Privacy Policy

Updated 4 August 2026

This privacy policy explains what personal data we collect, why we process it and on what legal basis. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

1. Data controller

T:mi New Route (Hei Aurora)
Business ID: 3393881-2
Address: Taavinharju 29 G 13, 02180 Espoo, Finland
Email:

Name of the register: Hei Aurora customer and order register.

For any privacy matter, please contact us at the email address above. We are not required to appoint a separate data protection officer.

2. What data we collect

We collect only the data we need to fulfil your order and to meet our legal obligations:

• your name and contact details (email, phone number)
• delivery address or the pickup point you select
• the recipient’s name, address and phone number when the gift is sent to someone else
• order details and the personalisation message you provide
• payment transaction data (we never handle or store card numbers)
• customer service enquiries and related correspondence
• technical data related to the use of the website, such as IP address, browser information and cookies
• marketing consents and newsletter subscriptions

If you create a customer account, we also process your account username and order history. Passwords are stored in encrypted form only.

3. Purpose and legal basis of processing

• Processing, making and delivering your order (basis: performance of a contract)
• Customer service and handling complaints (basis: contract or legitimate interest)
• Accounting and other statutory obligations (basis: legal obligation)
• Operating, developing and securing the online store and preventing misuse (basis: legitimate interest)
• Marketing, such as newsletters or targeted advertising, only where you have given consent (basis: consent)

We do not make automated decisions that have legal effects on you, and we never sell your data to third parties.

4. Who receives your data

We share data only to the extent needed to deliver the service. Our partners act as data processors and are bound by data protection law.

Payment processing

• Visma Payments Oy (Visma Pay) — online bank payments, Siirto and OP Lasku
• Stripe Payments Europe, Ltd. (WooPayments) — card, Apple Pay and Google Pay payments
• Klarna Bank AB (publ) — Klarna payment methods
• Vipps MobilePay — MobilePay payments

The payment provider processes the payment transaction as its own controller. Card details are given directly to the payment provider and never pass through our systems.

Delivery

• Carriers and their shipment management services, such as Matkahuolto Oy and Posti Oy
• Taxi and courier services used to deliver your order

Delivery details such as the recipient’s name, address and phone number are disclosed to the party carrying out the delivery only to the extent needed to get the parcel to its destination.

Technical services

• Website maintenance, hosting and backups
• Email delivery services (order confirmations and customer correspondence)
• Internal order notifications sent to our staff through a messaging service

Analytics and marketing

Based on your cookie consent only, we may use services such as Google Analytics, Google Ads and Meta (Facebook/Instagram) advertising tools. Without consent, these are not loaded.

5. Where data is stored and transfers outside the EU

Data is stored primarily on servers within the EU/EEA. Some of the services we use, such as analytics, marketing and messaging services, may also process data outside the EU/EEA. In that case the transfer is based on the European Commission’s Standard Contractual Clauses or another safeguard permitted by the GDPR.

6. How long we keep data

We keep order and customer data for as long as needed to fulfil the order and handle any complaints, and for the period required by the Finnish Accounting Act, generally six years from the end of the financial year. Personalisation messages are deleted once they are no longer needed for order processing or warranty handling. Data based on marketing consent is kept until you withdraw your consent.

7. Your rights

You have the right to:

• access the data we hold about you
• have inaccurate data corrected or your data erased
• object to or restrict processing
• receive the data you have provided in a machine-readable, portable format
• withdraw your consent at any time
• lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

Please note that erasure does not apply to data we are legally required to retain, such as accounting records.

To exercise your rights, contact us at . We respond within one month at the latest. We may ask you to verify your identity before acting on a request.

8. Cookies and marketing

The site uses cookies for functionality, statistics and marketing. Essential cookies, such as those needed for the shopping cart and login, are always active. Statistics and marketing cookies are loaded only with your consent. You can change or withdraw your cookie consent at any time in the site’s cookie settings.

You can subscribe to our newsletter by giving a separate marketing consent. Every newsletter includes an unsubscribe link.

9. Review photos and their use in marketing

You may attach photos or videos to your review. We publish them on the product page alongside your review as part of our service.

On the review form you can also give separate consent for us to use the photos you add in our marketing and on our social media channels, such as Instagram, Facebook, TikTok and Pinterest. This consent is optional: you can submit your review without it, and it does not affect whether your review is published.

The legal basis for this marketing use is your consent (Article 6(1)(a) of the EU General Data Protection Regulation). We do not publish your contact details alongside the photos. If identifiable people appear in the photo, you are responsible for having the right to provide it to us.

You can withdraw your consent at any time by contacting the controller named in section 1. After withdrawal we will remove the photos from our marketing materials and from the social media channels we control within a reasonable time. Withdrawal does not affect the lawfulness of processing carried out before it. We cannot remove photos from third-party posts outside our control.

We retain the record of your consent together with the review for as long as the review remains published.

10. Data security

We treat your data confidentially. Traffic to the online store is protected with SSL encryption. Access is limited to those people who need it to perform their duties, and our systems are protected with usernames, passwords and technical safeguards.

11. Changes to this policy

We may update this privacy policy, for example when our services or the law change. The current version is always available on this page, and the date of the latest update is shown at the top.