Privacy Policy

This Privacy Policy explains how Jasu Wonder World (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use our website and participate in online art auctions.

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Finnish data protection laws.

We may collect and process the following categories of personal data:

2.1 Information You Provide

• Full name
• Email address
• Phone number (asked at checkout for parcel deliveries, so the carrier can send the delivery notice by text message)
• Billing and shipping address
• Account login credentials

2.2 Transaction Data

• Bidding activity
• Purchase history
• Payment status (note: we do not store full payment details)

2.3 Technical Data

• IP address
• Browser type and device information
• Website usage data (via cookies and analytics tools)

2.4 Help Desk Chat

The chat bubble in the corner of the page is our own help desk; it is not run by an outside chat company. No conversation is stored until you start a chat. When you do, we store the messages you write and the answers you get, the page you were on, your browser type, your country and a scrambled one-way code made from your IP address (used to stop misuse; the address itself is not stored). The first answers come from an automatic helper that works from ready-made answers. If you ask for a person, we also ask for your name and email address, so that we can answer you by email if you have left the page; if you are logged in to your customer account, the chat is linked to that account. A technical cookie remembers your conversation in your browser for up to 90 days, so that you can continue it; it is not used for advertising or statistics. The legal basis is our legitimate interest in answering your questions and, when your question is about an order, the performance of our contract with you. Chats answered only by the automatic helper are deleted after 30 days; conversations with us are deleted 12 months after they are solved. You can ask us to delete your conversation earlier at any time. While you have one of our pages open, the page also tells our help desk every 30 seconds which page you are on, so that our team can see who is visiting and offer help in the chat. For this we use a random visit number that stays only in that browser tab and disappears when you close it; it is not a cookie. Our team sees only the page, its language, your country, the type of device, how many items are in your cart and, if you are logged in, your name. This information is kept only in our server's memory: nothing is saved, and you drop off the list about a minute after you leave. Our team may then send you a message in the chat bubble; you do not have to answer it.

• Contact form and e-mails – your name, e-mail address, the subject and your message. A message from the contact form goes into our own help desk (see “Help Desk Chat” above), where we answer it; e-mails you send us directly are handled the same way. This is used only to answer your message. The legal basis is your consent.
• Commission Studio requests – your name, e-mail address, the choices you make and anything you choose to write (for example a phone number, budget or deadline), and the reference photos you add. They are used only to answer you and to prepare a commission offer. The photos are stored privately: only our team can open them. The legal basis is your consent and steps taken at your request before entering into an agreement.
• Protection against spam robots – the forms are protected without any outside service: a hidden field that only robots fill in, a check of how fast the form was sent, and a limit on how many messages can be sent from one address in an hour. For the limit, a scrambled one-way code is made from your IP address; the address itself is not stored.
• Commission agreements signed online – if we make a commission agreement with you, you receive a private link to read and sign it. We store the agreement, your name and email address, the signature you draw, and the time and IP address of signing, as proof of what was agreed. The legal basis is the agreement between us. Only people who have the link can open the agreement.
• Invoices and online payment – an invoice contains your name and the contact details you gave us. You can pay by bank transfer or, when offered, by card through Stripe (Stripe Payments Europe, Ltd.). Card details are typed on Stripe’s own page and never reach this website; we only receive a confirmation that the invoice was paid. The legal basis is the agreement between us and our legal accounting obligations.
• Technical data – like any website, the server records basic technical information (such as IP address and browser type) in log files to keep the site secure and working. These logs are kept only for a short time.

Form messages are delivered to us by email and are also saved in the website’s private editor, which only we can open. Your data is never sold or used for advertising.

We process your personal data for the following purposes:

• To create and manage your user account
• To enable participation in auctions and process bids
• To process payments via Stripe and PayPal
• To send you the free coloring pages you request and, with your consent, occasional emails about new coloring pages, products and offers (you can unsubscribe at any time with the link in every email)
• To deliver purchased artwork
• To communicate important updates (e.g., auction results, payment reminders)
• To improve website functionality and user experience
• To comply with legal and regulatory obligations

We process your data based on the following legal grounds:

• Contractual necessity – to provide auction services and fulfill purchases
• Legal obligation – to comply with tax and accounting laws
• Legitimate interest – to improve services, prevent fraud, and ensure platform security
• Consent – for optional communications (e.g., marketing emails)

Payments are securely processed by third-party providers: Stripe and PayPal. These providers process your payment data in accordance with their own privacy policies. We do not store or have access to your full payment card details.

Google Customer Reviews: after an order, the thank-you page offers a short survey by Google. Only if you click “Yes” and agree in Google’s own window do we pass your email address, order number, delivery country and estimated delivery date to Google (Google Ireland Ltd.), which then emails you one short question about your order. If you do not click “Yes”, nothing is sent to Google. Google handles this under its own privacy policy.

We only share your personal data when necessary: with payment providers (Stripe, PayPal), with shipping partners (for delivery purposes), and with legal authorities when required by law. We do not sell your personal data to third parties.

The website runs on a server rented from Hostinger. Messages and notices are delivered to us through Google’s email service (Gmail). Card payments are processed by Stripe and PayPal payments by PayPal, parcels are delivered by Posti, and visitor statistics come from Google Analytics, as described in this policy. These service providers process data only to provide their service. Some of them may process data outside the EU/EEA; in that case the transfer is protected by the safeguards the GDPR requires, such as the EU’s standard contractual clauses.

Some of our service providers (e.g., Stripe, PayPal) may process data outside the European Economic Area (EEA). In such cases, appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) and adequacy decisions by the European Commission.

Some blog posts show videos from YouTube. They are embedded in YouTube’s privacy-enhanced mode (youtube-nocookie.com): when a page with a video is shown, YouTube (Google) receives your IP address, and it sets its own cookies only if you play the video, under Google’s privacy policy. The site also links to Instagram, Facebook, TikTok and Tumblr, which have their own privacy policies.

We use cookies and similar technologies to ensure website functionality, analyze traffic and user behavior, and improve user experience. You can manage or disable cookies through your browser settings. With your consent we use Google Analytics (Google Ireland Ltd.) to measure how the shop is used (analytics cookies), and the Meta Pixel (Meta Platforms Ireland Ltd.) and TikTok Pixel (TikTok Technology Limited) to measure our ads and show our products to shop visitors on Facebook, Instagram and TikTok (marketing cookies). Meta and TikTok are only loaded after you allow marketing cookies. Google Analytics only sets cookies after you allow analytics cookies; before that (Google Consent Mode) it only sends anonymous, cookie-less signals without an identifier, and Google Ads measurement needs marketing consent. See the cookie policy; the legal basis is your consent (GDPR Art. 6(1)(a)), and you can withdraw it at any time via “Cookie settings” at the bottom of every page. For the marketing pixels we and Meta/TikTok are joint controllers for collecting and sending the data. See our Cookie Policy for more detail.

The installable app and your browser. The site can be added to your home screen like an app. A service worker then keeps copies of the site’s own files and of the public pages and pictures you have opened in your browser’s cache, so that pages open quickly and also work without a connection; it never keeps the basket, checkout, account, order, help desk or editor pages. The site also keeps a few small notes in your browser’s local storage, for example the last pages you opened (for the offline page) and that you said “Not now” to the home-screen suggestion. All of this stays on your device and is never sent to us. The cookie policy lists every cookie and note.

We retain your personal data only as long as necessary: messages and commission requests are kept for as long as the conversation requires (help desk chats as described under “Help Desk Chat”); account data is retained while your account is active; signed agreements, invoices, orders and other information related to a purchase are kept for as long as Finnish accounting law requires (6–10 years); marketing data is retained until you withdraw consent. You can ask for your data to be deleted at any time; we delete it unless the law requires us to keep it.

You have the following rights regarding your personal data:

• Right of access – request a copy of your data
• Right to rectification – correct inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

To exercise your rights, contact us at: [email protected]

Your customer account is the same on the website and in the Jasu Wonder World Shop app on Google Play. You can delete it yourself at any time:

1. Log in at www.jasuwonderworld.com/shop/account (in the app, open Account).
2. Go to “My profile”.
3. Open “Delete my account”, type your password and press “Delete my account”.

Your profile, saved address and reward points are deleted straight away. Your past orders are kept for 6–10 years because Finnish accounting law requires it, but they are no longer linked to you.

You can also ask us to delete your account and data by emailing [email protected] from the email address you used in the shop. We do it within one month and confirm it by email.

We implement appropriate technical and organizational measures to protect your data, including secure (HTTPS) connections, restricted access to personal data, and use of trusted third-party providers. However, no system is completely secure, and we cannot guarantee absolute security.

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date.

For any questions or data protection requests: Jasmine Hintsala, Jasu Wonder World, Pohjavedenkatu 4 A 20, 00980 Helsinki, Finland. Email: [email protected]

If you believe your data has been processed unlawfully, you have the right to file a complaint with the Finnish Data Protection Authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), https://tietosuoja.fi