PRIVACY POLICY
Last updated: 8 September 2026
This Privacy Policy explains how A V A I N 22 Oy collects, uses, stores and protects personal data when you visit our website, contact us, book an appointment, purchase a product or service, subscribe to our communications, participate in a Beauty Inside Out programme, or otherwise interact with Anne Vainio, Beauty Inside Out or Beautiful You Helsinki.
We process personal data in accordance with the EU General Data Protection Regulation (“GDPR”) and applicable Finnish data protection legislation.
1. DATA CONTROLLER
A V A I N 22 Oy
Business ID: 3256747-4
c/o Tilitoimisto Count It Oy
Vihdintie 5
03100 Nummela
Finland
Email: contact@avain.io
Telephone: 044 971 2414
A V A I N 22 Oy is the data controller responsible for the personal data described in this Privacy Policy.
2. WHAT PERSONAL DATA WE COLLECT
Depending on how you interact with us, we may collect the following categories of personal data.
Contact and identification information
This may include:
name
email address
telephone number
postal address
billing and delivery information
Customer and order information
This may include:
products and services purchased or requested
order information
delivery information
invoicing and payment-related information
customer communications
information relating to warranties, repairs, adjustments, complaints or customer service
Appointment and consultation information
This may include:
appointment details
information you provide when booking or attending an appointment
measurements
previous hair and hairstyle information
colour and length preferences
lifestyle and fitting preferences
other information necessary to provide a personalised hair or support service
Beauty Inside Out support and programme information
If you participate in Personal Support, Group Support or another Beauty Inside Out service, we may process information you voluntarily provide in connection with the service, including your goals, experiences, reflections and communications with us.
Health-related information
Our services are intended in particular for women experiencing alopecia, hair loss, cancer-related hair loss or other visible changes.
As part of an appointment, consultation or support service, you may voluntarily tell us about your health or medical circumstances.
Health information is sensitive personal data under the GDPR. We only process health-related information that is relevant and necessary for the service you have requested and where an appropriate legal basis applies.
Where required, we will ask for your explicit consent to process this information.
Please do not provide health or medical information that is not necessary for the service you are requesting.
Marketing information
This may include:
newsletter subscription information
email address
marketing preferences
consent records
information relating to your interaction with our email communications where available through our service provider
Website and technical information
When you use our website, technical information may be processed, including:
IP address
browser information
device and network information
pages viewed
referring pages
website interactions
cookie information
3. HOW WE COLLECT PERSONAL DATA
We primarily collect personal data directly from you when you:
contact us
complete a website form
book an appointment
attend a consultation
purchase or order a product or service
participate in Personal Support or Group Support
subscribe to our newsletter
communicate with us by email, telephone or social media
voluntarily provide information necessary for the service you are requesting
Some technical information is collected automatically when you visit our website through Squarespace and its website technologies.
4. WHY WE PROCESS PERSONAL DATA AND OUR LEGAL BASIS
We only process personal data where there is an appropriate legal basis.
Providing products and services
We process personal data to:
respond to enquiries
arrange appointments
provide consultations
manage wig orders
personalise and deliver products
provide Personal Support and Group Support
manage customer relationships
provide customer service
manage adjustments, warranties, repairs and complaints
Legal basis: performance of a contract or taking steps at your request before entering into a contract.
Legal and accounting obligations
We process certain information where necessary to comply with accounting, taxation, consumer protection and other legal obligations.
Legal basis: compliance with a legal obligation.
Customer relationship and business administration
We may process limited personal data where necessary to maintain customer relationships, improve our services, protect our business and administer our operations.
Legal basis: our legitimate interests, where those interests are not overridden by your rights and freedoms.
Newsletters and direct marketing
We may send newsletters and electronic marketing where you have provided the required consent.
Legal basis: consent where required.
You may withdraw your consent at any time.
Health-related information
Where health-related information is relevant and necessary for the service you request, it will only be processed where both an appropriate legal basis under Article 6 GDPR and an applicable condition under Article 9 GDPR exist.
Where required, we rely on your explicit consent.
5. WEBSITE AND SQUARESPACE
Our website is hosted by Squarespace.
When you visit the website, Squarespace may process technical information required to operate, secure and improve the website, including:
browser, network and device information
IP address
referring pages
pages viewed
website activity and interactions
Squarespace processes relevant website information in connection with providing its services to us. Squarespace also provides tools for managing cookies and GDPR-related consent.
6. APPOINTMENT BOOKING
We use Squarespace Scheduling / Acuity Scheduling to manage online appointment bookings.
When you book an appointment, we may collect:
your name
email address
telephone number
appointment date and time
information you choose to provide in the booking form
files you voluntarily upload, where applicable
We use this information to arrange and manage your appointment and provide the service you have requested.
Squarespace / Acuity processes this information on our behalf in connection with providing online scheduling services.
Please avoid entering unnecessary medical or other sensitive information into booking forms.
7. NEWSLETTER AND EMAIL MARKETING
We use Squarespace Email Campaigns to manage our newsletter and email communications.
If you subscribe to our newsletter, we may process:
your name
email address
subscription status
marketing preferences
information relating to delivery or interaction with our emails where provided by Squarespace
We may send information about Anne Vainio, Beauty Inside Out, Beautiful You Helsinki, new collections, programmes, events, launches and other relevant updates.
You can unsubscribe at any time by using the unsubscribe link in our emails or by contacting:
Withdrawal of consent does not affect processing carried out lawfully before the consent was withdrawn.
8. COOKIES
Our website uses cookies and similar technologies.
Necessary cookies may be used where required for the website and its services to function securely and correctly.
Non-essential analytics or performance cookies are used only where the required consent has been obtained through our cookie settings.
We do not currently use third-party advertising or tracking technologies such as Google Analytics, Meta Pixel or TikTok Pixel.
If we introduce additional analytics, advertising or tracking technologies in the future, we will update our Privacy Policy and Cookie Policy and, where required, obtain consent before using them.
Further information is available in our Cookie Policy and Cookie Settings below.
Squarespace distinguishes between necessary cookies and non-essential analytics/performance cookies and provides consent tools for EU visitors.
9. PAYMENTS
We do not currently process payments directly through this website.
Where payment is required for a product or service, payment arrangements are provided separately, for example by invoice or payment link.
Information necessary for invoicing, accounting and payment administration may be processed by A V A I N 22 Oy and relevant financial administration or payment service providers where necessary.
We do not store complete payment-card details ourselves.
10. SOCIAL MEDIA
If you interact with us through services such as Instagram, Facebook, LinkedIn or TikTok, the relevant platform may process your personal data independently in accordance with its own privacy terms.
We may process information you send directly to us through these platforms for customer communication, enquiries, marketing and legitimate business purposes.
11. WHO WE SHARE PERSONAL DATA WITH
We do not sell personal data.
Where necessary, personal data may be processed by trusted service providers supporting our business, including:
Squarespace, for website hosting and functionality
Squarespace Scheduling / Acuity Scheduling, for appointment management
Squarespace Email Campaigns, for newsletters and email communications
accounting and financial administration providers
payment service providers where separately used
IT and cloud-service providers
postal and delivery providers
wig manufacturing and service partners where information is necessary to fulfil an order
professional advisers where necessary
public authorities where disclosure is required by law
We only share information that is necessary for the relevant purpose.
12. INTERNATIONAL TRANSFERS
Some service providers may process personal data outside Finland or the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA, appropriate safeguards are used as required by applicable data protection legislation, such as an adequacy decision or approved Standard Contractual Clauses where applicable.
Squarespace states that it provides GDPR mechanisms for relevant international transfers of personal data.
13. HOW LONG WE KEEP PERSONAL DATA
We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by law.
Retention periods vary according to the information concerned.
For example:
customer and order information is retained for as long as necessary to fulfil the customer relationship, manage warranties and customer service, and comply with accounting and legal obligations
enquiry and appointment information is retained only for as long as reasonably necessary for the enquiry, appointment or customer relationship
marketing information is retained until consent is withdrawn or the information is no longer required for marketing purposes
health-related information is retained only for as long as necessary for the service for which it was collected, unless retention is otherwise required by law
website and cookie data is retained in accordance with the applicable cookie and service settings
We periodically review personal data and delete or anonymise information that is no longer required.
14. DATA SECURITY
We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss or destruction.
Access to personal data is limited to persons and service providers who require the information for legitimate purposes.
We aim to minimise the collection of sensitive personal data and limit access to such information appropriately.
15. YOUR DATA PROTECTION RIGHTS
Depending on the circumstances and legal basis for processing, you may have the right to:
access your personal data
request correction of inaccurate or incomplete personal data
request deletion of personal data
request restriction of processing
object to certain processing
receive your personal data in a portable format where applicable
withdraw consent at any time where processing is based on consent
object to direct marketing at any time
lodge a complaint with a competent data protection authority
These rights are subject to the conditions and limitations provided by applicable legislation.
To exercise your rights, please contact:
We may request information necessary to verify your identity before responding to a request.
16. RIGHT TO LODGE A COMPLAINT
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a supervisory authority.
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
17. AUTOMATED DECISION-MAKING
We do not currently use personal data for decisions based solely on automated processing that would produce legal or similarly significant effects for you.
If this changes, this Privacy Policy will be updated accordingly.
18. CHILDREN
Our products and services are primarily intended for adults.
Where personal data relating to a minor is processed, we take appropriate measures according to applicable legislation and the nature of the service.
19. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy when our services, technologies, service providers or legal obligations change.
The current version will always be available on our website. The date of the latest update is shown at the top of this page.