Last Updated: 17 September 2026
1. Introduction
Welcome to the Privacy Policy of 24Seven Finland Oy Ab. We respect your privacy and are committed to protecting your personal data. This policy explains how we handle your personal data when you use our stores, our mobile app and our website, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
Controller
24Seven Finland Oy Ab (“24Seven”, “we”, “us”, “our”) is the controller of your personal data.
- Business ID (Y-tunnus): 3629716-8
- VAT number: FI36297168
- Registered in the Finnish Trade Register
- Address: Skogsgärdsvägen 5, 68555 Bosund, Finland
- Phone: +358 44 781 2451 or +358 44 977 6763
- Email: info@24-seven.fi
- Website: https://www.24-seven.fi
Data Protection Officer
For questions about this policy or to exercise your rights, contact our Data Protection Officer:
- Email: dpo@24-seven.fi
Changes to this policy
We may update this policy from time to time. We will post the new version on this page and update the “Last Updated” date. For material changes, we will also notify you in the app or by email before the change takes effect.
2. Personal data we collect
Identity data
- Finnish Trust Network (FTN) strong electronic identification (bank credentials or mobile certificate), provided through our identification broker Idura: your name and confirmation that your identity has been verified.
- Your personal identity code (henkilötunnus) is transmitted to us during identification. We store it only where necessary to reliably identify you, as permitted by Section 29 of the Finnish Data Protection Act, and protect it with additional encryption and access restrictions.
- Vipps MobilePay identification when you create an account or enter a store: your name and phone number, as confirmed by Vipps MobilePay. We do not receive your date of birth from Vipps MobilePay.
Contact data
- Mobile phone number (required), verified with a one-time SMS code
- Email address (optional but recommended)
Financial data
- Vipps MobilePay payment information (transaction reference, amount, status)
- Payment card information from in-store terminals (card type and last four digits only; we never receive the full card number or security code)
- Transaction history
Transaction data
- Products purchased, quantities and prices
- The store you visited
- Date and time of purchases
- Digital receipts
Technical data
- Device identifier
- IP address
- Authentication logs
- App usage data and operating system version
Usage data
- Store entry and exit times
- Interactions with smart fridges, vending machines and self-checkout
- App navigation and preferences (language, notifications)
Marketing and communications data
- Your marketing preferences
- Customer support messages
- Survey responses
Children
An account can be created by anyone who can complete strong electronic identification with the Finnish Trust Network (FTN) or identify themselves with Vipps MobilePay. We do not apply a separate minimum age beyond the requirements of those identification methods, so minors may also use our stores for everyday purchases. We do not direct marketing at minors, and we ask for marketing consent only from users aged 18 or over. Under the Finnish Data Protection Act, a child under 13 cannot give consent to online services on their own.
Required and optional data
Identification (FTN or Vipps MobilePay) and a verified mobile number are required to create an account. Without them, we cannot provide app-based store access or purchases. Your email address, marketing preferences and location are optional.
How we collect your data
- Directly from you: when you register, shop, contact support or answer surveys.
- Automatically: through the app, store entry systems, smart fridges, vending machines and self-checkouts, and technical logs and cookies.
- From third parties: Idura (FTN identification), Vipps MobilePay (identification and payments) and Market Pay (card payments).
3. How we use your personal data and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Identity, contact | Contract (GDPR Art. 6(1)(b)) |
| Strong identification at registration and store entry | Identity, technical | Contract (Art. 6(1)(b)); legitimate interest in store security (Art. 6(1)(f)) |
| Opening doors, smart fridges and vending machines | Identity, usage | Contract (Art. 6(1)(b)) |
| Processing payments | Financial, transaction | Contract (Art. 6(1)(b)) |
| Receipts and bookkeeping | Transaction, financial | Legal obligation under the Finnish Accounting Act (Art. 6(1)(c)) |
| Customer support | Contact, communications | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Store security, loss prevention and fraud detection | Identity, usage, transaction, technical | Legitimate interests (Art. 6(1)(f)) |
| Service improvement and aggregated statistics | Usage, technical | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Contact, marketing | Consent (Art. 6(1)(a)) |
| Nearest-store feature | Location (on request only) | Consent (Art. 6(1)(a)) |
| Responding to authorities | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can withdraw consent at any time in the app settings or by contacting us. Withdrawing consent does not affect processing carried out before withdrawal.
Automated decision-making
- Fraud detection: we analyse transaction patterns to flag suspicious activity. A flag is reviewed by our staff before any action that significantly affects you. You may request human review, express your view and contest the outcome by emailing dpo@24-seven.fi.
We do not use your data for profiling that produces legal or similarly significant effects.
Marketing
We send marketing only if you have opted in. You can opt out at any time by using the unsubscribe link in emails, changing the notification settings in the app, or emailing dpo@24-seven.fi. Marketing consent is separate from accepting our Terms and Conditions.
4. Who we share your data with
Service providers and partners
| Provider | Service | Location | Data | Safeguards |
|---|---|---|---|---|
| Idura ApS (Copenhagen, Denmark) | Identification broker for the Finnish Trust Network (FTN) | EU | Identification requests and results | Data processing agreement; EU-based |
| Vipps MobilePay AS, Finnish branch (Business ID 3330214-4; parent company in Norway) | Identification at the store entrance and MobilePay payments | EU/EEA | Identification data, phone number, payment information | EEA-based regulated payment institution acting as an independent controller for payments |
| Market Pay (Paris, France) | Card payments at in-store terminals | EU | Card type, last four digits, amount, timestamp | PCI DSS certified; EU-based |
| Amazon Web Services (AWS) | Primary hosting and backups | Stockholm, Sweden (eu-north-1) | All service data (encrypted) | Data processing agreement; EU data centre |
| Other IT service providers | SMS delivery of verification codes, email delivery, customer support and business software | See International transfers | Contact data, support messages | Data processing agreements |
Providers acting as our processors act only on our instructions under a data processing agreement, apply appropriate security measures, assist us with GDPR compliance, and delete data when it is no longer needed. Vipps MobilePay processes payment data as an independent controller under its own privacy notice.
Store owners (franchisees)
Our stores are operated by independent store owners. We may share your entry and identification data, and related transaction data, with the owner of the store you visited in order to ensure store security, investigate incidents such as theft or damage, handle returns, and allow the store owner to establish, exercise or defend legal claims. This sharing is based on our and the store owner’s legitimate interests.
Authorities
- Tax authorities (Verohallinto / Finnish Tax Administration)
- Police and other authorities when required by law
- Other supervisory authorities where legally required
Professional advisers
Auditors, legal advisers and insurers, under confidentiality obligations.
International transfers
Your service data is stored within the EU/EEA. If a service provider processes personal data outside the EU/EEA, we ensure an appropriate safeguard is in place, such as a European Commission adequacy decision (including the EU-US Data Privacy Framework) or the Commission's Standard Contractual Clauses. You can ask about our providers and safeguards at any time by emailing dpo@24-seven.fi.
5. Data security
Technical measures
- Encryption in transit (TLS 1.2 or higher, TLS 1.3 where supported)
- Encryption at rest for sensitive data (AES-256)
- Multi-factor authentication and role-based access for our systems
- Firewalls, intrusion detection, regular patching and vulnerability scanning
- Annual penetration testing
- Audit logging of access to personal data
Organisational measures
- Access on a need-to-know basis
- Confidentiality agreements and regular data protection training
- Information security policy, incident response plan and business continuity planning
- Vendor security assessments
Personal data breaches
If a personal data breach occurs, we will:
- Contain and assess the breach and document it in our breach register.
- Notify the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) within 72 hours where required by Article 33 GDPR.
- Notify you without undue delay if the breach is likely to result in a high risk to your rights, explaining what happened, the likely consequences, what we have done, and what you can do to protect yourself.
- Investigate the root cause and improve our safeguards.
6. Data retention
| Data | Retention period | Reason |
|---|---|---|
| Account information | Until you delete your account, plus the 30-day reactivation period | Service provision and reactivation |
| Personal identity code (henkilötunnus) | Until you delete your account, plus the 30-day reactivation period | Reliable identification (Finnish Data Protection Act, section 29) |
| Identification result (name, verification status) | While your account is active | Account security |
| Accounting vouchers (receipts, transaction and payment records) | 6 years from the end of the year in which the financial year ended | Finnish Accounting Act (Kirjanpitolaki 1336/1997), chapter 2, section 10 |
| Financial statements and ledgers | 10 years from the end of the financial year | Finnish Accounting Act |
| Store access and security logs | 3 months | Security and incident investigation |
| Customer support records | 3 years from last contact | Handling claims |
| Marketing consent | Until withdrawn (proof of consent kept as long as needed to demonstrate it) | Consent |
| Anonymised data | Indefinitely | No longer personal data |
When a retention period ends, data is securely deleted or anonymised within 30 days, and the deletion is logged. Retention may be extended for ongoing legal proceedings, authority investigations or legal holds.
Account deletion
When you delete your account, it is deactivated immediately and you have 30 days to reactivate it by signing in. After 30 days, your account data is deleted and your personal details in purchase and store visit records are irreversibly anonymised. Accounting records we are legally required to keep are retained in anonymised form or, where identification is legally required, for the statutory period only.
7. Your rights
Under the GDPR you have the right to:
- Be informed about how we process your data (this policy).
- Access your data and receive a copy (Art. 15).
- Rectification of inaccurate or incomplete data (Art. 16), including via the app settings.
- Erasure (Art. 17), subject to legal retention obligations and legal claims. Use account deletion in the app or email support@24-seven.fi.
- Restriction of processing (Art. 18).
- Data portability (Art. 20): your data in JSON or CSV format for data you provided on the basis of contract or consent.
- Object (Art. 21) to processing based on legitimate interests, and at any time to direct marketing.
- Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22).
- Withdraw consent at any time.
How to exercise your rights
Email dpo@24-seven.fi, stating your request and your registered mobile number. We may ask you to verify your identity to protect your data.
- We acknowledge requests within 3 business days.
- We respond within one month. For complex or numerous requests, this may be extended by up to two further months; we will tell you within the first month if so.
- Requests are free of charge. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse.
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country where you live, work or where the alleged infringement took place. In Finland:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
- Website: www.tietosuoja.fi
- Email: tietosuoja@om.fi
- Switchboard: +358 29 566 6700
- Postal address: PL 800, 00531 Helsinki, Finland
- Visiting address: Lintulahdenkuja 4, Helsinki
8. Cookies and similar technologies
Mobile app
- Essential identifiers (device ID, session ID) needed for the app to work. Legal basis: contract and legitimate interests.
- Analytics and crash reporting: we do not use Google Firebase, Google Analytics or other third-party analytics or crash reporting tools in the app.
Website
Our website uses necessary, functional, analytics and marketing cookies. Non-necessary cookies are used only with your consent. See our Cookie Policy and manage your choices through the cookie banner or your browser settings.
9. Specific privacy notices
Strong electronic identification (FTN via Idura)
- What happens: you identify yourself in the app with your Finnish bank credentials or mobile certificate. Idura passes the result to us.
- Purpose: secure account creation and sign-in.
- Legal basis: contract; legitimate interests (security).
- Retention: see section 6. Your henkilötunnus is stored securely for identification purposes, as described in section 2.
Vipps MobilePay
- At account creation and at the store entrance: you can identify yourself with Vipps MobilePay to create your account or to open the door. We receive the identification result and the data listed in section 2.
- Payments: we receive the transaction reference, amount and status. Funds are transferred according to Vipps MobilePay’s rules.
- Vipps MobilePay’s own privacy notice: help.vippsmobilepay.com/en-FI/terms-and-privacy
Card payments (Market Pay)
- Used at payment terminals in our stores. Card payments in the app are not currently available.
- We receive only the card type, last four digits and transaction confirmation. We never receive the full card number or security code.
- The amount is authorised at checkout and captured immediately after authorisation. Where a pre-authorisation is needed, the final amount is captured as soon as the purchase is completed.
Location data
Used only to show your nearest store, only if you enable it, and never tracked continuously. Turn it off in Settings > Privacy > Location.
10. Users outside Finland
We process all data under the GDPR and Finnish law, within the EU/EEA as described above. Users from other countries have the same rights as described in this policy.
11. Privacy by design
We build privacy into our systems from the start: we collect only the data we need, apply privacy-protective default settings, secure data throughout its lifecycle, and carry out data protection impact assessments for new or high-risk processing.
12. Glossary
- Personal data: information relating to an identified or identifiable person.
- Controller: the organisation that decides why and how personal data is processed (24Seven Finland Oy Ab).
- Processor: an organisation that processes personal data on the controller’s behalf.
- FTN (Finnish Trust Network): Finland’s network for strong electronic identification with bank credentials or mobile certificates.
- Henkilötunnus: Finnish personal identity code.
- Supervisory authority: in Finland, the Office of the Data Protection Ombudsman.
13. Contact information
Data protection: dpo@24-seven.fi
Customer support: support@24-seven.fi · +358 44 781 2451 or +358 44 977 6763
General inquiries:
24Seven Finland Oy Ab
Skogsgärdsvägen 5, 68555 Bosund, Finland
info@24-seven.fi
This policy is published in English. For a PDF or another format, contact dpo@24-seven.fi.