Kontakt
Mitä etsit?
Tietosuoja-käytäntö
Näin käsittelemme henkilötietojasi 24Seven:ssa.
Näin käsittelemme henkilötietojasi 24Seven:ssa.
Last Updated: 17 September 2026
Welcome to the Privacy Policy of 24Seven Finland Oy Ab. We respect your privacy and are committed to protecting your personal data. This policy explains how we handle your personal data when you use our stores, our mobile app and our website, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).
24Seven Finland Oy Ab (“24Seven”, “we”, “us”, “our”) is the controller of your personal data.
For questions about this policy or to exercise your rights, contact our Data Protection Officer:
We may update this policy from time to time. We will post the new version on this page and update the “Last Updated” date. For material changes, we will also notify you in the app or by email before the change takes effect.
An account can be created by anyone who can complete strong electronic identification with the Finnish Trust Network (FTN) or identify themselves with Vipps MobilePay. We do not apply a separate minimum age beyond the requirements of those identification methods, so minors may also use our stores for everyday purchases. We do not direct marketing at minors, and we ask for marketing consent only from users aged 18 or over. Under the Finnish Data Protection Act, a child under 13 cannot give consent to online services on their own.
Identification (FTN or Vipps MobilePay) and a verified mobile number are required to create an account. Without them, we cannot provide app-based store access or purchases. Your email address, marketing preferences and location are optional.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Identity, contact | Contract (GDPR Art. 6(1)(b)) |
| Strong identification at registration and store entry | Identity, technical | Contract (Art. 6(1)(b)); legitimate interest in store security (Art. 6(1)(f)) |
| Opening doors, smart fridges and vending machines | Identity, usage | Contract (Art. 6(1)(b)) |
| Processing payments | Financial, transaction | Contract (Art. 6(1)(b)) |
| Receipts and bookkeeping | Transaction, financial | Legal obligation under the Finnish Accounting Act (Art. 6(1)(c)) |
| Customer support | Contact, communications | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Store security, loss prevention and fraud detection | Identity, usage, transaction, technical | Legitimate interests (Art. 6(1)(f)) |
| Service improvement and aggregated statistics | Usage, technical | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Contact, marketing | Consent (Art. 6(1)(a)) |
| Nearest-store feature | Location (on request only) | Consent (Art. 6(1)(a)) |
| Responding to authorities | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can withdraw consent at any time in the app settings or by contacting us. Withdrawing consent does not affect processing carried out before withdrawal.
We do not use your data for profiling that produces legal or similarly significant effects.
We send marketing only if you have opted in. You can opt out at any time by using the unsubscribe link in emails, changing the notification settings in the app, or emailing dpo@24-seven.fi. Marketing consent is separate from accepting our Terms and Conditions.
| Provider | Service | Location | Data | Safeguards |
|---|---|---|---|---|
| Idura ApS (Copenhagen, Denmark) | Identification broker for the Finnish Trust Network (FTN) | EU | Identification requests and results | Data processing agreement; EU-based |
| Vipps MobilePay AS, Finnish branch (Business ID 3330214-4; parent company in Norway) | Identification at the store entrance and MobilePay payments | EU/EEA | Identification data, phone number, payment information | EEA-based regulated payment institution acting as an independent controller for payments |
| Market Pay (Paris, France) | Card payments at in-store terminals | EU | Card type, last four digits, amount, timestamp | PCI DSS certified; EU-based |
| Amazon Web Services (AWS) | Primary hosting and backups | Stockholm, Sweden (eu-north-1) | All service data (encrypted) | Data processing agreement; EU data centre |
| Other IT service providers | SMS delivery of verification codes, email delivery, customer support and business software | See International transfers | Contact data, support messages | Data processing agreements |
Providers acting as our processors act only on our instructions under a data processing agreement, apply appropriate security measures, assist us with GDPR compliance, and delete data when it is no longer needed. Vipps MobilePay processes payment data as an independent controller under its own privacy notice.
Our stores are operated by independent store owners. We may share your entry and identification data, and related transaction data, with the owner of the store you visited in order to ensure store security, investigate incidents such as theft or damage, handle returns, and allow the store owner to establish, exercise or defend legal claims. This sharing is based on our and the store owner’s legitimate interests.
Auditors, legal advisers and insurers, under confidentiality obligations.
Your service data is stored within the EU/EEA. If a service provider processes personal data outside the EU/EEA, we ensure an appropriate safeguard is in place, such as a European Commission adequacy decision (including the EU-US Data Privacy Framework) or the Commission's Standard Contractual Clauses. You can ask about our providers and safeguards at any time by emailing dpo@24-seven.fi.
If a personal data breach occurs, we will:
| Data | Retention period | Reason |
|---|---|---|
| Account information | Until you delete your account, plus the 30-day reactivation period | Service provision and reactivation |
| Personal identity code (henkilötunnus) | Until you delete your account, plus the 30-day reactivation period | Reliable identification (Finnish Data Protection Act, section 29) |
| Identification result (name, verification status) | While your account is active | Account security |
| Accounting vouchers (receipts, transaction and payment records) | 6 years from the end of the year in which the financial year ended | Finnish Accounting Act (Kirjanpitolaki 1336/1997), chapter 2, section 10 |
| Financial statements and ledgers | 10 years from the end of the financial year | Finnish Accounting Act |
| Store access and security logs | 3 months | Security and incident investigation |
| Customer support records | 3 years from last contact | Handling claims |
| Marketing consent | Until withdrawn (proof of consent kept as long as needed to demonstrate it) | Consent |
| Anonymised data | Indefinitely | No longer personal data |
When a retention period ends, data is securely deleted or anonymised within 30 days, and the deletion is logged. Retention may be extended for ongoing legal proceedings, authority investigations or legal holds.
When you delete your account, it is deactivated immediately and you have 30 days to reactivate it by signing in. After 30 days, your account data is deleted and your personal details in purchase and store visit records are irreversibly anonymised. Accounting records we are legally required to keep are retained in anonymised form or, where identification is legally required, for the statutory period only.
Under the GDPR you have the right to:
Email dpo@24-seven.fi, stating your request and your registered mobile number. We may ask you to verify your identity to protect your data.
You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country where you live, work or where the alleged infringement took place. In Finland:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Our website uses necessary, functional, analytics and marketing cookies. Non-necessary cookies are used only with your consent. See our Cookie Policy and manage your choices through the cookie banner or your browser settings.
Used only to show your nearest store, only if you enable it, and never tracked continuously. Turn it off in Settings > Privacy > Location.
We process all data under the GDPR and Finnish law, within the EU/EEA as described above. Users from other countries have the same rights as described in this policy.
We build privacy into our systems from the start: we collect only the data we need, apply privacy-protective default settings, secure data throughout its lifecycle, and carry out data protection impact assessments for new or high-risk processing.
Data protection: dpo@24-seven.fi
Customer support: support@24-seven.fi · +358 44 781 2451 or +358 44 977 6763
General inquiries: 24Seven Finland Oy Ab Skogsgärdsvägen 5, 68555 Bosund, Finland info@24-seven.fi
This policy is published in English. For a PDF or another format, contact dpo@24-seven.fi.