Privacy Policy
This policy explains how Omat Viinit collects and uses personal data when you use the bottle design, account, licensing, ordering, and website services.
Effective date: 18 August 2026
1. Controller and scope
Mercantem Oy, Business ID 1906794-2, operating the Omat Viinit service, is the controller for the processing described in this policy. Postal address: 02400 Kirkkonummi, Finland. Privacy enquiries and data protection requests can be sent to info@omatviinit.fi.
This policy applies to visitors, registered users, business customers, waitlist subscribers, and people who contact us. It does not replace the separate privacy notices of third-party services you choose to use.
2. Personal data we collect
- Account and authentication data, such as your email address, account identifier, authentication events, and information supplied by Google if you use Google sign-in. Passwords are handled by our authentication provider and are not stored by us in readable form.
- Business and licence verification data, such as contact name, company name, Business ID, alcohol licence number, licence status, licence type, and licensed location information.
- Design and project data, including label layouts, text, uploaded images and files, filenames, file metadata, previews, project history, and status.
- Order and customer data, such as company and contact details, email address, phone number, quantity, messages, requested deadlines, order lines, price, currency, payment status, and payment provider identifiers. We do not receive full payment-card details from Stripe.
- Waitlist and marketing data, such as name, company, email address, consent choice, and the time your choice was recorded.
- Technical and usage data, such as IP address, browser and device information, security logs, session cookies, cookie choices, page interactions, and analytics data when you consent to analytics cookies.
- Communications and support data that you send to us.
3. Why we use personal data and our legal bases
- To create and manage accounts, authenticate users, save projects, provide the editor, process orders, and deliver the service. The legal basis is performance of a contract or steps taken at your request before entering into a contract.
- To verify business alcohol-purchasing rights, prevent unauthorised access, secure the service, detect misuse, and keep reliable operational records. The legal basis is our legitimate interest in operating a lawful and secure business service and, where applicable, compliance with legal obligations.
- To process payments, maintain accounting records, handle disputes, and meet tax and other statutory duties. The legal basis is performance of a contract and compliance with legal obligations.
- To send waitlist or marketing messages only when you have given consent. You can withdraw consent at any time without affecting earlier lawful processing.
- To measure and improve the website with Microsoft Clarity only after you accept analytics cookies. The legal basis is consent.
- To respond to enquiries and develop the service. The legal basis is our legitimate interest in customer support and service improvement.
5. Service providers and recipients
We disclose personal data only where necessary to operate the service, complete an order, comply with law, protect legal rights, or complete a corporate transaction. Our principal provider categories include:
- Supabase, for authentication, database, and related backend services;
- Stripe, for checkout and payment processing;
- Google, when you choose Google sign-in;
- Microsoft Clarity, for consent-based website analytics;
- hosting, communications, security, accounting, and professional service providers; and
- public authorities or advisers when disclosure is required by law or needed to establish, exercise, or defend legal claims.
6. International transfers
Some providers may process data outside Finland or the European Economic Area. Where required, we use an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism together with appropriate safeguards. You may contact us for more information about the safeguards relevant to your data.
7. Retention
- Account and project data is generally retained while the account or project is active and for a reasonable period afterwards to allow recovery, resolve disputes, and protect the service.
- Order, payment, and transaction records are retained for the periods required by accounting, tax, consumer, and other applicable laws and limitation periods.
- Licence verification and security records are retained only as long as needed to demonstrate access rights, prevent abuse, and meet legal obligations.
- Waitlist and marketing data is retained until you withdraw consent or the relevant purpose ends, subject to a minimal suppression record where needed to respect your opt-out.
- Analytics data follows the retention settings of Microsoft Clarity, and the cookie recording your choice lasts for up to one year unless you delete it earlier.
8. Security
We use organisational and technical safeguards designed to protect personal data, including access controls, authenticated sessions, restricted administrative access, and service-provider security measures. No online service can guarantee absolute security, so please use a strong, unique password and protect your account credentials.
9. Your data protection rights
Depending on the circumstances, you may request access to, correction of, deletion of, or restriction of your personal data; object to processing based on legitimate interests; receive data you provided in a portable format; and withdraw consent at any time. You also have the right to complain to a supervisory authority, including the Office of the Data Protection Ombudsman in Finland at tietosuoja.fi.
Send requests to info@omatviinit.fi. We may ask for information needed to verify your identity. Legal duties or overriding lawful grounds may limit some requests.
10. Children
The ordering service is intended for authorised representatives of businesses that are legally entitled to purchase alcohol. It is not directed to children, and children must not create accounts or submit personal data through the service.
11. Changes to this policy
We may update this policy when the service or legal requirements change. We will publish the updated version here and change the effective date. If a change materially affects registered users, we will provide additional notice where appropriate.