Privacy Policy

This is Johku's demo shop. Johku Resort is a fictional company and orders in this shop are examples. This privacy policy shows how personal data is processed in a Johku online shop.

This privacy policy covers only the customer register of Johku Resort's Johku shop and the principles for processing its data.

We may change our privacy practices and this privacy policy from time to time. We therefore recommend that you review our privacy practices regularly.

1. Controller

Johku Resort (Johku demo shop)
Johkutie 1, 00123 Johkula, Finland
+358 50 376 8855
ilkka.lariola@johku.com
Business ID: Demo shop – no business ID

2. Person responsible for the register and/or contact person

Ilkka Lariola
Johku Resort (Johku demo shop)
+358 50 376 8855
ilkka.lariola@johku.com

3. Name of the register

Customer register of Johku Resort's online shop

4. Legal basis and purpose of processing personal data

Under the EU General Data Protection Regulation, the legal basis for processing personal data is the contract formed when a customer orders products and/or services from Johku Resort's online shop. The purpose of the register is to enable online trade through Johku Resort's online shop, for example the transfer of order, invoicing, payment confirmation or processing information between Johku Resort and the customer. In addition, the data is collected to enable customer service contacts, to maintain the customer relationship and for electronic marketing communication when the customer has given consent to it.

Johku Resort does not store in its customer register any orders placed for other merchants' products or any data related to them.

The data is not used for automated decision-making. The data may be used for profiling.

5. Data content of the register

  • First name and surname
  • Address
  • Postal area
  • Country
  • Phone number
  • Email address
  • Source page of the order

For companies, the following are also recorded:

  • Company name
  • Business ID
  • E-invoicing address
  • E-invoicing operator ID
  • Reference
  • Marking

In addition, the additional information field in the checkout lets the customer freely provide any other information they consider relevant.

Retention period

The data is retained for as long as the user and Johku Resort have a valid mutual agreement and/or consent.

The data may be retained for longer where necessary to fulfil obligations set by applicable legislation, such as responsibilities concerning accounting and consumer trade, and to demonstrate their proper fulfilment.

6. Regular sources of data

The data is collected with the electronic forms of the Johku online service. Customers enter the data themselves when ordering from Johku Resort's Johku online shop.

7. Regular disclosures of data and transfers outside the EU or EEA

The data is not disclosed further and remains with the controller only. The data may technically be processed outside the EU or the European Economic Area.

8. Principles of protecting the register

The register is handled with care, and data processed in information systems is appropriately protected. When register data is stored on Internet servers, the physical and digital security of their hardware is properly ensured. The controller ensures that stored data, server access rights and other information critical to the security of personal data are handled confidentially and only by employees whose duties require it.

Electronically stored data

The register is located in the Johku service, and Aptual Commerce Oy acts as the data processor. Only the controller and Aptual Commerce Oy's technical maintenance staff have access to the complete register data.

More about the privacy principles of the Johku service: johku.fi/fi/tietosuoja

Manual material

As a rule, we avoid printing register data as manual material. If manual material is printed from the register in some situations, it is stored in a locked space and only the controller has access to it.

9. Right of access and how to exercise it

Every person in the register has the right to check their data stored in the register and to correct any incorrect or incomplete data. The Johku system used by Johku Resort automates this right as follows:

Johku informs the user about the processing of their personal data through the My Johku (Oma Johku) service in connection with the merchant's confirmation messages. The messages contain a link to My Johku.

In My Johku the user can check the data stored about them and correct it if necessary. The service also lets the user download the data in a structured format for transfer from one system to another. My Johku is available at any time at johku.com/customer.

My Johku also lets the user terminate the My Johku agreement and delete their data from My Johku. If the user stops using My Johku and terminates their agreement with Johku, all automatic functions related to managing their own data cease. After the agreement ends, the user must manage their data (access, rectification, right to be forgotten, restriction, data portability) in writing directly with Johku Resort. Johku Resort may, if necessary, ask the person making the request to prove their identity. Johku Resort responds to a written request within the time set in the EU General Data Protection Regulation (as a rule within one month).

Using My Johku is free of charge.

10. Other rights related to the processing of personal data

A person in the register has the right to request that personal data concerning them be deleted from the register ("right to be forgotten"). Data subjects also have the other rights under the EU General Data Protection Regulation, such as restricting the processing of personal data in certain situations.

Please note, however, that the data stored in Johku Resort's customer register always arises when a customer buys products and/or services. Johku Resort is therefore also bound by the obligations set by accounting and tax legislation to retain the material.

Requests must be sent in writing to the controller. The controller may, if necessary, ask the person making the request to prove their identity. The controller responds to the customer within the time set in the EU General Data Protection Regulation (as a rule within one month).

11. Cookies

This website uses cookies. The site sends the browser a small file that is stored on the computer's hard drive. Both (temporary) session cookies, which expire when you close the browser, and persistent cookies, which are stored on the hard drive, are used. The purpose of cookies is to improve the user experience on the site. If you are a registered user, cookies also manage signing in and access to pages intended only for registered users. Cookies can be used to follow and review the user's interests and thereby improve the usability of the service. Browsers usually accept cookies automatically. If necessary, cookies can be disabled in the browser settings, in which case some functions will not be available.

Advertising cookies may be used to help optimise the advertising experience for users of the service. Some third-party providers, including Google, may also use cookies or web beacons (a 1-pixel image file) to improve the advertising experience.

Data collected with cookies and web beacons does not contain the user's personal data. Online actions cannot be linked to a specific person with it.

Last updated: 28 September 2026