Privacy policy

Last updated: 15 July 2026

This Privacy Policy explains how personal data is collected and used when you visit petcup.shop, place an order, submit content for personalisation or contact PetCup.

Personal data we collect

Depending on how you use the store, we may collect the following categories of personal data:

  • Contact and delivery information: name, email address, billing address, delivery address and any other contact information you provide;
  • Order information: products ordered, personalisation choices, order number, transaction status, delivery status and order history;
  • Personalisation content: uploaded pet photographs, pet names, instructions, design previews and related correspondence;
  • Payment information: payment method, payment status and limited transaction details. Full payment-card information is processed by the payment provider and is not made available to us;
  • Communications: messages, support requests, complaints and other correspondence;
  • Technical and usage information: IP address, browser and device information, cookie identifiers, approximate location and information about how the store is used; and
  • Fraud and security information: information used to identify suspicious transactions, misuse or security incidents.

If you provide another person’s information, such as a gift recipient’s name and delivery address, you are responsible for ensuring that you are permitted to provide it for that purpose.

How we use personal data

We use personal data to:

  • process and manage orders and payments;
  • prepare personalised designs and send previews for approval;
  • produce, fulfil, deliver and track orders;
  • communicate about orders, requested changes and delivery;
  • provide customer service and handle cancellations, complaints, refunds and product-safety matters;
  • maintain accounting, tax and other legally required records;
  • protect the store, customers and transactions against fraud, misuse and security threats;
  • maintain and improve the reliability and usability of the store; and
  • send marketing communications if you have specifically chosen to receive them.

Uploaded photographs and other personalisation content are used only as needed to prepare, preview, produce and support your personalised order. We do not use this content for unrelated advertising or marketing without separate permission.

Legal bases for processing

We process personal data on one or more of the following legal bases:

  • Performance of a contract: where processing is necessary to process, personalise, fulfil and support your order;
  • Legal obligations: where information must be retained or used for accounting, tax, consumer-protection, product-safety or other legal requirements;
  • Legitimate interests: where necessary to operate and secure the store, prevent fraud, improve services or establish, exercise or defend legal claims, provided those interests are not overridden by your rights; and
  • Consent: where you consent to optional cookies, marketing or another activity for which consent is required.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

When personal data is shared

We disclose personal data only where necessary for the purposes described in this policy. Recipient categories may include:

  • e-commerce, website-hosting and technical infrastructure providers;
  • payment and fraud-prevention providers;
  • personalisation, production and fulfilment providers;
  • postal, courier and delivery providers;
  • email, communications and customer-support providers;
  • analytics and cookie-related providers where permitted by your consent settings;
  • professional advisers where reasonably necessary; and
  • courts, regulators, authorities or other parties where disclosure is required by law or necessary to protect legal rights.

Service providers are permitted to process personal data only for the relevant service and subject to appropriate contractual and data-protection obligations.

We do not sell or rent personal data, and we do not disclose personalisation content to third parties for their own independent marketing.

International data transfers

Some service providers may process personal data outside Finland or the European Economic Area. Where required, such transfers are protected using an applicable adequacy decision, approved standard contractual clauses or another lawful transfer mechanism.

How long we retain personal data

We retain personal data only for as long as necessary for the purpose for which it was collected, including:

  • order, payment and accounting information for the periods required by applicable accounting, tax and consumer-protection laws;
  • communications for as long as reasonably necessary to provide support, resolve disputes and protect legal rights;
  • personalisation content for the time needed to create, fulfil and support the order, after which it is deleted in the ordinary course unless longer retention is necessary for an unresolved issue or legal obligation; and
  • cookie and technical information for the periods described in the applicable cookie settings or until consent is withdrawn, where relevant.

Retention periods may be extended where information is required for an ongoing complaint, dispute, fraud investigation or legal claim.

Cookies and similar technologies

The store uses cookies and similar technologies for essential functions such as security, shopping-cart operation and checkout. With your consent, optional technologies may also be used for analytics, personalisation or marketing.

You can accept, reject or adjust optional cookies through the cookie banner or the store’s cookie-preference controls. More information is available in our Cookie Policy.

Your data-protection rights

Subject to the conditions and limitations of applicable law, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests or direct marketing;
  • receive certain personal data in a portable format;
  • withdraw consent at any time; and
  • lodge a complaint with a competent data-protection supervisory authority.

These rights do not apply without exception in every situation. For example, some information must be retained to comply with accounting or other legal obligations.

To exercise a right, email support@petcup.shop. We may request information reasonably necessary to verify your identity and locate the relevant records.

Automated decision-making

PetCup does not make decisions based solely on automated processing that produce legal or similarly significant effects for customers. Payment and fraud-prevention providers may perform their own automated checks in accordance with their privacy notices.

Children

The store is not directed at children. Orders should be placed by adults or with the involvement and permission of a parent or legal guardian.

Data security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No method of electronic transmission or storage can be guaranteed to be completely secure.

Changes to this policy

We may update this Privacy Policy when our practices, services or legal obligations change. The latest version will be published on this page with an updated revision date.

Controller and contact

The data controller is the business operating the PetCup store. Its legal identity and business information are available in the Legal Notice.

For privacy questions or requests, email support@petcup.shop.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.