Privacy policy & data stewardship

Purpose and honourable scope

We draft this charter for visitors, prospective buyers, confirmed clients, and professional correspondents who interact with Throxxenmmaz.world or the Wenora catalogue. It explains what data we steward, why lawful grounds exist, how long archives breathe, which partners assist, and how you may steer the narrative of your own information.

The text is neither legal advice nor a diminishment of mandatory Finnish or EU consumer protections. Where national law grants you irreversible rights, those rights prevail.

Controller identity and privileged contact

The controller is the undertaking operating commercially as Throxxenmmaz.ddd. All statutory communications—especially requests under Articles 15 through 22 GDPR—should be directed exclusively to the coordinates below so our data protection coordinator can authenticate, respond, and archive proof of service.

Categories of personal information

We collect only what the moment demands. Illustrative categories include:

• Identity anchors: name, title, professional affiliation, billing identifiers you volunteer.
• Contact paths: email, telephone, messaging handles, parcel delivery instructions.
• Transaction artefacts: order references, product configurations, payment authorisation tokens (never full card numbers on our infrastructure).
• Behavioural telemetry: device type, approximate geography via IP, consent decisions, page sequence when analytics cookies receive permission.
• Correspondence fabric: free-text inquiries, voice-to-text transcripts if you choose that channel, attachments concerning customs or clinical paperwork you proactively share.
• Compliance dossiers: fraud screening notes, audit trail excerpts, regulatory communications.

Purposes and Article 6 legal bases

• Service delivery & security relies on legitimate interest (Art. 6(1)(f)) to maintain resilient hosting, resist abuse, and verify session integrity.
• Contract formation and honouring purchases rests on Art. 6(1)(b) and, for bookkeeping, Art. 6(1)(c).
• Optional measurement or marketing technologies activate solely under Art. 6(1)(a) consent via our translucent cookie console.
• Litigation or regulator defence invokes Art. 6(1)(c) and (f) as applicable.

We practice data minimisation at intake: forms ask only for fields that fulfill the stated purpose, and redundant inputs are trimmed at validation.

Processors, subprocessors, and instruction discipline

Hosting, encrypted mail transport, payment acquiring, ticketing interfaces, and (if consented) analytics vendors process data on documented instructions. Contracts meet Art. 28 GDPR, featuring audit rights, deletion assurances, and cooperation clauses for impacted individuals. Upon request we summarise active categories of processors without exposing trade secrets that would weaken collective security.

Cross-border transfers and supplementary armour

Primary processing occurs inside the EEA. Should a subprocessor maintain disaster recovery beyond EU borders, we rely on Commission-approved Standard Contractual Clauses, encryption in transit and at rest, organisational access tiers, and transfer impact assessments that we refresh when vendor architecture shifts materially.

Retention ledger

• Consent artefacts: twelve months beyond withdrawal unless a narrowly tailored dispute requires more.
• Contractual and fiscal archives: up to ten Finnish financial years unless superseded law dictates otherwise.
• Server logs containing IPs: rolling forty-five to ninety days except forensics holds.
• Customer care threads: thirty-six months post-closure unless warranty extensions apply.
• Suppression lists for marketing objections: indefinite minimal record to honour your choice.

Security architecture and cultural discipline

Technical layers include TLS 1.2 minimum, hardened cipher suites, segregated production credentials, MFA for privileged staff, and encrypted backups with quarterly restoration drills. Cultural layers include confidentiality covenants, need-to-know routing of tickets, and incident runbooks rehearsed with executive sign-off. Significant incidents are recorded, remediated, and—where the GDPR threshold demands—reported to supervisors and yourself without undue delay.

Your rights and the Finnish supervisory path

You may request access, rectification, erasure where applicable, restriction, portability for consensual or contractual processing, objection to interest-grounded processing, and human review if ever an automated decision with legal effect were contemplated (currently we employ none). Withdraw consent for optional processing at any moment via the cookie interface or a direct email.

Should dialogue with us prove unsatisfactory, you may elevate concerns to the Office of the Data Protection Ombudsman (Finland) without prejudice to seeking relief in courts of your habitual residence.

Minors and Wenora positioning

Wenora is positioned for adults. We do not knowingly invite data from individuals below sixteen without verifiable parental authority. If you believe we have received such data inadvertently, contact us immediately for erasure.

Evolution of this charter

Material adjustments—new processing purposes, different retention, expanded geographic exposure—will be surfaced here with a refreshed issuance stamp. Where fresh consent is legally warranted, we will solicit it distinctly rather than burying notice in silence.

Closing acknowledgement

Privacy is not a static brochure; it is a sequence of disciplined choices. We welcome exacting questions because they sharpen our governance. Reach the desk at question@throxxenmmaz.world or the postal chamber above whenever this charter intersects your life.