Privacy policy
BääBää - Privacy Policy
Last updated: 3 October 2026
This Privacy Policy explains how Poro Garage Oy, the company behind the BääBää online store, collects, uses, stores, and protects personal data, and what rights data subjects have in relation to the processing of their personal data.
This Privacy Policy applies to customers of the BääBää online store, users of the website, persons who contact customer service, and other individuals whose personal data we process in the contexts described in this Privacy Policy.
Personal data is processed in accordance with the European Union General Data Protection Regulation (EU) 2016/679 (GDPR), Finnish data protection legislation, and other applicable legislation.
1. Data Controller
Poro Garage Oy
Business ID: 3152600-5
Hemmolankatu 23 A 14
08150 Lohja
Finland
Email: info@baabaa.fi
Phone: +358 50 551 8778
BääBää® is an online store and brand used by Poro Garage Oy.
2. Contact Person for Data Protection Matters
For questions concerning data protection and the processing of personal data, you can contact:
Petra Elias
Email: petra@baabaa.fi
Phone: +358 50 551 8778
3. What Personal Data Do We Process?
The personal data processed depends on how you interact with the BääBää online store.
We may process, for example, the following information:
Customer and Order Information
-
first and last name
-
delivery and billing address
-
email address
-
telephone number
-
order information
-
ordered products and related information
-
delivery information
-
return and complaint information
-
customer communications and contacts
-
any notes relating to the customer relationship
Payment-Related Information
External payment service providers are used to process payment transactions.
BääBää does not normally process or store complete payment card numbers in its own systems. Payment card and other payment information is processed in the systems of the payment service providers in accordance with their applicable data protection and security practices.
BääBää currently uses, among others, Paytrail and Shopify Payments payment services. The current payment methods offered by BääBää include, for example, card, bank, mobile, invoice, and instalment payment methods.
Technical Website Information
In connection with the use of the website, we may process, for example:
-
IP address
-
device and browser information
-
operating system
-
technical information relating to the use of the website
-
information concerning cookies and similar technologies
-
activities and events carried out on the website in accordance with applicable cookie and data protection settings
Not all of the information listed above is collected from all users.
4. Purposes of Processing Personal Data
We process personal data for the following purposes:
Processing Orders and Performing the Contract
We process personal data in order to:
-
receive and process orders
-
confirm orders
-
deliver products
-
process payments through payment service providers
-
process returns and refunds
-
handle complaints and other matters relating to orders
-
communicate with the customer regarding matters relating to the order.
Customer Service
Personal data provided in connection with customer contacts is processed for the purposes of customer service, advice, feedback, complaints, and handling other customer-related matters.
Compliance with Legal Obligations
Personal data is also processed when processing is necessary for Poro Garage Oy to comply with a legal obligation, such as accounting, tax, and other statutory obligations.
Development of the Online Store and Services
We may process information to develop the functionality, security, products, services, and customer experience of the online store.
Where analytics based on cookies or similar technologies requires the user's consent, such information is processed only after consent has been given.
Direct Marketing
We may send electronic marketing communications where there is a lawful basis for doing so under applicable legislation.
Where electronic direct marketing is based on consent, processing is based on the consent you have given. You may withdraw your consent at any time.
Marketing communications include an appropriate option to refuse to receive further marketing communications.
5. Legal Bases for Processing Personal Data
Depending on the purpose of the processing, the processing of personal data is based on one or more of the following legal bases under the GDPR:
Contract
Article 6(1)(b) of the GDPR applies where processing is necessary for the performance of an order agreement or another agreement entered into with us, or in order to take steps at your request prior to entering into a contract.
Legal Obligation
Article 6(1)(c) of the GDPR applies where processing is necessary for compliance with a legal obligation to which we are subject.
Legitimate Interest
Article 6(1)(f) of the GDPR applies where processing is necessary for the purposes of the legitimate interests pursued by Poro Garage Oy or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
Legitimate interests may include, for example, website security, prevention of misuse, management of customer relationships, development of services, and the establishment, exercise, or defence of legal claims.
Consent
Article 6(1)(a) of the GDPR applies where processing is based on the consent you have given.
Providing consent is voluntary, and you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Sources of Personal Data
We primarily obtain personal data:
-
from you when placing an order through the online store
-
when you contact customer service
-
in connection with a return, complaint, or other customer matter
-
when subscribing to a newsletter or other marketing communications
-
in connection with the use of the website through technologies and cookies for their permitted purposes
-
from payment service and delivery service partners to the extent necessary to process an order.
7. Recipients and Processors of Personal Data
Personal data may be disclosed or service providers may be used to process personal data where this is necessary to fulfil the purposes described in this Privacy Policy.
Such recipients and processors may include, for example:
Online Store and Technology Service Providers
Providers of the technical implementation of the online store and related services process data to enable the operation of the BääBää online store.
Payment Service Providers
BääBää uses, among others, the following for payment processing:
-
Paytrail Oyj
-
Shopify Payments / Stripe Payments Europe, Ltd
According to BääBää's current payment methods page, Paytrail acts as a payment service provider, and Stripe Payments Europe, Ltd acts as Shopify Payments' European payment service partner.
Payment service providers process payment-related information to provide their services and in accordance with applicable legislation.
Transport and Logistics Services
Transport and logistics partners used to deliver orders receive the information necessary to complete the delivery, such as the recipient's name, delivery address, and, where necessary, telephone number or email address.
Accounting and Financial Administration Services
Personal data may be processed for accounting, financial administration, invoicing, and compliance with statutory obligations.
Authorities
Information may be disclosed to authorities where disclosure is required by law or by a binding order from an authority.
Service providers may be replaced or added where necessary for the operation of the online store. In such cases, personal data processing is carried out in accordance with the requirements of the GDPR, and appropriate data processing agreements are entered into with processors where required.
8. Transfers of Personal Data Outside the EU and EEA
We aim to use service providers whose processing of personal data takes place within the European Union or the European Economic Area.
If personal data is transferred outside the EU or EEA, we ensure that the transfer is carried out in accordance with Chapter V of the GDPR.
A transfer may be based, for example, on:
-
an adequacy decision adopted by the European Commission
-
Standard Contractual Clauses (SCCs) adopted by the European Commission
-
another transfer mechanism permitted under the GDPR.
The safeguards relating to data transfers are assessed on the basis of the applicable legislation and the relevant service provider.
9. Retention of Personal Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was processed or as otherwise required by law.
The retention period depends on the type of data and the purpose of processing.
For example:
-
order and customer relationship information is retained for as long as necessary to manage the customer relationship and fulfil contractual obligations
-
accounting and tax-related information is retained for the period required by applicable legislation
-
information relating to complaints and legal claims may be retained for as long as necessary for the establishment, exercise, or defence of a legal claim
-
information concerning marketing consent is retained for as long as necessary to demonstrate the consent and manage marketing activities
-
the retention period for cookie-related information depends on the relevant cookie and its purpose.
When personal data is no longer needed, it is securely deleted or anonymised unless legislation requires its retention.
10. Protection of Personal Data
Poro Garage Oy uses appropriate technical and organisational measures to protect personal data.
Such measures may include, for example:
-
encrypted connections
-
restriction of access rights
-
protection of user accounts and passwords
-
appropriate protection of services and systems
-
restricting the access rights of employees and other persons processing data according to their work responsibilities
-
appropriate handling and disposal of data
-
assessment of the security requirements of service providers.
Personal data is processed only by persons who are authorised to do so on the basis of their work responsibilities.
11. Rights of Data Subjects
Under the GDPR, you have the following rights in relation to the processing of your personal data.
Right of Access
You have the right to obtain confirmation as to whether we process your personal data and to request access to your personal data and the information concerning its processing required under the GDPR.
Right to Rectification
You have the right to request the correction of inaccurate or incomplete personal data.
Right to Erasure
In certain circumstances, you may have the right to request the deletion of your personal data.
The right to erasure is not absolute. For example, we may have a legal obligation to retain information or another legal basis under the GDPR for continuing to process it.
Right to Restriction of Processing
In certain circumstances, you may have the right to request restriction of the processing of your personal data.
Right to Object
You have the right to object to the processing of your personal data in certain circumstances where the processing is based on legitimate interests.
You always have the right to object to the processing of your personal data for direct marketing purposes.
Withdrawal of Consent
Where the processing of personal data is based on consent, you may withdraw your consent at any time.
12. Exercising Your Rights
You may exercise your data subject rights by contacting:
Poro Garage Oy / BääBää®
Email: info@baabaa.fi
When making a request, it is advisable to specify as clearly as possible which right you wish to exercise and which information the request concerns.
Where necessary, we may request additional information to verify your identity so that personal data is not disclosed to the wrong person.
We will process requests concerning data subject rights within the time limits prescribed by the GDPR.
13. Right to Lodge a Complaint with a Supervisory Authority
If you believe that the processing of your personal data violates applicable data protection legislation, you have the right to lodge a complaint with the competent data protection supervisory authority.
In Finland, the national supervisory authority is the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
P.O. Box 800
00531 Helsinki
Finland
Website: www.tietosuoja.fi
Email: tietosuoja@om.fi
The data subject has the right to refer a matter concerning the processing of personal data to the Data Protection Ombudsman if they believe that the processing of personal data violates data protection legislation.
14. Cookies and Similar Technologies
The BääBää online store uses cookies and similar technologies to enable the operation of the website, remember user preferences and, based on the user's consent, for analytics and marketing.
Cookies are divided into categories based on their purpose, for example:
Necessary Cookies
Necessary cookies are required for the technical operation of the online store. They may be used, for example, for:
-
shopping cart functionality
-
the checkout process
-
security
-
session management
-
the technical provision of an online service requested by the user.
The use of necessary cookies generally does not require the user's consent.
Functional Cookies
Functional cookies may be used, for example, to remember the user's choices and preferences.
If functional cookies are not technically necessary, their use is based on the user's consent.
Analytics and Performance Cookies
Analytics cookies may be used to measure the use and functionality of the website and to develop services.
Where the use of such cookies requires consent, the cookies are used only after the user has given consent.
Marketing and Advertising Cookies
Marketing cookies and similar technologies may be used, for example, to target advertising, measure advertising effectiveness, and carry out marketing based on the user's interests.
Such technologies are used only after the user has given the required consent.
15. Cookie Consent
Where the website uses non-essential cookies or similar technologies whose use requires consent, users are given the opportunity to accept or reject such cookies and manage their choices.
Consent is requested before technologies requiring consent are activated.
Consent must be freely given, specific, informed, and unambiguous. Users must be able to withdraw their consent as easily as they gave it.
Acceptance of cookies is not a general requirement for normal use of the online store where the cookies concerned require the user's consent.
16. Cookie Management
You can manage your cookie settings through the cookie settings management function available on the website.
You can also manage or delete cookies through your browser settings.
Blocking cookies may affect the operation of certain online store functions, particularly where technically necessary cookies are concerned.
17. Third-Party Services
The BääBää online store may use third-party technical, payment, analytics, marketing, communication, or other services related to the functions of the online store.
Such services may process personal data or use cookies to provide their services.
The use of third-party services is, as applicable, based on a contract, law, legitimate interest, or the user's consent.
Where a particular service requires consent, it will not be activated before the required consent has been obtained.
18. Changes to this Privacy Policy
Poro Garage Oy may update this Privacy Policy, for example, when the online store, services used, legislation, or data protection practices change.
The latest version will be published on this page.
If the changes have a material impact on the processing of personal data or the rights of data subjects, we will seek to draw appropriate attention to the changes.
19. Contact Information
Poro Garage Oy / BääBää®
Business ID: 3152600-5
Hemmolankatu 23 A 14
08150 Lohja
Finland
Email: info@baabaa.fi
Phone: +358 50 551 8778
Contact person for data protection matters:
Petra Elias
petra@baabaa.fi