Privacy policy

PRIVACY POLICY

Version 1.2  Effective 23 september 2026

This policy explains what personal data Rothe Estate collects about you, why, who we share it with, and your rights. It applies to visitors and customers of rotheestate.com.

1. Who is responsible for your data

Rothe Estate ("we", "us", "our"), a sole trader (toiminimi) owned by Casper Wentzel, Business ID 3658227-6, Iirislahdenranta 26 B 2, 02230 Espoo, Finland, is the controller of your personal data.

Rothe Estate is established in Finland, inside the European Union.

2. What we collect, why, and on what legal basis

Processing and fulfilling your order. Name, delivery address, email, phone, order contents and payment confirmation. We never see or store your full card details — those go directly to our payment provider. Legal basis: performance of a contract with you.

Customer service, returns and complaints. Order details and your correspondence with us. Legal basis: performance of a contract with you, and our legitimate interest in resolving issues properly.

Fraud prevention and payment security. Order and payment metadata, IP address. Legal basis: legitimate interest, limited to what is needed to prevent fraud.

Site analytics. Browsing behaviour and cookie identifiers. Legal basis: your consent, given through our cookie banner. See our Cookie Policy.

Legal and tax compliance. Order and invoice records. Legal basis: legal obligation.

Email marketing. If you sign up to our emails, we store your email address and the date you consented, so we can send you new arrivals, offers and occasional news. Legal basis: your consent. You can unsubscribe from any email, and we stop immediately. Emails are sent through Shopify Email, part of Shopify, our store platform. We keep your address until you unsubscribe, and we do not sell or share it for anyone else's marketing.

3. Who we share your data with

To fulfil your order we share some of your personal data — typically your name, delivery address, phone number and order details — with:

• Shopify, the platform this store runs on.
  - Shopify Payments, our payment provider, including Apple Pay and Google Pay where you choose them.
  - The supplier fulfilling your order, and DSers, the tool that routes your order to them. See section 4 — this is the transfer you should read about.
  - The delivery carrier handling your parcel.
• Google Customer Reviews, only if you choose to take part after ordering: your email address, order number, delivery country and estimated delivery date, so Google can send you a review survey.
  - Analytics providers, only after you consent through the cookie banner. The current list is in our Cookie Policy, which we keep up to date.                                  -We use Google Ads conversion tracking to measure our advertising, only if you consent to marketing cookies. See our Cookie Policy.
• Google Ads, only if you consent to marketing cookies: when you order, a scrambled (hashed) version of your email address, phone number and address is sent to Google so it can measure whether our ads led to your purchase. Google cannot read this data in its original form.

We do not sell your personal data.

4. Sending your data outside the EU

Your goods are dispatched to you from a warehouse inside the European Union. Your order details, however, are routed to us and to our suppliers through DSers and AliExpress, which are based in China. This means your name, delivery address and phone number are sent to China on every order, so that the order can be placed and shipped.

China does not have a European Commission adequacy decision. We make this transfer because it is necessary to perform our contract with you: without it, your order cannot be placed with the supplier and shipped to you (Article 49(1)(b) GDPR). We do not transfer your data to China for any other purpose.

We limit the transfer to the minimum needed to ship your order: your name, delivery address and phone number. We do not send your payment details, your email address, your order history or your browsing data. If you would prefer we did not transfer your data this way, we cannot fulfil an order for you, but you are welcome to contact us at info@rotheestate.com before ordering.

5. How long we keep your data

Order and invoice records: six years from the end of the financial year in which you ordered. This is the period Finnish accounting law requires and we cannot shorten it.

Customer service correspondence: two years from the last message, so that we can handle any later claim under the two-year legal guarantee.

Cookie consent records: one year, after which you are asked again.

Account details, if you create an account: until you close the account, or three years after your last order if you do not.

We do not keep personal data for longer than these periods require.

6. Your rights

Subject to the conditions in applicable law, you have the right to: get a copy of the personal data we hold about you; have inaccurate data corrected; have your data deleted in certain circumstances; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on it, without affecting anything we did before you withdrew it.

To exercise any of these rights, email info@rotheestate.com. We will respond within one month.

You also have the right to complain to a data protection supervisory authority. Ours is the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto). If you live in another EU country, you may complain to the authority there instead.

7. Automated decision-making

Our payment provider may use automated fraud-scoring to assess a transaction before it is approved. We do not otherwise make automated decisions about you, and we do not build advertising audiences from your data. You have the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you, subject to the exceptions the law allows.

8. Children

Our site and products are not directed at children, and we do not knowingly collect personal data from children.

9. Changes to this policy

We will post any change on this page with an updated effective date. If a change is material and we hold your email address, we will tell you by email.