PRIVACY POLICY

Last updated: September 2026

At Henua, we value your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data Henua Organics Oy (“Henua”, “we”, “us” or “our”) collects, how and why we process it, with whom it may be shared, how long it may be retained and what rights you have in relation to your personal data.

We process personal data in accordance with applicable data protection legislation, including the European Union General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Data Controller

Henua Organics Oy
PL 41
60101 Seinäjoki
Finland
info@henua.fi

Contact person for privacy matters

Jenni Tuominen
jenni@henua.fi

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed in connection with Henua's website, online store, customer relationships, orders, customer service, marketing and other interactions with Henua.

3. Personal Data We Collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

Contact and identification information

• name;

• postal and delivery address;

• email address;

• telephone number.

Order and transaction information

• products ordered;

• order history;

• billing and delivery information;

• payment status and transaction information;

• returns, refunds and customer service information.

Payments are processed by third-party payment service providers. Henua does not generally store full payment card details in its own systems.

Account and customer information

• customer account information;

• preferences;

• communications with Henua;

• product reviews and other content you choose to submit.

Marketing information

• newsletter subscriptions;

• marketing preferences and consents;

• information concerning your interaction with marketing communications.

Technical and usage information

• IP address;

• browser and device information;

• operating system;

• pages visited;

• referring pages;

• interactions with our website;

• cookie identifiers and similar technical information.

4. How We Collect Personal Data

We may collect personal data when you:

• visit or browse our website;

• make a purchase;

• create or use a customer account;

• subscribe to our newsletter or other marketing;

• contact our customer service;

• submit a product review;

• participate in a competition, campaign or other promotion;

• interact with us through our website or other digital channels; or

• otherwise provide information directly to us.

Certain technical information may also be collected automatically through cookies and similar technologies.

5. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis for doing so.

Performance of a contract

We process personal data where necessary to:

• process and fulfil your order;

• process payments;

• arrange delivery;

• manage returns and refunds;

• communicate with you concerning your order; and

• provide customer service.

Legal obligations

We may process and retain personal data where necessary to comply with legal obligations, including accounting, taxation and other statutory requirements.

Legitimate interests

Where permitted by law, we may process personal data based on our legitimate interests, including:

• operating and developing our business and online store;

• improving our products and services;

• preventing fraud and misuse;

• maintaining the security of our website and systems;

• understanding how customers use our website and services; and

• managing and developing customer relationships.

Where processing is based on legitimate interests, we consider and balance our interests against your rights and interests.

Consent

Where required, we process personal data on the basis of your consent, for example in connection with certain forms of electronic direct marketing, analytics, advertising or non-essential cookies.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

6. Marketing Communications

If you have subscribed to our newsletter or otherwise consented to receive marketing communications, we may send you information about Henua, our products, launches, offers and other relevant content.

You can unsubscribe at any time by using the unsubscribe link included in our marketing emails or by contacting us at info@henua.fi.

Unsubscribing from marketing does not prevent us from sending transactional or service-related communications concerning your orders or customer relationship.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

These may include:

Strictly necessary cookies, which are required for the operation, security and essential functionality of the website and online store.

Functional cookies, which help remember choices and improve website functionality.

Analytics cookies, which help us understand how visitors use our website and allow us to improve its performance and user experience.

Advertising and targeting cookies, which may be used to measure advertising effectiveness and, where permitted, provide advertising that is more relevant to users.

Where required by applicable law, non-essential cookies and similar technologies are used only with your consent.

You can manage your cookie choices through the cookie consent settings available on our website. You may also be able to manage certain cookies through your browser settings.

8. Analytics and Advertising

We may use third-party analytics, marketing and advertising service providers to understand website usage, measure the effectiveness of our marketing and improve our services.

Depending on your cookie choices and applicable law, these providers may process technical information such as cookie identifiers, IP addresses, device information, website interactions and information about the effectiveness of advertising.

Where consent is required by law, such processing is carried out only after the appropriate consent has been obtained.

9. Shopify

Our online store is hosted on the Shopify platform.

Shopify provides the e-commerce infrastructure that enables us to operate our online store and process customer orders.

When you visit or make a purchase through our online store, personal data may be processed by Shopify in connection with providing its services to Henua. Certain Shopify consumer services may also involve Shopify processing personal data under its own terms and privacy policies.

For further information about Shopify's processing of personal data, please refer to Shopify's applicable privacy documentation.

10. Sharing Personal Data

We may share personal data with trusted service providers where necessary to operate our business and provide our services.

These may include providers of:

• e-commerce and website hosting;

• payment processing;

• order fulfilment, logistics and shipping;

• customer service;

• email and marketing services;

• product review services;

• website analytics;

• advertising and marketing technology;

• IT, cloud and security services; and

• professional services such as accounting or legal services.

Service providers may process personal data only to the extent necessary for the relevant service and in accordance with applicable data protection requirements.

We may also disclose personal data where required by law, court order or a lawful request from a competent authority, or where necessary to establish, exercise or defend legal claims or protect our rights and legitimate interests.

If Henua undergoes a merger, acquisition, restructuring or sale of all or part of its business, personal data may be transferred as part of that transaction in accordance with applicable law.

We do not sell your personal data.

11. International Transfers of Personal Data

Some of our service providers operate internationally. As a result, personal data may be processed or transferred outside Finland and, in some circumstances, outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we take steps to ensure that the transfer complies with applicable data protection law.

Depending on the circumstances, appropriate safeguards may include:

• an adequacy decision adopted by the European Commission;

• European Commission Standard Contractual Clauses;

• Binding Corporate Rules; or

• another lawful transfer mechanism recognised under applicable data protection legislation.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law.

Customer and order information may be retained for the duration of the customer relationship and thereafter where necessary to fulfil legal obligations, resolve disputes, prevent fraud or establish, exercise or defend legal claims.

Accounting, payment and transaction records are retained for the periods required by applicable accounting and tax legislation.

Marketing information is generally retained until you withdraw your consent, unsubscribe or the information is no longer necessary for the relevant marketing purpose, subject to any information that must be retained to respect your opt-out preferences.

When personal data is no longer required, it will be deleted, anonymised or otherwise securely disposed of as appropriate.

13. Data Security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

Access to personal data is limited to persons who require it for their duties or for providing services to Henua and who are subject to appropriate confidentiality and data protection obligations.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

If you have reason to believe that your interaction with us or your customer account is no longer secure, please contact us promptly at info@henua.fi.

14. Your Data Protection Rights

Subject to the conditions provided by applicable data protection legislation, you may have the right to:

• obtain confirmation as to whether we process your personal data;

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of your personal data;

• request restriction of processing;

• object to certain processing, including processing based on legitimate interests;

• object at any time to the processing of your personal data for direct marketing;

• receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;

• withdraw consent at any time where processing is based on consent; and

• lodge a complaint with a competent supervisory authority.

These rights may be subject to limitations and exceptions under applicable law.

To exercise your rights, please contact us at info@henua.fi.

We may need to verify your identity before fulfilling a request.

15. Right to Lodge a Complaint

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman.

16. Product Reviews and Public Content

If you choose to submit a product review or other content for publication, information included in that content may become publicly visible.

Please do not include sensitive personal information or other information you do not wish to make public in reviews or other publicly available content.

17. Third-Party Websites and Services

Our website may contain links to third-party websites or integrate third-party services.

Henua is not responsible for the privacy practices of independent third parties. We encourage you to review the privacy notices of third-party services before providing personal data to them.

18. Children's Privacy

Our online store is not intended for children to make purchases independently.

We do not knowingly collect personal data from children where such collection would require parental or guardian consent under applicable law.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices or applicable legal requirements.

The current version will be published on our website together with the date of the latest update.

20. Contact Us

If you have questions about this Privacy Policy, the processing of your personal data or wish to exercise your data protection rights, please contact:

Henua Organics Oy
PL 41
60101 Seinäjoki
Finland
info@henua.fi

Privacy contact:
Jenni Tuominen
jenni@henua.fi

Last updated: September 2026