Privacy policy

Privacy Policy

Updated 14 October 2026

This policy explains how Ninja / No8nik Oy processes customers' and website visitors' personal data under the EU General Data Protection Regulation (GDPR).

Data controller

No8nik Oy (Ninja)
Business ID 2957453-4
Kampinkuja 2, 00100 Helsinki, Finland
Phone +358 50 316 6180
Email asiakaspalvelu@ninja.fi

For privacy matters, contact the email address above.

Name of the register

Ninja customer register.

Purposes and legal bases for processing

We process personal data for:

  • orders, payments, deliveries, returns, customer service and performance of contracts (GDPR Art. 6(1)(b));
  • accounting and compliance with legal obligations (Art. 6(1)(c));
  • electronic direct marketing where based on consent (Art. 6(1)(a));
  • customer relationship management, service improvements, fraud prevention and other legitimate business interests where applicable (Art. 6(1)(f)); and
  • product safety and recall communications where a valid legal basis applies.

Personal data processed

We may process:

  • names, addresses, email addresses and phone numbers;
  • customer accounts and relationship information;
  • orders, purchase history, payment-related information, tracking details, returns and exchanges;
  • customer service and communications;
  • marketing permissions and objections, language preferences, marketing and customer relationship information;
  • profiling and customer segmentation information; and
  • technical data such as IP addresses, device and browser information, cookies, identifiers and website interaction and event data.

We do not store full payment card details in our own systems; payments are processed by payment service providers.

Sources of data

Data is primarily obtained directly from customers in our online store, physical store and during the customer relationship. Additional data is generated through orders, payments, returns, exchanges, communications and website use. We may also receive necessary information from service providers.

Data retention

We retain personal data only as long as needed for its purpose or legal obligations. Principal retention periods:

  • purchase history and customer relationship data: up to 10 years unless a different period is justified;
  • customer service records: up to 10 years unless a different period is justified;
  • direct marketing: until consent is withdrawn or an objection is made; we regularly review the validity of consent;
  • accounting records: for the period required by accounting law.

Recipients and service providers

Depending on the purpose, service providers include:

  • Shopify – e-commerce platform and related services;
  • payment providers, including Shopify Payments, Klarna and Vipps MobilePay, and other payment services offered at checkout;
  • Klaviyo – customer communications and marketing;
  • Posti and PostNord – shipping and logistics;
  • Google, Meta, TikTok, Pinterest, Microsoft and OpenAI (ChatGPT Ads) – analytics, advertising, conversion measurement and evaluation of advertising results in accordance with consent; and
  • other providers necessary for the technical operation of the store, customer service, security and business operations.

Providers process data according to their roles and agreements. We may disclose data to authorities where required by law.

Transfers outside the EU and EEA

Some providers operate or may process data outside the EU/EEA. In such cases, we ensure that an appropriate transfer mechanism is in place under applicable data protection law, such as a European Commission adequacy decision or standard contractual clauses.

Cookies and other tracking technologies

Our store uses cookies and similar technologies, including local browser storage and online identifiers. CookieFirst groups them into:

  • Necessary: operation, security, shopping cart, language and region choices and other functions requested by visitors;
  • Functional: optional functions that improve the user experience;
  • Performance and analytics: measuring website use, function and performance;
  • Advertising: measurement, targeting and personalisation of advertising.

Where required by law, non-essential cookies and similar technologies are used on the basis of consent managed through CookieFirst. You can change or withdraw your consent using the Cookie settings link. Withdrawal does not affect the lawfulness of earlier processing.

We use Google Consent Mode to communicate consent choices to Google services; this does not replace consent. Details of cookies, purposes, providers and lifetimes are available in CookieFirst's cookie settings and declaration.

ChatGPT Ads tracking (OpenAI)

We use OpenAI's ChatGPT Ads tracking technology to measure advertising campaign results and online store conversions according to your consent choices.

With your consent, OpenAI may receive data about website activity, products viewed, items added to the cart, checkout starts and purchases. This can include event identifiers, product details, order value and currency, and technical identifiers.

To match conversion events, we may also use SHA-256 hashed customer identifiers, such as email addresses and phone numbers, and other necessary matching information where available and permitted. Hashed identifiers remain personal data.

The legal basis for advertising tracking is consent (GDPR Art. 6(1)(a)). You can change or withdraw your consent using the Cookie settings link. OpenAI is a recipient of tracking data. Transfers outside the EU/EEA are subject to the requirements described in the section above.

Shopify Network Intelligence

Shopify services may process IP addresses, device, browser and interaction information. Through Shopify Network Intelligence, Shopify may combine information across its services under its privacy practices, subject to region-specific privacy and consent choices.

Direct marketing and profiling

We may use customer data for electronic direct marketing where an appropriate legal basis exists. You can unsubscribe through the link in marketing messages or by contacting customer service.

We may segment customers and use profiling to target communications and marketing. Such profiling does not produce legal or similarly significant effects within the meaning of GDPR Art. 22. You may object to profiling for direct marketing at any time.

Your rights

Subject to applicable data protection law, you have the right to:

  • know whether we process your data and access it;
  • request correction of inaccurate or incomplete data;
  • request erasure where legally applicable;
  • request restriction of processing;
  • object to processing based on legitimate interests for reasons relating to your situation;
  • object to direct marketing at any time;
  • in certain circumstances, receive the data you provided in a structured, commonly used and machine-readable format and transfer it to another controller; and
  • withdraw consent at any time where processing relies on consent.

These rights are not absolute; for example, statutory retention obligations may prevent immediate erasure.

Exercising your rights

Send requests to asiakaspalvelu@ninja.fi. We may request additional information to verify your identity.

Information security

We use appropriate technical and organisational safeguards and limit access to persons and providers who need the data for their tasks.

Right to lodge a complaint

You may lodge a complaint with a competent supervisory authority if you believe your data has been processed unlawfully. In Finland, the authority is the Office of the Data Protection Ombudsman.

Changes to this policy

We may update this policy when processing practices, services or legislation change. The current version is published on this page.