Privacy policy

Last updated: 14 September 2026

This notice explains how TrainBot Oy uses personal information when you browse trainbot.tech, buy from us, use your customer account, subscribe to our newsletter or contact us. Reading this notice, creating an account or making a purchase does not constitute consent to optional marketing or cookies.

Who is responsible for your information?

TrainBot Oy is the controller for our webshop and customer-service processing. Our registered address is Anjankuja 2 H 61, 02230 Espoo, Finland; Business ID 3487224-5. Contact us at info@trainbot.tech or +358 50 486 0709 for privacy questions or requests.

Information we use and where it comes from

  • Contact and order details: your name, email, telephone number, delivery and billing addresses, purchased items, payment status, order history and any business or VAT information you supply. We receive these from you and from the services processing your order.
  • Payment information: your selected payment provider processes the payment credentials needed for its service. TrainBot receives transaction and payment-confirmation information and the payment details made available to the merchant. Do not send complete card numbers or verification codes to our customer-service email.
  • Customer-account information: your email address, customer profile, order information, preferences and sign-in verification information. Email sign-in is required before online checkout. Shopify sends a one-time verification code; no account password or security questions are required. A customer profile is created on sign-in if one does not already exist.
  • Messages and requests: the information you provide in enquiries, withdrawal, cancellation, return and warranty requests, including the purchase reference and supporting material you choose to send.
  • Newsletter information: your subscription details and choices, and delivery or interaction information associated with the email service, subject to applicable consent requirements.
  • Technical and browsing information: your IP address, browser and device information, pages and products viewed, cart activity, identifiers and consent choices. This is received through Shopify and the website services when you interact with them, subject to the rules for optional cookies and similar technologies.

Provide only information relevant to your request. Information needed to process payment, deliver goods or identify an order is necessary for the corresponding service. If it is missing, we may be unable to complete that service. Optional marketing consent is not required to buy or exercise your purchase rights.

Purposes and legal bases

  • Preparing and performing your purchase: taking requested steps before a contract, processing orders and payments, managing your account, arranging delivery, and communicating about your purchase, returns and refunds.
  • Legal obligations: accounting, taxation, consumer protection and responding to valid legal requirements, including handling withdrawal and defect claims.
  • Legitimate interests: necessary and proportionate processing to protect the webshop and accounts, prevent fraud, answer general enquiries, maintain reliable services and establish or defend legal claims. We balance these interests against your rights. You may object to processing based on legitimate interests.
  • Consent: optional electronic marketing and non-essential cookies or similar technologies where consent is required. You may withdraw consent at any time; withdrawal does not affect the lawfulness of earlier processing.

Order, delivery, withdrawal and safety communications are service messages. Newsletter consent is separate from both these messages and your cookie choices.

Services and recipients

We share information needed for the relevant service with authorised staff and providers supporting the store:

  • Shopify: storefront hosting, checkout, customer accounts, order management, security, privacy choices and platform reporting. Shopify also processes information for its own services where described in its privacy policy. You can contact Shopify through its privacy portal about processing for which it is responsible.
  • Payment and delivery providers: the payment services available for your order, Posti and the delivery partners involved in transporting your parcel. They receive the transaction or delivery information needed for their functions and may have their own legal responsibilities.
  • MailerLite: newsletter subscription forms and email delivery. Its privacy notice explains its processing.
  • Review and social content providers: the Google Reviews and GSC Instagram Feed integrations support review and social-content display. When third-party content loads or you follow a social link, the provider can receive technical connection information and processes information under its own privacy rules.
  • Business support: providers assisting with store maintenance, communications, accounting, legal advice or claims, to the extent needed for that work and subject to applicable confidentiality and data-protection duties.

We may disclose information where a valid legal obligation requires it or where necessary to establish, exercise or defend legal claims. Any further use or disclosure must have a lawful basis; this notice does not give unlimited permission to share your information.

Cookies and your choices

Cookies and similar technologies can keep a cart or sign-in session working, remember choices, measure website use or support marketing. Necessary functions include checkout, security and recording your privacy choices. Optional categories in our preference panel are Preferences, Analytics and Marketing.

Select Cookie preferences in the website footer to open the panel. You can save individual choices or decline optional categories and later change your selection using the same control. Your choice is recorded through Shopify's Customer Privacy service. Browser settings can also block or remove cookies; blocking necessary cookies may prevent sign-in or checkout from working. If a privacy control does not work for you, contact info@trainbot.tech.

Shopify's published merchant-store cookie list includes cart cookies lasting up to two weeks, consent and localisation cookies lasting up to one year, and analytics cookies with a 30-minute rolling session or up to one year. Which cookies apply depends on the feature, your choices and browser. See the Shopify cookie policy for names, purposes and current expiry periods. Third-party content and newsletter technologies have their own provider information linked or identified above.

Where applicable regional law provides a right to opt out of sale, sharing or targeted advertising, use the data-sharing opt-out page or contact us directly. Shopify's regional opt-out controls are currently enabled for applicable US states and may vary by visitor location. Global Privacy Control signals are handled through Shopify's regional privacy functionality where applicable. You can always send us a privacy request even if a regional form is not displayed.

You can unsubscribe from promotional email using the unsubscribe link in the message or by contacting us. This does not stop necessary purchase or service communications.

International processing

Our Shopify store's configured customer-data hosting location is the United States. Shopify and other providers may also process information in other countries, so your information is not necessarily kept only in Finland or the EEA. Transfers outside the EEA or UK must use an applicable lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards. You can request information about the safeguards relevant to your information from us; Shopify's privacy materials also explain its international processing.

How long information is retained

  • Accounting records: Finnish law generally requires transaction vouchers and related correspondence to be retained for at least six years after the end of the calendar year in which the financial period ended. Financial statements, accounting books and certain other accounting materials are retained for at least ten years from the financial-period end. These rules apply to relevant accounting evidence, not to every browsing or account record.
  • Orders, returns and warranty enquiries: records are retained for processing the purchase or request, meeting the legal duties associated with it, and the period needed to establish, exercise or defend applicable claims. Relevant records may need to be kept after an account is deleted or a commercial warranty expires.
  • Customer accounts: information is kept to operate your account and customer relationship. You may request deletion; we separate this from transaction information that must be retained for legal reasons.
  • Marketing: subscription information is used while your subscription remains active. After an objection or unsubscribe request, limited suppression or consent-evidence information may be retained to respect your choice and demonstrate compliance; it is not permission to continue marketing.
  • Technical records and cookies: retention follows the necessary operational or security purpose and the relevant cookie lifetime or service setting. Expired information is deleted or anonymised when no lawful retention purpose remains.

Your rights and complaints

Subject to the applicable legal conditions, you may request access, correction, deletion, restriction, a portable copy of information, or object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent for consent-based processing. We do not penalise you for exercising your rights.

Send requests to info@trainbot.tech. We may ask for proportionate information needed to verify your identity. Under the GDPR, we respond without undue delay and normally within one month; where the law permits an extension, we explain it within that first month. Retention required by law can limit deletion, and we will explain any applicable restriction. An authorised representative may contact us with evidence of their authority.

You may complain to the Finnish Office of the Data Protection Ombudsman or another competent supervisory authority, including the authority where you live or work. You do not have to contact us before complaining. Where your regional law provides an appeal right, you can also ask us to reconsider a decision.

Children, external websites and security

Our purchasing and account services are intended for adults. A parent or guardian can contact us if a child has supplied personal information so that we can assess and handle it appropriately. External websites and social networks have their own privacy practices; review their notices when using them. Keep your email account and sign-in codes secure and send only information needed for your request.

Updates

We update this notice when our services, processing or legal requirements change, and show the update date above. We give additional notice where the law requires it. An update does not retrospectively create consent or remove your rights.