Privacy notice
Updated 27 October 2026
1. Controller and contact details
Kauneuskeidas Mirva Oy (Midas ihonhoitokeskus), Business ID 0833954-3
Paasikivenkatu 14, 04200 Kerava
Email:
2. Scope and personal data
This notice covers the website, gift card shop and related customer service and withdrawal notices. It does not describe the salon's other customer or treatment records. We process the purchaser's name, email and any telephone number provided; selected treatments or gift card amount, prices, order references, payment and delivery status and payment transaction references; the gift card number, validity and available value; the greeting, design and language, and the accepted terms and acceptance time. Withdrawal records include name, email, optional telephone, purchase identifiers, the notice and receipt time, and email delivery information. Order and contact details relating to an unsuccessful payment may also be retained to resolve the matter. Technical information includes IP address, browser and log data and cookie preferences. One-way identifiers derived from the IP address and email are used to prevent abuse of the withdrawal form. Do not enter health information, payment card details or online banking credentials in free-text fields.
3. Purposes and legal bases
Contract: processing the purchase and payment, creating and delivering the gift card, its use and related customer service. Legal obligations: accounting, consumer rights and withdrawal notices, and obligations to authorities. Legitimate interests: service security and operation, preventing abuse, investigating faults and handling legal claims. Processing is limited to information necessary for these purposes. Consent: optional website analytics. You can refuse analytics or withdraw consent in cookie settings. Buying a gift card or accepting its terms is not consent to electronic direct marketing.
4. Sources and providing information
Information primarily comes from you through an order, withdrawal form or enquiry. Payment status and references come from the payment service; gift card identifiers, validity and status come from the gift card management service. Technical data arises when the service is used. If you include another person's data in the greeting, provide only what is needed for the gift. Information required to process and email the order must be provided to complete the purchase. Sufficient purchase identifiers and contact details are needed to identify a withdrawal and acknowledge receipt. Fields marked optional may be left empty.
5. Recipients and service providers
Authorised staff and the following categories of service providers process information as required for their duties:
• Website hosting and maintenance providers: operation of the website, data storage and technical security.
• Payment service providers: processing and confirming payments and any refunds. The shop does not store full payment card details or online banking credentials.
• Gift card and salon management services: gift card identifiers, value, validity, order references and purchased service information, and any associated sales entries.
• Email delivery and email service providers: sending and receiving gift cards, order messages, withdrawal acknowledgements and staff notifications.
• Website analytics providers: website usage and device information only for users who have consented to analytics.
• Accounting service providers and authorities: compliance with statutory accounting and other duties.
Website hosting and payments use providers operating in Finland. Management, email and analytics services use international providers. Processing regions and international transfers are described in section 6. Providers receive only the data required for their duties. For details about our providers and the recipients of your own data, contact
6. Processing outside the EU and EEA
Services are provided in Finland, elsewhere in the EU/EEA and through international providers. International management, email and analytics services may involve processing or support access outside the EU or EEA. An EU-based delivery or storage service alone does not guarantee that all processing remains in the EU.
Depending on the transfer, safeguards include a European Commission adequacy decision or standard contractual clauses and any necessary supplementary measures. Contact the controller at
7. Retention
Information forming part of accounting vouchers is retained for 6 years from the end of the year in which the financial year ended, unless a longer legal period applies. This does not shorten the separate statutory retention periods for accounts and financial statements. Other gift card information is retained for 3 years after expiry. Customer service, withdrawal and uncompleted order information is retained for 3 years after the matter closes. Information necessary for an unresolved dispute or legal claim may be kept until final resolution and expiry of applicable time limits. It is then deleted or anonymised. The website's cookie preference and analytics cookies are set for a maximum of 180 days. Identifiable technical fault and abuse data is limited to what is necessary to investigate the incident; unnecessary technical material is deleted after resolution. Copies in backups expire through backup rotation and are not returned to ordinary customer use. Further details are available from the controller.
8. Cookies and analytics
Essential session and security information enables the service and its forms to work. Optional website analytics is not loaded before consent. Analytics is used to understand website usage and improve the service. Change your preference through the website's Cookie settings button. Withdrawing consent does not affect the lawfulness of earlier processing.
9. Your rights
You may request access, correction, erasure or restriction and, where applicable, data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation and withdraw consent at any time. Data subject to a legal retention duty cannot be erased before that duty ends.
Send requests to
10. Security and decision-making
Access is limited according to duties. Network connections are protected and the service is maintained with access controls and backups. The gift card process described here does not make solely automated decisions that have legal or similarly significant effects on you. The payment provider is responsible for its own payment security and assessment processes. This notice is updated when the service or processing changes. The current version is available on this page.