Privacy policy
Last updated: 10 August 2026
1. Who We Are
This Privacy Policy explains how Gato Gloves Oy collects, uses, stores and shares personal data when you:
- visit gatogloves.com;
- purchase products from us;
- create or use a customer account;
- contact our customer service;
- submit a product review;
- subscribe to marketing communications; or
- otherwise interact with our online store.
The data controller is:
Gato Gloves Oy
Business ID: 3597883-4
Tunturikatu 18
00100 Helsinki
Finland
Email: info@gatogloves.com
In this Privacy Policy, “GATO”, “we”, “us” and “our” refer to Gato Gloves Oy.
2. Personal Data We Collect
Depending on how you interact with GATO, we may collect the following categories of personal data.
Contact and Identity Information
This may include:
- name;
- email address;
- telephone number;
- billing address;
- delivery address; and
- country or region.
Order and Transaction Information
This may include:
- products ordered;
- product sizes and variants;
- order value;
- discounts and bundles used;
- delivery method;
- order history;
- return or exchange information; and
- information relating to customer service cases.
Payment Information
Payments are processed by Shopify and/or third-party payment service providers.
GATO does not store full payment card numbers or full card authentication information.
Payment providers may process information necessary to:
- process payments;
- prevent fraud;
- verify transactions; and
- comply with their legal obligations.
Customer Account Information
If you create a customer account, we may process information relating to:
- your account;
- login activity;
- saved customer information; and
- order history.
Customer Service and Communications
If you contact us by:
- email;
- WhatsApp;
- website forms;
- social media; or
- another communication channel,
we may process the information contained in your message and other information necessary to respond to your request.
If you contact us through a third-party platform such as WhatsApp or a social media service, that provider may also process your personal data under its own privacy terms.
Reviews and User-Generated Content
If you submit a product review, we may process:
- your name or chosen display name;
- review content;
- rating;
- photographs or videos you submit;
- product and order information used to verify the review; and
- technical information necessary to prevent fraudulent reviews.
Information that you choose to include in a public product review may be visible to other visitors of the website.
Technical and Website Usage Data
When you use our website, we may automatically collect information such as:
- IP address;
- device type;
- operating system;
- browser type;
- pages viewed;
- referring website;
- interactions with the website;
- session identifiers;
- cookie identifiers;
- cart and checkout activity; and
- approximate location derived from technical information such as IP address.
3. How We Collect Personal Data
We collect personal data:
Directly from you
For example when you:
- place an order;
- create an account;
- contact us;
- submit a review;
- subscribe to marketing; or
- provide information during a return or exchange.
Automatically
Certain technical information is collected when you use our website through:
- cookies;
- pixels;
- server logs;
- Shopify technologies; and
- similar technologies.
From service providers
We may receive information from companies that help us operate the store, including:
- Shopify;
- payment providers;
- delivery providers;
- review platforms;
- bundle and cart applications; and
- analytics or advertising platforms.
4. Why We Process Personal Data
We process personal data for the following purposes.
Orders and Contract Performance
We process personal data to:
- process orders;
- receive payments;
- deliver products;
- manage returns and exchanges;
- provide order information; and
- fulfil our contractual obligations.
Legal basis: performance of a contract or steps taken at your request before entering into a contract.
Customer Service
We process information necessary to:
- answer questions;
- resolve order issues;
- handle returns and exchanges;
- process complaints; and
- provide customer support.
Legal basis: performance of a contract and/or our legitimate interest in providing customer service and managing our customer relationships.
Legal and Accounting Obligations
We process and retain information where required for:
- bookkeeping;
- taxation;
- consumer protection;
- regulatory obligations; and
- legal claims.
Legal basis: compliance with legal obligations.
Security and Fraud Prevention
We may process information to:
- protect our customers;
- prevent fraudulent transactions;
- protect our website;
- investigate misuse; and
- maintain the security of our systems.
Legal basis: our legitimate interests in preventing fraud and protecting our business, customers and systems, and where applicable compliance with legal obligations.
Improving Our Store
We may analyse information to understand how customers use the website and to improve:
- website functionality;
- customer experience;
- product presentation;
- store performance; and
- purchasing flows.
Where such processing requires cookies or similar technologies that require consent, the legal basis is your consent.
For other limited processing that does not require consent, the legal basis may be our legitimate interests where those interests are not overridden by your rights.
Marketing
We may use your personal data to send marketing communications where you have consented to receive them or where otherwise permitted by applicable law.
Legal basis: consent and, where specifically permitted by applicable law, legitimate interests.
You can unsubscribe from marketing communications at any time.
5. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
These may include:
Strictly Necessary Cookies
These are required for functions such as:
- shopping cart operation;
- checkout;
- security;
- customer login;
- language or privacy preferences; and
- core Shopify functionality.
Where permitted by law, strictly necessary technologies may operate without consent because they are required to provide the service requested by the user.
Analytics Cookies
Analytics technologies may help us understand:
- website traffic;
- how pages are used;
- technical performance; and
- how customers move through the store.
Marketing and Advertising Technologies
Where enabled, we may use technologies such as Meta Pixel or similar advertising tools to:
- measure advertising effectiveness;
- understand conversions;
- create advertising audiences; and
- improve advertising relevance.
Where consent is required by applicable law, non-essential analytics and advertising technologies are used on the basis of your consent.
You can accept, reject or manage non-essential cookies through the privacy or cookie controls provided on the website.
Withdrawing consent does not affect the lawfulness of processing that occurred before consent was withdrawn.
EU rules generally require consent before information is stored on or accessed from a user's device unless the technology falls within a permitted exemption, such as where it is strictly necessary for a service requested by the user.
6. Service Providers and Other Recipients
We disclose personal data only where necessary for the purposes described in this Privacy Policy.
Recipients may include:
Shopify
Our online store is hosted and operated using Shopify.
Shopify processes personal data necessary to provide the ecommerce platform, hosting, checkout, security and related services.
For certain Shopify services, Shopify may also process information in its own role in accordance with its own privacy terms.
Payment Providers
Payment providers process information necessary to:
- complete transactions;
- authenticate payments; and
- prevent payment fraud.
Shipping and Logistics Providers
We provide necessary information such as:
- name;
- delivery address;
- telephone number;
- email address; and
- shipment information
to carriers and logistics providers when required to deliver your order.
Store Applications and Technology Providers
We may use third-party applications to provide functionality such as:
- product bundles;
- shopping cart functionality;
- customer reviews;
- marketing;
- analytics; and
- customer communications.
This may include services such as Kaching and Judge.me where those services are enabled in our store.
These providers receive only information that is necessary for the relevant service, subject to their respective roles and privacy obligations.
Advertising Platforms
Where you have provided the required consent, information may be transmitted to advertising providers such as Meta Platforms Ireland Limited through technologies such as Meta Pixel.
Certain processing connected with Meta Business Tools may involve GATO and Meta acting as joint controllers for the collection and transmission of relevant event information.
Authorities and Legal Recipients
We may disclose information where required to:
- comply with law;
- respond to lawful requests from authorities;
- establish, exercise or defend legal claims; or
- protect the rights, property or safety of GATO, our customers or others.
7. International Transfers of Personal Data
Some of our service providers operate internationally.
As a result, personal data may in certain cases be processed or transferred outside Finland or the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we take steps to ensure that the transfer is made using a lawful transfer mechanism where required.
Depending on the recipient and destination, these safeguards may include:
- an adequacy decision adopted by the European Commission;
- the European Commission's Standard Contractual Clauses;
- another legally recognised transfer mechanism; or
- other safeguards required by applicable data protection law.
Shopify's current data-processing terms provide mechanisms for international transfers of merchant customer data, and GDPR requires appropriate safeguards where personal data is transferred outside the EEA.
8. How Long We Keep Personal Data
We do not retain personal data for longer than necessary.
Retention periods depend on:
- the purpose for which the data was collected;
- the nature of our relationship with you;
- legal and accounting obligations;
- fraud and security requirements; and
- the need to establish or defend legal claims.
For example:
Order and Accounting Information
Order and transaction information is retained for the period required under applicable accounting, tax and consumer protection laws.
Customer Service Information
Customer service records are retained for as long as reasonably necessary to handle the matter and protect the legitimate interests and legal rights of GATO and the customer.
Customer Accounts
Account information may be retained while the account remains active and afterwards where retention is necessary for legal, security or order-history purposes.
Marketing Information
Marketing contact information is retained until you unsubscribe, withdraw your consent or the information is otherwise no longer necessary, subject to information we may need to retain to record your opt-out preference.
Cookie and Technical Information
Retention periods vary depending on the particular cookie, technology and service provider.
9. Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you may have the following rights.
Right of Access
You have the right to request confirmation of whether we process personal data concerning you and to obtain access to that data.
Right to Rectification
You may request correction of inaccurate personal data and completion of incomplete information.
Right to Erasure
In certain circumstances, you may request deletion of your personal data.
The right to erasure is not absolute, and we may retain information where processing is required by law or another lawful basis applies.
Right to Restriction
In certain circumstances, you may request that processing of your personal data be restricted.
Right to Data Portability
Where the legal requirements are met, you may request personal data that you have provided to us in a structured, commonly used and machine-readable format and may have the right to transmit it to another controller.
Right to Object
You may object to processing based on our legitimate interests in certain circumstances.
You have the right to object at any time to processing of your personal data for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawal does not affect processing lawfully carried out before the consent was withdrawn.
Rights Related to Automated Decision-Making
GATO does not currently make decisions about customers based solely on automated processing that produce legal effects or similarly significant effects on the customer.
Service providers such as payment and fraud-prevention providers may use automated tools under their own terms and legal obligations.
GDPR gives data subjects rights including access, rectification and portability, and individuals also have the right to lodge a complaint with the competent supervisory authority.
10. How to Exercise Your Rights
To exercise your data protection rights, contact:
Gato Gloves Oy
Email: info@gatogloves.com
Please provide enough information for us to identify your request.
We may need to verify your identity before providing access to personal data or carrying out certain requests.
Requests are handled in accordance with the time limits and requirements of applicable data protection legislation.
11. Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent data protection supervisory authority.
In Finland, the supervisory authority is the:
Office of the Data Protection Ombudsman
(Tietosuojavaltuutetun toimisto)
You may also contact the supervisory authority in another EU or EEA country where applicable.
12. Data Security
We use appropriate technical and organisational safeguards designed to protect personal data against:
- unauthorised access;
- accidental or unlawful destruction;
- loss;
- alteration;
- unauthorised disclosure; and
- misuse.
We also rely on security measures provided by Shopify and other service providers used to operate our online store.
No online service or data transmission method can be guaranteed to be completely secure.
13. Third-Party Websites and Services
Our website may contain links to:
- social media platforms;
- WhatsApp;
- payment services; or
- other third-party websites and services.
These third parties process personal data under their own privacy policies.
GATO is not responsible for the privacy practices of independent third-party websites or services.
14. Sale or Restructuring of the Business
If Gato Gloves Oy is involved in a merger, acquisition, restructuring, financing or sale of all or part of its business, personal data may be disclosed where reasonably necessary in connection with that transaction and subject to applicable data protection law.
15. Changes to This Privacy Policy
We may update this Privacy Policy when:
- our services change;
- our technology providers change;
- our data-processing practices change; or
- applicable law changes.
The latest version will always be available on our website.
The “Last updated” date at the top of this Privacy Policy indicates when the policy was last revised.
16. Contact
If you have questions about this Privacy Policy or how GATO processes your personal data, contact:
Gato Gloves Oy
Business ID: 3597883-4
Tunturikatu 18
00100 Helsinki
Finland
Email: info@gatogloves.com