Luhta.com – Nordic house of brands for sports, outdoors and more
Updated 10.9.2025
Luhta.com online shop register description and privacy policy
1. Controller
L-Fashion Group Oy
Business ID: 0149158-5
P.O. box 55, 15501 LAHTI, Finland
Tel. +358 (0)3 822 111 (switchboard)
2. Contact information for matters related to the register
If the matter pertains to the processing of personal information or the use of the rights based on GDPR in the Luhta.com online shop, you may contact the Data Protection Officer of L-Fashion Group Oy. The Data Protection Officer may be contacted via email at dataprotection@luhta.fi.
3. Register name
Luhta.com online shop customer register.
4. What data do we process?
We or our cooperation partners process the following data relating to the customer:
First name and last name
Date of birth
Home address, zip code, town or city (unlisted address or other contact information will not be entered into the register, the provider of the information is responsible for the conformance of the data)
E-mail address
Phone number
Preferred language of communication
Permissions for direct marketing and other marketing communication, such as marketing surveys
Data that is possibly collected on the basis of customer relationship:
Details of purchases made, including the location of purchase, total amount, product category and individual product items.
Data collected for the purpose of developing the customer relationship
Possible data on the controller’s retail chains, services and products that interest the customer
Data voluntarily provided by the customer
Customer-generated data (e.g., click and visit history)
Information that is possibly collected at the request of the customer:
Direct marketing restriction
Restriction on sending marketing surveys
5. Purpose of processing personal data
The personal data of Luhta.com online shop customers are processed for the following purposes:
Provision and production of services:
Personal data are processed for the processing of Luhta.com online shop orders, purchase transactions and returns as well as for invoicing.
→ Legal basis for processing: fulfilment of contract
Customer service:
Personal data are processed for the purpose of debt recovery and crediting, as well as for managing customer relations, communication with customers as well as designing and improving the customer service experience of Luhta.com customers. We also process personal data for the handling of errors, disruptions and complaints on the Luhta.com online store.
→ Legal basis for processing: legitimate interest
Marketing:
Personal data are also processed for marketing and communication purposes within the limits permitted by law. The data in the Luhta.com online shop register may also be used for targeting special offers, benefits, events or other marketing measures. The register collects data on Luhta.com customers’ purchasing behavior, including purchases made by point of sale, total amount, product category and individual product.
→ Legal basis for processing: customer consent, legitimate interest
Developing business operations:
Personal data are also processed for the purpose of analysing, designing and developing business operations, as well as preventing and investigating misuse. Feedback for developing the online shop may also be gathered in the register.
→ Legal basis for processing: legitimate interest
6. Where is data collected from?
The basic data and marketing data of the customer are collected from the Luhta.com online shop customer account and possibly from the notifications the customer gives the controller during the customer relationship either while the customer is using the controller’s services or when the customer gives or refuses consent for marketing when asked by the controller. The customer’s publicly available name and contact information can also be obtained from officials and companies offering updating services as the controller updates the customer register.
Data can also be obtained from the notifications given by the customer or from the answers the customer has given in customer surveys. We also collect data through cookies for targeted marketing, provided the customer has given their consent. The use of cookies on our Luhta.com website is described in a separate cookie policy.
7. Information on the recipients of the personal data
Personal data are processed by the employees of either L-Fashion Group Oy or L-Fashion Group Oy partners and subcontractors, whose duties require the processing of such data. The processors of the personal data are bound by confidentiality obligations, and personal data are processed confidentially.
Information may be disclosed from the register to officials if legislation so requires. The data stored in the customer register are not disclosed to parties outside of L-Fashion Group Oy other than in the circumstances described below or because of a legal obligation.
Customer register data can be disclosed to partners in the following situations:
Technical implementation of data processing:
To ensure the technical implementation of data processing, data may be transferred to or they can be collected directly by contract partners of the controller (such as suppliers, companies offering payment or fraud protection services, credit information companies and companies offering analysis environments, marketing services and marketing surveys). In these cases, the obligations related to data processing have been organised with contracts between the partners.
Examples of these third parties are Lamia Oy, Custobar Oy, Frosmo Oy, Klarna Ab, Posti Group Oyj and Google .
Other legal basis:
Data may be disclosed outside of L-Fashion Group Oy, if it is necessary on the basis of legislation or there is another legal basis for the disclosure, such as the customer’s consent for targeted marketing through external partners (for example, we use Google Signals as an external service for remarketing audiences) or if it is necessary in order to protect the company from legal action.
By external marketing partners we mean third parties outside of Luhta, such as advertisers, advertising technology providers, social media service providers, and providers of measurement and analytics services, who act as data processors on behalf of L-Fashion Group Oy. Where the customer has given consent, these third parties may place cookies on the customer’s device when visiting our services, for example, to deliver the most relevant advertising or to measure user numbers across different websites.
It is L-Fashion Group Oy’s goal that personal data are primarily processed in the EU and the European Economic Area.
Within the limits of the European Union General Data Protection Regulation (GDPR) and other applicable law, data may be transferred outside the EU or the European Economic Area if this is required by the technical implementation of its processing (see section ´Technical implementation of data processing´). If data are transferred, the transfers are based on an adequacy decision issued by the European Commission or safeguarded through supplementary measures required under applicable legislation. If such transfer of data is implemented, a contract following the EU Commission Standard Contractual Clauses is signed, or there is another legal basis for the transfer such as establishment, exercise or defence of legal claims.
8. Data protection principles and data retention period
Only specific employees of the controller or its partners have the right to access the register based on the user right granted by the controller. The information system of the Luhta.com customer register has been protected with firewalls and other technical security measures. The information system can only be accessed by named users using their personal usernames and passwords. The processors of the personal data are bound by duty of confidentiality and personal data are processed confidentially.
We store personal data in accordance with applicable legislation and only for as long as necessary to fulfil the predefined purposes for which the data was collected. In practice, this means that data is deleted once it is no longer needed for the purposes for which it was collected.
We store our customers' data for eight (8) years from the purchase transaction in order to handle any related claims. After this period, we delete the personal data from the customer register. The customer will be informed of the deletion in advance, provided that the customer has provided up-to-date contact details.
If a customer has not made any purchases within two (2) years and there is no other legal basis for retaining the data (for example, a previous purchase and related rights to submit complaints), the customer’s data will be automatically deleted. The customer will be informed of the termination in advance, provided that they have supplied up-to-date contact details.
Personal information is generally not kept in manual registers. Manually handled documents containing customer data are kept in locked and fireproof storage facilities.
The controller assesses the risks pertaining to data protection regularly.
9. Right of access
The customer has the right to find out what data the register holds about them. The customer can access their data primarily through the online shop at Luhta.com. If the customer is not able to access their data online, they can make a written and signed request for accessing their personal data via email at customerservice@luhta.com.The customer must additionally send a copy of the request to the Data Protection Officer of L-Fashion Group Oy by mail or via e-mail (dataprotection@luhta.fi). In the access request, the customer must state their identity and address. The customer’s identity may be verified.
The customer also has the right to know if L-Fashion Group Oy is processing their personal data. The customer must make a written and signed request for the information about data processing and deliver it via email to customerservice@luhta.com. The customer must in addition send a copy of the request to the Data Protection Officer of L-Fashion Group Oy via e-mail (dataprotection@luhta.fi). In the request, the customer must state their identity and address. The customer has the right to receive a copy of the processed data. If their data are not processed, the customer also has the right to receive confirmation of it. If the customer refuses consent for marketing communication, the customer may still be sent information regarding purchases or the customer relationship. In certain circumstances, the provision of information is a requirement for the implementation or use of a service.
10. Right to rectification of personal data
The customer has the right to have any incorrect or incomplete personal data rectified.
The customer can rectify their data primarily by contacting our customer service at customerservice@luhta.com. The customer must in addition send a copy of the request to the Data Protection Officer of L-Fashion Group Oy via e-mail (dataprotection@luhta.fi). In the rectification request, the customer must state their identity and address. The customer’s identity may be verified.
The controller may also rectify or complete incorrect or incomplete data in the register on their own initiative.
11. Right of erasure of personal data
The customer has the right to have their personal data erased where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the customer withdraws consent on which the processing is based and where there is no other legal ground for the processing;
The customer objects, on grounds relating to their particular situation, to processing of personal data concerning them which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling;(In this case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the customer or for the establishment, exercise or defence of legal claims.)
The customer objects to the processing of their personal data for direct marketing purposes;
The personal data have been unlawfully processed; or
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
The customer may make a written and signed request about the erasure of their personal data via email at customerservice@luhta.com. The customer must in addition send a copy of the request to the Data Protection Officer of L-Fashion Group Oy via e-mail (dataprotection@luhta.fi). In the request, the customer must state their identity and address. The customer’s identity may be verified.
We store our customers' data for eight (8) years from the purchase transaction in order to handle any related claims. After this period, we delete the personal data from the customer register.
12. Restriction of processing personal data
The customer has the right to obtain from the controller restriction of processing where one of the following applies:
the accuracy of the personal data is contested by the customer, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and the customer opposes the erasure of the personal data and requests the restriction of their use instead;
the controller no longer needs the personal data for the purposes of the processing, but they are required by the customer for the establishment, exercise or defence of legal claims;
The customer objects, on grounds relating to their particular situation, to processing of personal data concerning them which is necessary for the performance of a task carried out for reasons of public interest or for the exercise of official authority vested in the controller or processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party and the controller is waiting for the verification whether the legitimate grounds of the controller override those of the customer.
Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the customer’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
The customer may make a written and signed request about the restriction of processing of their personal data via email at customerservice@luhta.com. The customer must in addition send a copy of the request to the Data Protection Officer of L-Fashion Group Oy by mail or via e-mail (dataprotection@luhta.fi). In the request, the customer must state their identity and address. The customer’s identity may be verified.
13. Right to object
The customer has the right to object to the processing of their personal data where one of the following applies:
The customer has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them, which is necessary for the performance of a task carried out for reasons of public interest or for the exercise of official authority vested in the controller or which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, including profiling; or
(In this case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the customer or for the establishment, exercise or defence of legal claims.)
The customer has the right to object, at any time, to processing of personal data concerning them for direct marketing, which includes profiling to the extent that it is related to such direct marketing.
The customer may give a written and signed notice of objection about the processing of their personal data via email at customerservice@luhta.com. The customer must in addition send a copy of the notice to the Data Protection Officer of L-Fashion Group Oy by mail or via e-mail (dataprotection@luhta.fi). In the notification, the customer must state their identity and address. The customer’s identity may be verified.
14. Transfer of data
The customer has, under certain circumstances, the right to transfer the personal data stored by the controller to themselves or to another controller. The right applies to personal data, which the customer has given to the controller and which the controller processes based on the consent of the customer or in order to fulfil a contract in which the customer is a party. The right applies to data which are processed using data processing techniques.
15. The right to withdraw consent
The customer can, at any time, withdraw consent, when the processing of their personal information is based on this consent. The processing of personal data is based on consent, for example, when the customer has given consent to electronic direct marketing.
The customer can withdraw their consent by contacting the Luhta.com online shop’s customer service at customerservice@luhta.com.
16. Information about automated decision-making and profiling
Decision-making is automated when
decision-making is based solely on automatic processing of personal data; and
The decisions made have legal effects or similarly significantly affects the registered.
Profiling means the automated processing of personal information, in which personal aspects are evaluated.
Profiling specifically relates to the analysis or prediction of aspects concerning, for example, personal preferences, interests or behaviour.
Profiling
Is automated or semi-automated;
Targets personal data; and
Evaluates personal aspects.
The controller may profile their customers in order to target marketing based on the purchasing behaviour and preferences of the customer. According to the estimate of the controller, this kind of profiling does not have significant effects on the targeted customer. In addition, the profiling done by the controller is always based on the consent of the customer and the customer has the right to object to the profiling.
17. The right to lodge a complaint
If the customer considers the processing of their personal data by L-Fashion Group Oy to violate the provisions of the EU’s General Data Protection Regulation, the customer may lodge a complaint with a supervisory authority in their permanent place of residence or place of work or where the customer considers the violation of the provisions to have happened.
A list of contact details for all relevant data protection authorities in the European Economic Area (EEA) can be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en