Old Continent Atelier

Privacy Policy

This privacy statement describes how Old Continent Atelier (CVPE Development Oy) processes personal data when you use this store, in line with the EU General Data Protection Regulation (GDPR).

1. Data controller

CVPE Development Oy (Y-tunnus 3245678-9)
Mannerheimintie 1, 00100 Helsinki, Finland
Contact: hello@cvpe.dev
Data protection contact: J. Ahonen

2. What we process and why

Orders and delivery. Name, contact details, delivery address, and order contents are processed to fulfil your purchase and provide customer service. Legal basis: performance of a contract (Art. 6(1)(b)) and our legal obligation to retain accounting records (Art. 6(1)(c)).

Payments. Card and payment details are entered directly with our payment processor; we receive and store only a transaction reference, never card numbers. Legal basis: performance of a contract (Art. 6(1)(b)).

Order emails. Your email address and order details are used to send order confirmations, fulfilment and shipping notices, and replies to your enquiries. Legal basis: performance of a contract and legitimate interest (Art. 6(1)(b), (f)).

Store analytics. We may collect privacy-safe, first-party operational metrics (such as page views and aggregate conversion rates) without cookies, cross-site identifiers, or advertising profiles. Legal basis: legitimate interest in operating and improving the store (Art. 6(1)(f)).

AI-assisted content. Storefront content and product imagery may be generated or edited with AI tooling. No customer personal data is used for this purpose.

3. Processors and international transfers

We use the following processors, bound by data processing agreements:

  • Google Cloud (Google Ireland Ltd / Google LLC) — hosting, database, file storage, and AI services. Store data is hosted in European regions (eur3, europe-north1, europe-west3). Any access from outside the EEA is covered by EU Standard Contractual Clauses.
  • Stripe (Stripe Payments Europe Ltd / Stripe Inc.) — payment processing. Transfers to the US are covered by Standard Contractual Clauses.
  • SendGrid (Twilio Inc.) — transactional email delivery. Transfers to the US are covered by Standard Contractual Clauses.

We do not sell personal data and do not share it with third parties for advertising.

4. Retention

Order and invoicing records are kept for the period required by Finnish accounting and tax law (up to 10 years). Correspondence is retained up to 24 months. Aggregated analytics data is retained up to 14 months. Data is deleted or anonymised when no longer needed.

5. Your rights

You may request access to, rectification or erasure of your personal data, restriction of or objection to processing, and data portability by contacting hello@cvpe.dev. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

6. Cookies

This store uses only strictly necessary cookies (for example, during secure checkout). We do not use tracking, analytics, or advertising cookies, and no cookie banner is therefore required.

7. Automated decision-making

We do not make decisions with legal or similarly significant effects about you solely by automated means.

8. Changes

We may update this statement when our processing changes. The current version is always available on this page.
Last updated: October 2026.