Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how Taomtips Oy processes personal data in connection with the TAOM Billiards website, online store, customer accounts, customer service, marketing and product-authentication services.

1. Data controller

Taomtips Oy
Business ID: FI2628814-5
Olgantie 33, 40420 Jyskä, Finland
Email: privacyprotection@taombilliards.com
Telephone: +358 10 375 3200

2. Personal data we process

Depending on how you use our services, we may process:

identification and contact details, such as name, email address, telephone number, billing address and delivery address;
customer-account details, login information and account preferences;
order, delivery, return, refund, warranty and customer-service information;
payment status and transaction references received from payment service providers; we do not store full payment-card details;
marketing choices and records of consent or withdrawal;
technical data needed to operate and secure the service, such as device and browser information, logs and cookie identifiers;
product-authentication and verification data generated when a product QR code is scanned, including the verification time, approximate city-level location and technical event information; and
information supplied in privacy requests, complaints or other communications.

3. Why and on what legal basis we process data

We process personal data for the following purposes:

Orders and customer accounts: to conclude and perform a contract, deliver products, handle returns, refunds, warranties and customer service, and provide account functions.
Legal obligations: to meet accounting, tax, product-safety and other statutory requirements.
Security and fraud prevention: based on our legitimate interest in protecting customers, our services, products, intellectual property and distribution channels.
Product verification: based on our legitimate interest in verifying authenticity, preventing counterfeit products and misuse, and maintaining product traceability.
Service development and analytics: with consent where required, or on the basis of legitimate interest when the processing does not require consent.
Electronic marketing: on the basis of consent or, where permitted by law, an existing customer relationship. You can opt out at any time.

4. How we obtain data

We receive personal data when you create an account, place an order, contact us, use the website, choose cookie preferences, subscribe to marketing, respond to a survey, or scan a product-verification code. We may also receive necessary transaction, delivery and fraud-prevention information from payment, logistics and service providers.

5. Recipients and service providers

We disclose data only when necessary for the purposes described above. Recipients may include payment providers, banks, delivery and logistics providers, hosting and IT providers, customer-service and marketing platforms, professional advisers, public authorities and other parties where required by law.

Online payments are processed by Paytrail Plc and other payment methods presented at checkout. Taomtips Oy does not store full payment-card details.

Where a service provider processes data on our behalf, it may use the data only according to our documented instructions and applicable data-protection law.

6. International transfers

Some service providers may process data outside the European Economic Area. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where necessary.

7. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected and for applicable legal obligations. Our principal retention periods are:

customer accounts with no completed orders: up to 24 months after the last account activity;
customer-account login and profile data associated with orders: up to 36 months after the most recent account activity or order, unless the customer asks us to close the account earlier and no overriding reason requires continued retention;
pending checkout and abandoned-order records: normally 7 days;
failed payment/order records: normally 30 days;
cancelled-order records: normally 12 months;
completed, refunded and other accounting records: normally up to 7 years, after which personal fields are deleted or anonymised unless a longer period is required for a legal claim or other statutory obligation;
customer-service, complaint, warranty and legal-claim records: for the duration of the matter and normally up to 3 years after it is closed, or longer where needed to establish, exercise or defend a legal claim;
privacy-request and consent records: normally 3 years after the request is completed or the consent is withdrawn;
marketing data: until consent is withdrawn or the data is no longer needed for marketing; inactive marketing records are reviewed regularly;
cookie and similar-technology data: according to the retention periods stated in our Cookie Policy; and
backups: overwritten according to a rolling schedule, normally within 30–90 days, subject to security and disaster-recovery requirements.

Before deleting an account, we may retain or separate information that must remain available for accounting, tax, fraud prevention, warranty handling or legal claims. When retention is no longer necessary, data is deleted or anonymised.

8. Cookies and similar technologies

We use necessary cookies to operate the website and online store. Optional preference, analytics and marketing technologies are used only according to the choices available in our consent banner and where consent is required. You can change your choices at any time through Cookie settings. More information is available in our Cookie Policy.

9. Product authentication and QR verification

Some TAOM products include a QR code used to verify authenticity and provide product information. The verification service may process the date and time of the scan, approximate city-level location and limited technical event data needed for security, monitoring and service improvement.

The service is designed not to store direct identifiers such as a name or contact details merely because a code is scanned. In most cases, we cannot identify an individual from a verification event alone. If you ask us to exercise a data-protection right in relation to a verification event, we may need additional information to locate the relevant event.

10. Your data-protection rights

Subject to applicable law, you have the right to:

obtain confirmation of whether we process your personal data and receive a copy of it;
correct inaccurate or incomplete data;
request deletion of data;
restrict processing;
object to processing based on legitimate interests or to direct marketing;
receive data you provided in a structured, commonly used and machine-readable format where the right to portability applies; and
withdraw consent at any time without affecting processing carried out before withdrawal.

Requests are normally free of charge. A reasonable fee may be charged, or a request may be refused, only where permitted by law, for example if a request is manifestly unfounded or excessive. We normally respond within one month.

Send requests to privacyprotection@taombilliards.com. We may ask for information necessary to verify your identity.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman’s Office or another competent supervisory authority.

11. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. Access is limited according to job duties, and service providers are subject to confidentiality and data-protection obligations.

12. Changes to this policy

We review this Privacy Policy regularly. Material changes will be communicated on this page and, where appropriate, directly to affected customers.