Last updated: 23 September 2026

1. Controller

Name: Pieni Thai Oy
Business ID: 3568100-2
Address: Puntarikatu 1, 20780 Kaarina
Phone number: +358 45 787 10649
Email: contact@littlethai.fi
Contact person: Toni Lehtinen

2. Name of the register

Pieni Thai Oy's customer, order, and marketing register

3. Purpose and legal basis for processing personal data

We process your personal data for the following purposes:

Online store orders and customer service

Purpose: Receiving, preparing, delivering, or facilitating the pickup of orders, confirming payment transactions, sending order confirmations and notifications, customer service, and handling potential claims and cancellations.
Legal basis: Performance of a contract (GDPR Article 6(1)(b)) and compliance with legal obligations, such as the Accounting Act (GDPR Article 6(1)(c)).

Registered user information and customer accounts

Purpose: Maintaining user accounts, facilitating transactions and reordering, and displaying order history to the customer.
Legal basis: Performance of a contract (GDPR Article 6(1)(b)).

Newsletters and marketing

Purpose: Sending lunch menus, offers, news, and campaigns via email.
Legal basis: Consent of the data subject (GDPR Article 6(1)(a)).

Website development and data security

Purpose: Ensuring the functionality of the website and online store, fixing errors, preventing abuse, and improving visitor experience through analytics.
Legal basis: Legitimate interest (GDPR Article 6(1)(f)) – maintaining and developing the quality, security, and usability of the service.

4. Data content of the register

We may collect and process the following information:

Online store customers and orders:

First and last name
Email address
Phone number
Delivery and/or billing address (for home deliveries)
Order details (ordered dishes/products, price, delivery method, pickup time, and any additional information/special requests provided by the customer)
Payment method and payment transaction identifier (note: we never process or store card numbers; these are handled securely by the payment provider)

Registered users:

Name, email address, and phone number
Saved address details
Username and password (encrypted/hashed)
Registration date and order history
Language selected on the site

Newsletter subscribers:

Name (optional)
Email address
Date of subscription and consent given for marketing communications
Language selected on the site

Technical and usage data of the website:

IP address
Browser type and version, and operating system
Visit times, pages browsed, and actions on the site
Information collected via cookies

Games

Number of game sessions, best scores, comparison with other players
Publicly visible information: Player's best scores and nickname, which the user can set in their profile settings. No other information is published without separately requested permission.

5. Regular sources of information

Data is obtained from the data subject themselves when placing online store orders, creating a user account, subscribing to the newsletter, or during other contact.
Payment transaction status (successful/aborted) is obtained from the payment service provider.
Technical usage data of the website is collected automatically through the use of the site via cookies and server logs.

6. Data retention period

Order and purchase information (accounting records): Retained in accordance with the Accounting Act for 6 years from the end of the calendar year in which the financial year ended.
Registered users: Data is retained for the duration of the user account and for a maximum of two (2) years from the last login or order, unless the user requests the deletion of their account sooner.
Newsletter subscribers: Data is retained until the newsletter subscription is cancelled or consent is withdrawn.
Website usage data: Analytics and log data are retained for a maximum of 26 months.

7. Disclosure and transfer of data

We do not sell, rent, or disclose your personal data to third parties for marketing purposes.

Data may be transferred or disclosed only to the following parties to fulfill the services:

Payment providers: Secure processing of order payments.
Transport and delivery partners: Potential parties handling order delivery (only address and phone information necessary for delivery).
IT and software service providers: Operator of the online store platform, hosting service, email service, and analytics tools.
Authorities: To fulfill legal obligations upon a legally based request by authorities.

Data is processed primarily within the EU and EEA. If data is transferred outside the EU/EEA, we ensure appropriate safeguards, such as the European Commission's standard contractual clauses (SCC).

8. Principles of register protection

Personal data protection is ensured through appropriate technical and organizational measures:

The site and online store always use a secure SSL/TLS encrypted connection (HTTPS).
All electronic systems are protected by firewalls, usernames, and strong passwords.
Access to order and customer data is restricted only to employees whose duties (such as food preparation, delivery, or customer service) require it.
Data processing agreements (DPA) compliant with the GDPR have been signed with partners and service providers.

9. Data subject rights

In accordance with applicable data protection legislation, you have the following rights:

Right of access: The right to know what personal data we process and to request a copy of it.
Right to rectification: The right to demand the correction of incorrect, outdated, or incomplete data.
Right to erasure ("right to be forgotten"): The right to request the deletion of your data, unless we have a legal obligation (such as the Accounting Act) to retain the data.
Right to restriction of processing: The right to restrict the processing of your data in certain statutory situations.
Right to object: The right to object to the processing of data to the extent that processing is based on legitimate interest.
Right to data portability: The right to receive the data you provided to us in a structured and machine-readable format.
Withdrawal of consent: You can unsubscribe from the newsletter at any time via the link at the bottom of the message or by contacting us.

Right to lodge a complaint with a supervisory authority:

If you believe that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with the Data Protection Ombudsman:

Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PO Box 800, 00531 Helsinki
Telephone exchange: 029 566 6700
Email: tietosuoja@oikeus.fi
Website: tietosuoja.fi

10. Exercising rights

All requests related to data protection and exercising your rights must be submitted in writing via email to contact@littlethai.fi. We may request identity verification before fulfilling the request. We will respond to requests in accordance with the GDPR within one month.

11. Cookies

Our website and online store use cookies and similar technologies. Some cookies are necessary for the basic functions of the site and online store (such as shopping cart functionality and order progress), while others are used for analytics and improving the user experience.

12. Changes to the privacy policy

We reserve the right to update and change this privacy policy as our operations or legislation change. We recommend checking this policy regularly. We will announce significant changes on our website.

Privacy Policy