Privacy Policy & GDPR Compliance Statement

Effective Date: September 2026 · Compliant with Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2026)

At Gems & Gears ("we", "our", or "us"), we respect your personal data and are dedicated to upholding the strictest data protection standards. This Privacy Policy outlines our transparent data processing practices, your statutory rights under European Union law, and our strict safeguards when you browse or order through gemsgears.com.

1. Data Controller Identification

For the purposes of the General Data Protection Regulation (GDPR) and applicable Finnish data privacy legislation, the Data Controller is:

Gems & Gears
Studio Address & Office: Kaivokselantie 4, 01610 Vantaa, Finland
Data Protection Officer / Inquiries: business@gemsgears.com
Telephone: +358 45 794 1515

2. Legal Bases for Processing (Article 6 GDPR)

We only collect and process personal data where there is a valid lawful basis under Article 6 of the GDPR:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing your name, physical delivery address, email, telephone number, and payment status to fulfill and ship your jewelry orders within Finland.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Retaining statutory purchase, tax, and invoicing records in compliance with the Finnish Accounting Act (Kirjanpitolaki 1336/1997) and consumer protection statutes.
• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring website stability, preventing credit card fraud, maintaining SSL network security, and improving store navigation.
• Consent (Art. 6(1)(a) GDPR): Sending marketing newsletters or non-essential analytical cookies when you have affirmatively opted in. Consent may be withdrawn at any time.

3. Categories of Personal Data Collected

• Order & Identification Data: Full name, billing address, Finnish shipping address, email address, and phone number for parcel tracking notifications.
• Payment Information: Handled exclusively via PCI-DSS Level 1 compliant tokenized payment gateways (Visa, Mastercard, Klarna, Paytrail). We never store full payment card numbers or CVV codes on our servers.
• Technical & Telemetry Data: IP address, device operating system, browser type, and timestamps collected automatically for diagnostic security and anti-fraud monitoring.

4. Data Sharing & Third-Party Processors

We do not sell, lease, or monetize your personal information. Data is disclosed only to verified Data Processors bound by written Data Processing Agreements (DPAs) in compliance with Article 28 GDPR:

• Postal & Logistics Partners: Posti Group Oyj and Matkahuolto, solely for domestic physical delivery and parcel tracking updates.
• Payment Processors: Certified European acquiring banks and gateway providers for transaction settlement.
• Cloud Infrastructure: Cloudflare Inc., ensuring DDoS defense, SSL/TLS encryption, and fast content delivery within the European Economic Area (EEA).

5. Data Retention Periods

Personal data is retained only for as long as necessary to fulfill the operational purpose for which it was gathered:

• Order and billing records: Retained for 6 to 10 years in compliance with statutory Finnish commercial accounting and tax laws.
• Customer service correspondence: Retained for up to 24 months to assist with jewelry maintenance, warranty, or return questions.
• Marketing subscriptions: Retained until you request unsubscription or withdraw consent.

6. Your Statutory Rights Under the GDPR

Under Chapter III of the General Data Protection Regulation, individuals located in Finland and the European Union possess comprehensive statutory rights:

• Right of Access (Article 15 GDPR): The right to obtain confirmation as to whether your personal data is being processed, and receive a complete copy of that data.
• Right to Rectification (Article 16 GDPR): The right to have inaccurate or incomplete personal information corrected without undue delay.
• Right to Erasure / "Right to be Forgotten" (Article 17 GDPR): The right to request deletion of your personal data when it is no longer necessary for the original collection purpose or when statutory retention periods expire.
• Right to Restriction of Processing (Article 18 GDPR): The right to restrict the processing of your data under specific contested circumstances.
• Right to Data Portability (Article 20 GDPR): The right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21 GDPR): The right to object at any time to the processing of your data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Article 7(3) GDPR): The right to withdraw consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

To exercise any of these rights, simply email our customer team at business@gemsgears.com. We will respond within thirty (30) days free of charge.

7. Right to Lodge a Complaint with a Supervisory Authority

If you believe that Gems & Gears has processed your personal data in violation of the GDPR or Finnish data protection legislation, you have the statutory right under Article 77 GDPR to lodge a formal complaint with the competent supervisory authority in Finland:

8. Cookies & Tracking Technologies

Our website utilizes necessary functional cookies required for shopping cart state management, checkout integrity, and security. You can manage or disable non-essential cookies via your browser settings at any time.

9. Contact Information

For any inquiries regarding this policy or our data practices, please reach out to:

Gems & Gears
Email: business@gemsgears.com
Phone: +358 45 794 1515
Studio Address: Kaivokselantie 4, 01610 Vantaa, Finland