Privacy policy

Last updated: 14 October 2026

This notice explains how we process personal data in the DevilParts online store at devilparts.com, when handling orders and in customer service. Using the store or reading this notice does not by itself constitute consent to marketing or optional tracking.

1. Controller and contact details

Controller: 110Manufacturing Oy
Online store: DevilParts
VAT identification number: FI35297991
Privacy contact: Ville Toivanen
Email: info@devilparts.com
Postal address: Fallåker 17 C, 02740 Espoo, Finland

2. Personal data and its sources

Depending on the service you use, we process:

your name, email address, telephone number, billing address and delivery address;
ordered products, prices, payment transaction identifiers and status, deliveries, returns, warranties and complaints;
customer account identifiers, settings and order history;
customer service messages and information needed to handle your enquiry;
newsletter subscriptions, consents, withdrawals and marketing objections;
IP address, browser and device details, and website activity such as product views and cart events. Processing for optional analytics, personalisation and advertising depends on your consent.

We receive information from you when you order, create an account, subscribe or contact us; from use of the store; and from payment and delivery providers. Shopify's network services may also combine information about your interactions with other Shopify merchants and Shopify as described below. Payment card information is processed through the payment service.

3. Purposes and legal bases

Orders and customer accounts: accepting orders, payments, deliveries, order communications, returns, contractual customer service and maintaining an account you request. The basis is performance of a contract or steps at your request before entering a contract, GDPR Article 6(1)(b).
Legal obligations: accounting, taxation and statutory consumer rights. The basis is compliance with a legal obligation, Article 6(1)(c), including under the Finnish Accounting Act and Consumer Protection Act.
Newsletters: sending news, products and offers through Shopify. The basis is consent, Article 6(1)(a). You can unsubscribe using the link in each message or by contacting us.
Analytics, optional personalisation and targeted advertising: measuring use of the store, evaluating advertising results, and selecting products or ads based on your interests through Google Analytics, Google Ads, YouTube advertising, Meta and Shopify services. The basis is consent, Article 6(1)(a). Consent for cookies and similar technologies is also governed by section 205 of the Finnish Act on Electronic Communications Services.
Security and fraud prevention: protecting the service, accounts and payment transactions against misuse. The basis is legitimate interests, Article 6(1)(f): protecting our store, customers and business.
Other customer enquiries and legal claims: answering other enquiries and establishing, exercising or defending legal claims. The basis is legitimate interests, Article 6(1)(f): providing customer service and protecting our rights.
Documenting consent and objections: demonstrating consent and respecting marketing objections. The basis is compliance with a legal obligation, Article 6(1)(c).

For legitimate-interest processing we consider necessity and the impact on your rights. Legitimate interests do not replace consent where optional tracking requires it.

4. Providing information

To place an order, you must provide the information needed for payment, order handling and delivery. Without it, we cannot fulfil the order. Forms distinguish mandatory fields from optional information. Statutorily required order and accounting information is also processed to meet legal obligations.

Customer accounts and newsletters are optional. You do not need to consent to marketing or optional cookies to buy products. For customer service we need the information necessary to resolve your enquiry.

5. Recipients and service providers

Shopify: the ecommerce platform, customer accounts, newsletters, analytics and network services.
Shopify Payments and Klarna: processing payments and the payment method you select. Klarna may act as an independent controller, including for its credit and payment services. Further information: Klarna privacy information and Shopify privacy information.
Google: Google Analytics, Google Ads and YouTube advertising. Depending on your consent, information shared may include device and cookie identifiers, website and purchase events, and advertising measurement data. See Google's privacy policy.
Meta: advertising, targeting and advertising measurement. Depending on your consent, information shared may include device and tracking identifiers, website activity and purchase events. See Meta's privacy policy.
Delivery and logistics providers: carriers selected for each order receive the name, address, contact and shipment information needed to deliver it. The carrier appears in your order's delivery information.
Accounting and financial administration providers: order, payment and supporting-document information needed for bookkeeping. We are preparing to introduce an accounting system; its provider will be selected separately.

Our technical service providers and their subcontractors may also process information as needed for their tasks. Providers processing data on our behalf must have appropriate data processing agreements. Some providers act as independent controllers under their own notices. We disclose information to authorities where required by law.

6. Shopify Network Intelligence

We use Shopify Network Intelligence and Shopify's enhanced features to protect our business, improve services, personalise experiences and target advertising. Shopify may combine information about your interactions with our store, other merchants and Shopify for these services. Advertising and other processing requiring consent depend on your consent.

Shopify acts as controller for its own services and is responsible for related rights requests. Information and instructions are available in the Shopify Consumer Privacy Policy and Shopify Privacy Portal. You can contact us about our own processing.

7. International transfers

The store's Shopify hosting region is set to the European Union. International transfers may nevertheless occur through services, support operations or subcontractors. Shopify, Google, Meta and payment services may process information outside the EEA, including in the United States and Canada.

Transfers use an applicable GDPR mechanism: a European Commission adequacy decision where its conditions are met, approved binding corporate rules, or the Commission's standard contractual clauses with additional safeguards where necessary. Shopify describes its mechanisms in Appendix C of its Data Processing Addendum. Google's and Meta's transfer information is available in their policies linked above.

You can request information about transfers of your data and a copy of the applicable safeguards at info@devilparts.com. Other people's personal data and confidential information may be redacted while retaining the information needed to understand the safeguards.

8. Retention periods

Accounting records and financial statement materials: materials containing personal data under Chapter 2, section 10(1) of the Finnish Accounting Act are retained for 10 years after the end of the financial year.
Supporting documents and business-transaction correspondence: retained for 6 years after the end of the calendar year in which the financial year ended. This includes order and payment information required for accounting.
Other order, warranty and complaint information: retained during handling of the order or matter and for 3 years after the matter is closed. An ongoing warranty, statutory liability or specific legal claim may require necessary information to be retained until the matter and applicable limitation periods have ended.
Customer accounts: retained while used, then deleted on request or after 3 years of inactivity. Accounting or complaint information retained on a separate basis may remain.
Other customer service correspondence: retained for 3 years after the enquiry is closed.
Newsletters: marketing use ends when you unsubscribe or withdraw consent. Limited evidence of consent may be retained for applicable liability and claim periods; the minimum information needed to honour an objection is kept while we conduct marketing through the relevant channel.
Security logs: retained for no more than 12 months. Information necessary to investigate a specific security incident may be kept during the investigation and handling of related legal claims.
Google Analytics: event-data retention is set to 2 months and user-data retention to 14 months. User-data retention resets on new user activity. These settings do not apply in the same way to aggregated statistical reports.

A cookie's lifespan differs from retention of information collected in a provider's systems. Payment providers, Google, Meta and Shopify's own services describe their independent-controller retention periods in their notices. When the applicable retention period expires, we delete or anonymise information unless there is a specific lawful reason to retain it longer.

9. Cookies and tracking technologies

Necessary cookies support services you request, including the cart, login, checkout and remembering privacy choices. Optional analytics, personalisation and advertising tracking depend on your consent. You can accept or reject optional categories and change earlier choices using the Cookie settings link in the store's footer.

Names, purposes and lifespans of Shopify cookies are listed in the merchant-storefront section of Shopify's cookie list. For example, the cart cookie lasts 2 weeks and Shopify analytics and marketing cookies last 1 year. Google's _ga cookie has a default lifespan of 2 years and advertising _gcl_ cookies last 90 days. Details are in Google's cookie information. Meta's technologies and lifespans are described in Meta's cookie policy. Technologies used depend on the service and your choices.

Tracking information may be shared with Shopify, Google and Meta as described in section 5. With your consent, website and purchase events may be used to assess your interests, recommend products and target advertising. You can withdraw consent in Cookie settings; withdrawal does not affect the lawfulness of earlier processing.

10. Your rights

You can obtain confirmation of processing, access to your data and a copy of it.
You can request correction of inaccurate data and completion of incomplete data.
You can request erasure or restriction where the GDPR conditions are met. A statutory retention obligation may prevent erasure of particular records.
You can object to legitimate-interest processing on grounds relating to your particular situation. We then continue only where permitted by the GDPR.
You can object at any time to direct marketing and related profiling. We will then stop processing your information for that purpose.
Where processing is automated and based on consent or a contract, you can receive data you provided in a structured, commonly used, machine-readable format and request transfer to another controller where technically feasible.
You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Send your request to info@devilparts.com. If we have reasonable doubts about your identity, we request only the additional information needed to verify it. We respond without undue delay and within one month. For complex or numerous requests, this may be extended by up to two further months; we inform you of the extension and reasons within the first month. Requests are normally free of charge. The GDPR provides limited exceptions for manifestly unfounded or excessive requests.

You can lodge a complaint with the Finnish Office of the Data Protection Ombudsman or another competent EU supervisory authority. Contacting us first is not a prerequisite.

11. Security and changes

We protect information using technical and organisational measures proportionate to the risks and access rights appropriate to each role. We update this notice when processing changes, display the revision date and give separate notice of material changes where necessary. We request new consent where changed processing requires it.