Updated 28 September 2026

Privacy policy

1. Introduction

Papu Group Oy (business ID 3582059-4) is committed to protecting the privacy of its customers, and everyone who uses our website or other online services of Papu Group Oy is protected under the EU General Data Protection Regulation (EU) 2016/679.

The personal data you provide to Papu Group Oy (hereinafter "Papu") is used only for the purpose for which you have given your consent (for example, to process online orders or for online marketing). We do not use personal data for any purpose other than the one you have consented to. You can unsubscribe from our newsletter at any time, and you have the right to request information about what personal data has been collected and/or to have the data deleted from our register. If you have any questions or other concerns regarding this privacy policy, you can contact our customer service.

2. What information do we collect?

We only collect personal data with your consent. We receive the data when an order is placed or when an individual subscribes to our newsletter. Data is only disclosed to partners needed to provide the service, such as the e-commerce platform, payment and logistics services and the virtual try-on service provider. If data is processed outside the EU, the transfer is based on safeguards in accordance with the GDPR, such as standard contractual clauses approved by the European Commission. However, the service provider may disclose data to the authorities in accordance with applicable legislation. In connection with a reorganisation of the company's ownership, we may disclose the data to the parties involved.

The service has strict built-in access control that prevents outsiders from accessing users' private data. The register is only used by persons whose duties require it. Employees are bound by a duty of confidentiality. The register is not kept in paper form, and if personal data is printed on paper, the document is destroyed as soon as it is no longer needed.

Our service uses various social media features that allow users to share information with different social media services. We recommend that you review the privacy policies of these service providers, such as (but not limited to) Facebook and Instagram.

3. Personal data

Papu collects personal and non-personal data when our website papudesign.live or other Papu online services (including, but not limited to, papudesign.com) are used. Data (personal and non-personal) is collected when, for example, you visit and browse our website, place an order or use other functions in our online store, contact customer service or subscribe to our newsletter.
The personal data provided to Papu includes, but is not limited to, contact details and payment details. All personal data we receive and collect is provided by the user.

Non-personal data includes, but is not limited to, IP address, browser type, number of visits and search terms used. Non-personal data is collected so that we can improve our services.

4. How is personal data used?

Papu uses the personal data collected to:

• Process orders placed through the online store
• Provide tracking information for order shipments
• Contact you if there are problems with your order
• Provide customer service
• Offer campaigns you are interested in or provide information you may be interested in, in accordance with the consent given

5. Your rights

You have the right to request information about the personal data Papu has collected about you. If you want your personal data to be corrected or deleted, please contact customer service at info@papudesign.com. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

6. Cookies

We use cookies and similar technologies in our online store. Strictly necessary cookies are always used, as they enable, for example, the shopping cart, login and checkout. We only use analytics and marketing cookies (e.g. Google Analytics, Google Ads, Meta and Microsoft Clarity) with your consent, in which case the legal basis for processing is consent. You can give or withdraw your consent at any time via the Cookie settings link at the bottom of the page. More detailed information about cookies and their retention periods can be found in our cookie policy.

7. Virtual try-on

With the virtual try-on in our online store, you can see how a garment looks on you. The service is voluntary, and using it requires logging in to your customer account and your consent to the processing of your photo.

What data we process

• The photo of yourself that you upload (try-on photo). The photo is resized in your browser, and the image's metadata, such as location information, is removed.
• AI-generated try-on images and information about which products you have tried on and when.
• Your customer ID and the number of remaining and purchased try-ons.
• A note in your customer data that you have already received the free try-ons for newsletter subscribers.

Purpose and legal basis of processing

We only use the photo to create a try-on image for you. The processing is based on your consent (EU General Data Protection Regulation 2016/679, Article 6(1)(a)), which you give before uploading the photo. The photo is not used to identify you, for marketing or for training AI models. You can withdraw your consent at any time by deleting your photo. Withdrawal does not affect processing carried out before it.

Retention periods

• The original uploaded photo is deleted immediately after processing, within one day at the latest.
• The photo processed for the try-on is deleted within 7 days.
• The try-on photo saved to your profile is kept until you delete or change it or your customer account is deleted.
• AI-generated try-on images are deleted automatically after 60 days.

You can view and delete your try-on photo and all AI-generated images at any time on the My try-ons page. Your remaining try-ons are kept even if you delete the images.

Processors and data transfers

The images are stored in Google Cloud within the EU (Belgium). The try-on images are created with Google's Gemini image model (Google Cloud), which may also process the image outside the EU. Google acts as a processor of personal data on behalf of Papu in accordance with the Google Cloud data processing terms and does not use the images for its own purposes. Transfers outside the EU are based on standard contractual clauses approved by the European Commission and the EU-U.S. Data Privacy Framework. Your customer account and try-on package orders are processed in Shopify like other online store orders.

Your rights

You have the right to know what data is processed about you and the right to request that the data be corrected or deleted. You can delete your photos yourself on the My try-ons page or contact customer service at info@papudesign.com. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

Notes

The application is intended solely for customers' virtual try-on of Papu products. Any other use may result in access being revoked. If access is revoked due to activity contrary to the purpose of the application, any fees paid for its use will not be refunded.