Privacy policy

Controller and contact

Ehasa Oy, Company ID 3585069-7, Ruonasalmentie 8 A, 00830 Helsinki, Finland. Contact for customer and order data on this website: info@ehasa.org.

Kuulaportti account and sign-in

You can order without signing in and track the order using its number and the email used for the order. A Kuulaportti account lets you sign in to the store customer area. A new, inactive Kuulaportti account is created after payment only if you choose account creation at checkout and no account already uses the email address. The account stores your first name, last name, email and country. Profile visibility and optional Marketplace emails are off. We email a link to activate the account and choose a password on the store website. An order does not change existing account settings. Kuulaportti data are also covered by the Kuulaportti privacy information.

Kuulaportti provides this website with your unique user identifier, name, verified email address and Ehasa web administration permission. The password entered in the sign-in form is verified against the shared Kuulaportti account system. It is not stored in Ehasa web customer records. Signing in does not give this website access to your Kuulaportti event registrations, payments or other profile details.

Activated ordinary Kuulaportti users can access the customer area. Administration requires membership in the Kuulaportti ehasa web admin group; that permission is checked on administration requests. Session duration follows the Kuulaportti sign-in settings and the remember-me choice. Signing out ends your session on this website.

Data and sources

In addition to sign-in information received from Kuulaportti, we process delivery details you provide: recipient name, phone number with calling code, address, postal code, city and country. Order records contain products and variants, quantities, prices, delivery method, payment reference and status, handling history and related messages. Full payment-card details are not stored by Ehasa. Technical server logs are used to maintain operation and security.

You can edit delivery details on this website's account page. Edit your name, email and other Kuulaportti profile information in Kuulaportti. Password recovery is available in the account area on this website. Profile changes do not change orders already placed; contact customer service to correct an existing order.

Purposes and legal bases

Account and delivery data are used to provide your account, handle orders, deliveries and support, based on performance of a contract or steps before a contract. Required delivery details are needed to deliver your order. Accounting and other statutory processing are based on legal obligations. Access control, misuse prevention and technical logs are based on the legitimate interest of protecting the service and users' data.

We do not use this data for automated decision-making or profiling.

Recipients and transfers

Access is limited to Ehasa personnel who need the data and necessary hosting, communication, payment and delivery providers. Necessary payment data are sent to PayPal; delivery contact and address details are provided to Shipit and the carrier. The Zettle integration transfers product information and inventory balances; sign-in credentials and customer profiles are not sent as part of product imports.

The payment provider's processing and any transfers outside the EU/EEA are described in PayPal's privacy policy, including its transfer grounds and safeguards.

Retention

Your linked identifier and delivery profile are retained while needed for your customer account, until the data are no longer necessary or the account is removed. Orders, payments and accounting records are retained for the statutory period. Vouchers and business transaction correspondence are kept for at least six years from the end of the year in which the financial year ended; accounting books and financial statements for at least ten years from the end of the financial year. Technical logs are retained as necessary to investigate operation and security.

Your rights

You can request access, correction or erasure and, where applicable, restriction or portability, and object to processing based on legitimate interests. Statutory order records cannot be erased before the retention period ends. Send requests to info@ehasa.org. You can lodge a complaint with the Finnish Data Protection Ombudsman.

Address verification and videos

When you check an address, the address you enter and selected country are sent to the Esri address search service. Your name, email and phone number are not sent. Without an API key that allows stored geocoding, the result is temporary and address data or coordinates returned by Esri are not stored. Your delivery address remains the details you entered yourself. If address autofill is enabled with an API key that allows storage, the selected street, postal code, city and country fill the delivery fields.

Address search: Powered by Esri

Our own background videos are served from Ehasa. Opening a YouTube video connects to YouTube, which receives information such as the IP address and technical browser details. Automatic background loading respects the browser’s reduced-motion and data-saving settings.

Website performance measurement

Public content pages send loading, layout stability and responsiveness measurements to our own server. We retain only page type, device class and measurement histograms, without page URLs, search terms, account details or form contents. No measurement cookies or cross-page user tracking are used. A hash of a random page-load measurement ID prevents duplicate counting. Data are removed within 30 days. Do Not Track and Global Privacy Control disable measurement. Browser policy reports retain only the directive and resource category, without original URLs or personal information in the report. Abuse prevention uses a hash of the IP address that rotates every minute.

Battlegroup search and usage measurement

The Battlegroup website counts page views, internal searches, opened search results and topic buttons, and time when rule sections are visible. A reading moment means that a rule section was visible in an active window for at least eight seconds; it does not confirm that the text was read. These aggregates help improve instructions, search suggestions and topic buttons.

Measurement is sent to Ehasa’s own server without cookies, account details or visitor identifiers. Aggregates contain only a known page or rule section, language, device category, event type and, for searches, a normalized query and whether results were found. Queries resembling contact details or long identifiers are omitted. Do not enter personal information in search. Reports are available only to administrators. Public search receives aggregate weights for predefined topics, never the queries people entered. Daily usage aggregates expire within 30 days. Test website data is separate from the published website.

Do Not Track and Global Privacy Control prevent measurement. You can also disable Battlegroup measurement or disable measurement on the test website. This preference stays in that website’s browser storage; only the opt-out setting is stored for this purpose. Enable measurement again or enable it on the test website.

The Google Search Console aggregates shown to administrators describe Google queries and pages opened from Google results. These are separate, dated summaries and are not linked to individual Battlegroup visitors.

Checkout bot protection

Checkout uses Google reCAPTCHA to prevent automated orders. Google processes technical browser and connection information for this check. We do not send delivery form details or cart contents to the verification service. Local attempt limits use hashes of the IP address and session; their counters are removed on the next checkout request after 24 hours.

Google Privacy Policy · Google Terms of Service

Cookies

Necessary session cookies support sign-in, your cart and security. Kuulaportti uses its own cookies on its website for sign-in and registration. Non-essential cookies require applicable consent.

Updated 16 October 2026.