Privacy policy | Antaisin.fi

This English version is a translation of the Finnish privacy statement. The Finnish version is the original version, and if the language versions differ, the Finnish version applies.

This statement describes what personal data the Antaisin.fi online shop processes, for what purpose, for how long, and to whom data is disclosed.

Controller and contact

Antaisin Oy
Y-tunnus 3180375-4
Viereläntie 4 A
90630 Oulu
asiakaspalvelu@antaisin.fi
+358 44 280 9861

We have not appointed a data protection officer. In data protection matters you can contact customer service at the email address above.

What data we process and why

Order and delivery. Name, email address, phone number, company, delivery and billing address, the contents and amounts of the order, and any gift wrapping message and order note. These are needed to process and deliver the order, for customer service, and for handling withdrawals and returns.

Payment. Payment confirmation, the chosen payment method and the payment service's transaction reference. We neither receive nor store card details: payment takes place in the Visma Pay service.

Consent for digital content. If the order contains digital products delivered immediately, we store the text of the consent as it was shown, its version, the order lines and product names it covered, the time, and the IP address. This is the evidence that delivery began at your request and that you accepted the ending of the right of withdrawal.

Country information for taxation. The order stores the billing country and the delivery country when the order has a delivery address.

Download links and gift cards. Download link identifiers and gift card codes are stored only in one-way protected form. The readable value exists only in the message sent to you. In the sending queue such messages are encrypted.

Customer account. If you create an account, we process your email address, login links and the orders linked to the account. The account has no password: logging in uses a single-use link valid for 15 minutes. When you request a login link, we store the IP address of the request with it in order to investigate misuse.

Back-in-stock notice. When you ask to be told about a product that has run out, we store your email address, the product and the language of the page. We send one message when the product is available again and delete the request at the same time.

Contact and quote request forms. Name, email address and the content of the message.

Marketing messages. We send email about new sheet music and records, and the newsletters may include special offers such as discount codes. If you permit marketing messages, we store the permission, its terms version and the time. When you give or withdraw the permission in your customer account, or withdraw it using the link in a message, we also store the IP address. No IP address is stored with a permission given at checkout. The permission is not pre-selected and is not a condition of purchase. If you have bought from the online shop, we may also send you information about our own similar products without separate permission. You can refuse the messages at any time free of charge using the link in a message, in your customer account or through customer service. A withdrawal or refusal is stored as new data. When we send a newsletter, we store the recipient's address, the basis and the time of sending. If a message bounces because the address is no longer in use, or you mark it as spam, the address is added to a block list and no marketing is sent to it. Marking a message as spam is also stored as a refusal.

The old online shop's newsletter list. Before the current online shop, newsletter subscribers were kept in the Mailchimp service. From there and from the old online shop's orders we transferred to our own register the email address, the basis for marketing (permission or customer relationship) and its time, and information about withdrawals and bounced messages. No names, postal addresses or IP addresses were transferred. Addresses with neither a purchase nor a subscription of their own were not transferred at all.

Order reminder. The shop has a feature that can send one reminder about an unfinished order to the address given in the order. The feature is not in use.

We do not carry out automated decision-making or profiling.

Legal bases for processing

Performance of the contract: processing the order, delivery, delivering digital content, the customer account, and handling withdrawals and returns.

Legal obligation: accounting and taxation, and consumer-law evidence such as the digital delivery consent and withdrawal notices.

Consent: marketing messages you have permitted, the click map which requires analytics consent, and the embeds which require marketing consent (YouTube videos and the Spotify and Apple Music players). Consent can be withdrawn at any time.

Customer relationship: marketing messages to previous buyers about our own similar products. Section 200(2) of the Finnish Act on Electronic Communications Services (917/2014) allows email marketing without separate permission when the contact details were obtained in connection with a sale and every message offers an easy way to refuse further messages free of charge. The processing of personal data is then based on our legitimate interest in marketing our own products to our customers. You can refuse the messages at any time, and refusing does not affect your orders.

Legitimate interest: cookieless visitor statistics and preventing misuse. Balancing of interests: the statistics use no cookies, their identifier changes when the day changes and an order is not linked to the identifier of the visit, the data is not disclosed to third parties and is not used to target marketing, and improving how the shop works is not possible without knowing where buying is interrupted. You can object by contacting customer service, and a Global Privacy Control or Do Not Track signal from your browser prevents recording automatically.

Visitor statistics and the click map

Visitor statistics are server-side and cookieless. No third-party analytics script is placed on a public page.

The statistics record the pages and actions of a visit, such as adding to the cart, a checkout field that was left invalid (the name of the field, not its contents) and a search that found nothing, together with the search term. They also record the language of the page, the device type (phone, tablet or computer) and whether you came from a search engine, social media, email or directly, and the source tag of a campaign link (utm_source) if you arrived through one. The referring address is not stored, only its class.

Your IP address and browser details are not stored. The server derives an identifier for the visit from them that changes when the day changes, and the random value used to derive it is destroyed after a few days. The same person therefore cannot be recognised from one day to the next. Placing an order is recorded in the statistics with the order's identifier, so that we can see how many orders were paid, but without the identifier of the visit: the order is not linked to the pages you visited. Events are kept for 25 months.

If you give analytics consent, we may also record where on the page you click: the position is stored as a percentage of the page width and height together with the address of the page. We do not store cursor movement or the element you pressed, and we do not record your visit. Without consent there is no such script on the page at all.

If your browser sends a Global Privacy Control or Do Not Track signal, your visit is not recorded. Visits by search robots and staff are not recorded.

To whom data is disclosed

DigitalOcean, LLC provides the server on which the shop and its database run, and the server's disk backups. It processes the data on the server as a processor on our behalf.

Dropbox, Inc. stores an encrypted copy of the database backups in the controller's Dropbox account. Each backup is encrypted on the server before the transfer, and Dropbox has no encryption key and no access to the backups' contents.

Visma Payments Oy processes the data needed for payment in order to provide the payment service.

Mailgun Technologies, Inc. delivers the shop's email, such as order confirmations, shipping and refund notices, download links, gift cards, login links, back-in-stock notices, acknowledgements of withdrawals and privacy requests, seller and staff messages, and newsletters. Mailgun is part of the Sinch group. It processes the recipient's email address and the content of the message as a processor on our behalf. The content may include a name and order details, and in a message to a seller or to staff also the delivery address and phone number. For newsletters, Mailgun only tells us about a permanent bounce or a spam complaint. We do not track whether newsletters are opened or their links clicked.

The Rocket Science Group LLC (Mailchimp) kept the old online shop's newsletter list as a processor on our behalf. We no longer use the service, and we closed the account on 15 October 2026. After the closure, Mailchimp deletes the list's data.

A seller who sends the product directly. If an order line is sent directly by the seller, we pass on for delivery the order number, the order date, those order lines, your name, any company, the delivery address, the phone number and the gift wrapping message. No amounts of money are passed on.

Teeri ERP reads order data for seller settlements. The connection is a read-only interface: the system cannot write to the shop.

Google (Gemini). We use a language model to translate and draft the shop's texts. What is sent to the service is the shop's public content and text written by staff: the product name, details and track list together with the names and roles of the artists and authors, the text to be translated as staff wrote it, and for the introductions on artist pages the artist's name, other names, approved facts with their sources and excerpts from public sources such as interviews. An artist is often a person, and the excerpts may contain information about their career and life. No customer, order or payment data is sent. We use the paid Gemini API service. Under its terms, Google processes the data sent and the model's responses as a processor on our behalf in accordance with Google's data processing terms. Google does not use them to improve its products, but keeps them for a limited period to prevent abuse. Our contracting party is Google Cloud EMEA Limited in Ireland.

Google (YouTube), Spotify AB and Apple (Apple Music). If you give marketing consent, product, artist and content pages may show YouTube videos and Spotify and Apple Music players. Your browser loads the embed directly from the service, so the service receives your IP address, your browser details and the address of the shop and may set cookies. YouTube videos are loaded from Google's youtube-nocookie.com address. We decide to show the embed, and the service processes the data it receives on its own behalf under its own privacy policy. Without consent the embed is not loaded, and the page shows an ordinary link to the service instead.

Location of data and transfers

The shop's server and database are located in the EU, in Frankfurt, Germany, in a data centre of our hosting provider DigitalOcean. The backups are kept in the same data centre, and an encrypted copy of them is also kept in Dropbox in the United States.

DigitalOcean is a US company. The data is stored in the EU, but DigitalOcean and its subprocessors may also process it from outside the EEA, for example in technical support. Such transfers are based on DigitalOcean's certification under the Data Privacy Framework between the EU and the United States. If the framework ceases to be valid, the transfers are governed by the EU standard contractual clauses included in DigitalOcean's data processing agreement.

Dropbox is a US company, and the encrypted copy is stored in the United States. The transfer to the United States is based on the Data Privacy Framework between the EU and the United States.

The shop's email is sent through Mailgun's EU region, so the messages and their delivery data are stored in the EU. Mailgun is a US company, and it and its subprocessors may also process the data from outside the EEA, for example in customer support. Such transfers are based on the EU standard contractual clauses included in Mailgun's data processing agreement and on Mailgun's certification under the Data Privacy Framework between the EU and the United States.

Mailchimp is a US company, and the old online shop's newsletter list was stored in the United States. The transfer was based on Mailchimp's certification under the Data Privacy Framework between the EU and the United States and on the EU standard contractual clauses included in Mailchimp's data processing agreement.

Google may process the data sent to Gemini in any country where it or its subprocessors maintain facilities, including outside the EEA, such as in the United States. Transfers to the United States are based on Google LLC's certification under the Data Privacy Framework between the EU and the United States. If a transfer has no such basis, it is governed by the EU standard contractual clauses included in Google's data processing terms. Only the shop content described above is sent to Gemini.

The embed services (YouTube, Spotify and Apple Music) may also process data outside the EEA, in particular in the United States. They process the data they receive through the embed on their own behalf, so the transfers and their legal bases are described in the services' own privacy policies.

Retention periods

Paid orders: for the period required by the Accounting Act. The payment processing events are kept with the order, but the payment method details and the payment service's customer identifier are removed from them after 18 months.
Unpaid orders (failed, cancelled or abandoned payment): personal data is removed after 90 days. The order lines and the amounts remain. If the payment service has nevertheless reported a payment for the order, the order is kept like a paid one, because money has moved.
Consent for digital content: kept with the order. Its IP address is cleared after 3 years.
Withdrawal notices: personal data is removed 3 years after the notice. The fact of the withdrawal and its time remain.
IP addresses in the order log, marketing consents and data protection requests, and a new recipient address of a gift card recorded in the staff log: 6 months, after which they are cleared. The rest of the data remains.
Marketing permissions, refusals and the block list: kept for as long as we send marketing, because without them we could not honour your refusal. The IP address is cleared as described above.
Newsletter sending: the delivery records are deleted 36 months after sending. Refusals and the block list are kept as described above.
Connection identifier of a stock reservation: the reservation of an unpaid order stores an identifier derived from the IP address with a secret key, used to limit how many items can be reserved from one network connection. The raw IP address is not stored. The identifier is removed when the reservation ends in a payment or a failed payment, and otherwise at the latest one day after the reservation ends.
Customer account: kept until you ask for it to be deleted or it has gone unused for 3 years. If there has been no sign-in and no order on the account for 3 years, we send a notice to the account's address, and the account is deleted 30 days later unless you sign in or place an order before then. Orders are not deleted with the account but kept for their own retention periods. Accounts transferred from the old online shop that have never been signed in to are not deleted this way, because the old orders are visible only through them. Login links are deleted 30 days after the link has expired.
Shopping cart: deleted 90 days after the last change.
Visitor statistics: 25 months.
Back-in-stock notices: deleted when sent; an unsent request after 12 months.
Contact and quote requests: deleted 36 months after they were handled.
Download rights and gift cards: kept with the order, because they are rights you bought. The recipient's email address, the sender's name and the message of a gift card are removed 36 months after the card has been used up.
Server logs and failed background tasks: the error log for 14 days, the security log for 90 days and a failed background task, such as an unsent message, for 30 days. They may contain the recipient address of a message.
Backups: the database is backed up every night and the backups are kept on the server. In addition, each backup is encrypted on the server and the encrypted copy is transferred to the controller's Dropbox account. Dropbox has no encryption key and no access to the backups' contents. The same retention periods apply on the server and in Dropbox: daily copies are kept for 7 days, weekly copies for 2 months and half-yearly copies for 12 months. Backups are therefore kept for at most 12 months. After that, Dropbox keeps a file deleted there for a further 30 days, and disk copies of the server are kept by the service provider for 4 weeks. Deleted data can therefore remain in a backup for at most 12 months and 30 days. Backups are used only to restore data and to test restoring.
Data protection requests and the justifications for how they were handled: personal data is removed 3 years after the request was handled. The request, its outcome and the justifications remain.

Your rights

Depending on the situation, you have the right to access your own personal data, to ask for incorrect data to be corrected, to ask for data to be deleted or its processing restricted, to object to certain processing, and to have the data you provided transferred from one system to another.

Deletion is carried out in practice by replacing identifying data: we cannot delete accounting records because of the statutory retention obligation. If we cannot carry out a request, we tell you the reason in writing.

If the database has to be restored from a backup, after the restore we carry out again the deletion requests and objections that were handled after the backup was taken. A restore therefore does not bring back data you asked us to delete, nor resume processing you objected to.

You can make a request to the customer service email address or with the shop's data protection form. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Cookies

The shop sets only its own cookies that are necessary for it to work:

antaisin_suostumus: your choice regarding optional cookies. Valid for six months.
antaisin_kieli: the language you chose. Valid for a year.
antaisin_ei_tilastoa: only on our own staff's devices. Tells the shop not to count visits from the device in the visitor statistics. The cookie contains no identifier. Valid for 400 days.
Cookies for the shopping cart, the session and form protection, without which buying does not work.

The shop sets no advertising or profiling cookies. Embeds (YouTube, Spotify and Apple Music) are not loaded onto the page at all without marketing consent, so your browser makes no request to these services before consent. After consent the embed services may set their own cookies. You can change your choice at any time in the cookie settings .