data in the ordinary meaning of selling customer databases for money.

However, we may disclose or make personal data available to third parties where necessary to operate our business and provide our services.

These recipients may include:

5.1 Shopify

Our online store is powered by Shopify.

Shopify processes customer and transaction information in connection with providing its e-commerce platform, hosting, checkout, security and related services.

For customers in the EEA and UK, personal data is initially received by Shopify International Limited in Ireland. Shopify may subsequently process or transfer data through other Shopify entities and subprocessors located in other countries.

5.2 Payment Providers

We share information with payment processors and financial service providers where necessary to:

• Process transactions

• Verify payments

• Prevent fraud

• Process refunds

Payment providers may process your personal data as separate controllers or processors depending on the service concerned.

5.3 Fulfilment, Warehouse, Shipping and Logistics Providers

We may share the personal data necessary to fulfil and deliver your order with:

• Warehouses

• Fulfilment providers

• Shipping agents

• Logistics providers

• Postal operators

• Couriers

• Customs and import service providers

This information may include:

• Your name

• Delivery address

• Telephone number

• Email address where necessary

• Order details

• Tracking and delivery information

Some of these providers may be located outside the European Economic Area ("EEA") and outside the United Kingdom, including in countries from which products are fulfilled or shipped.

We only provide information reasonably necessary for fulfilment, shipping, customs processing and delivery.

5.4 Analytics and Advertising Providers

Subject to your consent where required, we may share or make information available to analytics and advertising providers used by our Website.

These services may process:

• Cookie identifiers

• Device information

• IP address

• Website activity

• Advertising interactions

• Purchase and conversion information

5.5 Email, Customer Service and Communication Providers

We may use third-party services to provide:

• Customer support

• Transactional emails

• Marketing emails

• Order notifications

• Other customer communications

These providers may process contact information and communication history on our behalf.

5.6 Professional Advisers

We may disclose information where reasonably necessary to:

• Accountants

• Auditors

• Lawyers

• Tax advisers

• Insurers

• Other professional advisers

5.7 Authorities and Legal Requirements

We may disclose personal data where required or permitted by applicable law, including to:

• Courts

• Tax authorities

• Customs authorities

• Regulators

• Police or law enforcement agencies

• Other competent public authorities

5.8 Corporate Transactions

If TonkaBrand Oy or its business or assets are involved in a merger, acquisition, financing, restructuring, sale or similar corporate transaction, relevant personal data may be disclosed to prospective or actual purchasers, advisers and other parties involved in the transaction, subject to applicable law.

6. INTERNATIONAL DATA TRANSFERS

Because we operate an international e-commerce business and use global service providers, your personal data may be transferred to, stored in or processed in countries outside the EEA and the United Kingdom.

Such countries may include, depending on the service providers and fulfilment methods used:

• Canada

• United States

• United Kingdom

• Countries in Asia

• Other countries where our technology, payment, advertising, fulfilment or logistics providers operate

This may occur, for example, when:

• Shopify or its subprocessors process data internationally;

• an international payment provider processes a transaction;

• an analytics or advertising provider processes Website data;

• an order is fulfilled by an international warehouse or fulfilment partner;

• customer details are provided to international logistics providers for shipping and delivery.

6.1 Transfers From the EEA

Where personal data protected by the GDPR is transferred outside the EEA, we will rely on a valid transfer mechanism as required by applicable law.

Depending on the destination and recipient, these mechanisms may include:

• An adequacy decision adopted by the European Commission;

• The European Commission's Standard Contractual Clauses ("SCCs");

• Binding Corporate Rules;

• The EU–US Data Privacy Framework where applicable to an eligible and participating recipient;

• Other lawful transfer mechanisms or derogations permitted under applicable data protection legislation.

Where required, additional safeguards and assessments may also be implemented.

6.2 Transfers Involving United Kingdom Personal Data

Where the UK GDPR applies and personal data is transferred outside the United Kingdom, we will use an appropriate transfer mechanism where required.

Depending on the recipient and destination, this may include:

• UK adequacy regulations;

• The UK Extension to the EU–US Data Privacy Framework where applicable;

• The UK International Data Transfer Agreement ("IDTA");

• The UK Addendum to the European Commission's Standard Contractual Clauses;

• Other legally recognised transfer mechanisms.

6.3 Shopify International Transfers

Although certain Shopify customer data may be stored in Europe, Shopify operates internationally.

Personal data may therefore be transferred to Shopify group companies and subprocessors outside the EEA and UK, including in Canada and the United States.

Shopify states that it uses legally recognised international transfer mechanisms and contractual safeguards for such transfers.

6.4 Fulfilment and Logistics Transfers

Where an order is fulfilled or shipped through a service provider located outside the EEA or UK, we may transfer the information necessary to fulfil and deliver that order to the relevant provider.

We seek to limit such transfers to information reasonably necessary for fulfilment and delivery and use appropriate data protection arrangements where required by applicable law.

You may contact us at officialveloursnoir@gmail.com if you would like further information about the safeguards applicable to international transfers of your personal data.

7. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and as required by applicable law.

Retention periods depend on the type of information and why it is processed.

7.1 Order and Transaction Records

Order, transaction, accounting and related information may be retained for the period required under Finnish accounting, taxation and other applicable legislation.

Certain accounting records are generally required to be retained for several years.

7.2 Customer Service Records

Customer service communications may be retained for a reasonable period after the matter has been resolved where necessary to:

• Provide support

• Maintain records

• Resolve disputes

• Establish, exercise or defend legal claims

7.3 Marketing Information

Marketing contact information may be retained until you:

• Withdraw your consent;

• Unsubscribe;

• Object to direct marketing; or

• The information is no longer necessary for the relevant purpose.

We may retain limited information indicating that you have opted out so that we can respect your preference.

7.4 Cookie and Analytics Information

Cookie and analytics retention periods depend on the cookie or service concerned and are described, where applicable, through our cookie consent tools and settings.

7.5 Legal Claims

Information may be retained for longer where reasonably necessary for the establishment, exercise or defence of legal claims or where required by law.

8. COOKIES AND SIMILAR TECHNOLOGIES

Our Website uses cookies, pixels and similar technologies.

These technologies may include:

• Essential cookies

• Functional cookies

• Analytics cookies

• Advertising cookies

• Conversion tracking technologies

Essential technologies may be used where necessary for the Website, checkout, security or other services requested by you.

Where required by applicable law, non-essential analytics, advertising and similar tracking technologies will not be activated until you have provided the required consent.

You can withdraw or modify your consent through the Website's cookie or privacy settings.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

9. YOUR DATA PROTECTION RIGHTS

Depending on your location and applicable law, you may have rights concerning your personal data.

These may include:

9.1 Right of Access

You may request confirmation as to whether we process your personal data and request a copy of your personal data.

9.2 Right to Rectification

You may request that inaccurate personal data be corrected or incomplete information completed.

9.3 Right to Erasure

You may request deletion of personal data in circumstances provided by law.

This right is not absolute. We may be required to retain certain information for legal, accounting, tax, fraud-prevention or legal-claims purposes.

9.4 Right to Restriction

You may request that processing of your personal data be restricted in circumstances provided by law.

9.5 Right to Data Portability

Where applicable, you may request personal data provided by you in a structured, commonly used and machine-readable format and may have the right to transmit that data to another controller.

9.6 Right to Object

Where processing is based on legitimate interests, you may have the right to object to that processing.

You have the right to object at any time to processing of your personal data for direct marketing purposes.

9.7 Right to Withdraw Consent

Where we rely on your consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.8 Right to Complain

You have the right to lodge a complaint with a competent data protection supervisory authority.

10. AUTOMATED PROCESSING AND FRAUD SCREENING

Our e-commerce, payment and fraud-prevention providers may use automated technologies to identify transactions that potentially involve fraud, security threats or misuse.

We do not intend to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals unless such processing is permitted by applicable law and appropriate safeguards are provided.

11. WHETHER YOU MUST PROVIDE PERSONAL DATA

Certain personal data is necessary to enter into and perform a purchase contract with us.

For example, we generally require:

• Your name

• Delivery address

• Contact information

• Information necessary to process payment

If you do not provide information required to process payment or deliver an order, we may be unable to accept or fulfil your order.

Providing information for optional marketing purposes is not required to purchase from us.

12. DATA SECURITY

We use appropriate technical and organisational measures designed to protect personal data against:

• Accidental loss

• Destruction

• Unauthorised access

• Unauthorised disclosure

• Alteration

• Misuse

We also require service providers handling personal data on our behalf to provide appropriate safeguards where required by applicable law.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

13. CHILDREN

Our products and Website are not specifically directed at young children.

We do not knowingly seek to collect personal data from children where doing so would be unlawful.

If we become aware that personal data has been collected from a child in circumstances where parental or guardian consent is legally required and has not been obtained, we will take appropriate steps in accordance with applicable law.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• Changes in applicable law;

• Changes to our service providers;

• Changes to our Website;

• Changes to our business operations; or

• Changes to the ways in which we process personal data.

The current version and effective date will be published on the Website.

Where required by law, we will provide additional notice of material changes.

15. CONTACT US

For questions concerning this Privacy Policy, the use of your personal data, or to exercise a data protection right, please contact:

Velours Noir / TonkaBrand Oy

TonkaBrand Oy
Business ID: 3531600-5
VAT ID: FI35316005

Kraatarintie 18 C 14
21110 Naantali
Finland

Email: officialveloursnoir@gmail.com

16. SUPERVISORY AUTHORITIES

16.1 Finland and the European Economic Area

As TonkaBrand Oy is established in Finland, the competent Finnish supervisory authority is the:

Office of the Data Protection Ombudsman (Finland)

You may lodge a complaint with the supervisory authority if you believe your personal data has been processed unlawfully.

You may also have the right to lodge a complaint with another competent supervisory authority in the EEA, particularly in the country where you live or work or where you believe an infringement occurred.

16.2 United Kingdom

Where the UK GDPR applies to our processing, individuals in the United Kingdom may also have the right to lodge a data protection complaint with the:

Information Commissioner's Office (ICO)

Nothing in this Privacy Policy limits any right to contact a competent data protection authority under applicable law.