Privacy Policy
Last updated: 23.10.2026
This Privacy Policy explains how Lapland Catering / Levi Black Operations Oy collects and processes personal data in connection with the website, online store, contact forms, and related digital services.
1. Data Controller
Levi Black Operations Oy
Business ID: 3108618-5
Immellompolo 1
99130 Sirkka (Kittilä)
Finland
2. Contact Person for Privacy Matters
Antti Tuononen
Managing Director
Levi Black Operations Oy
Email: antti@laplandcatering.com
If you have any questions regarding privacy or the processing of your personal data, you may contact us using the email address above.
3. Personal Data We Process
Depending on how you use the website and our services, we may process information such as your name, email address, telephone number, delivery and billing address, order details, ordered products and quantities, selected delivery date and time, payment method and payment status, information you provide through contact or quotation request forms, and technical information relating to your browser, device, and use of the website.
If the website uses cookies related to analytics or other optional features, we may also process cookie identifiers and information relating to website usage in accordance with the cookie choices made by the user.
As a general rule, we do not receive or store customers’ full payment card details in our own systems. Payment information is processed by the payment service provider.
4. Purposes of Processing Personal Data
Personal data is processed for receiving and fulfilling online store orders, arranging deliveries, processing payments, sending order confirmations and other order-related communications, providing customer service, responding to enquiries and quotation requests, fulfilling accounting and other legal obligations, maintaining the technical functionality and security of the website, analysing website usage based on the user’s consent, and monitoring and improving the website’s search engine visibility.
5. Legal Bases for Processing Personal Data
Depending on the situation, the processing of personal data is based on one or more of the following legal bases.
Performance of a contract: when processing is necessary to receive, process, and deliver an order placed by the customer.
Legal obligation: when information must be retained or otherwise processed in order to comply with accounting, taxation, or other applicable legislation.
Legitimate interests: when processing is necessary for purposes such as customer service, service security, prevention of misuse, or reasonable business administration.
Consent: when we use optional cookies, analytics services, or other technologies that require the user’s consent.
Where processing is based on consent, you may withdraw your consent at any time.
6. Online Store and WooCommerce
The online store on the website is implemented using WooCommerce.
When an order is placed, we process information necessary to fulfil the order, such as the customer’s contact details, delivery and billing information, ordered products and quantities, selected delivery date and time, order value, delivery charge, payment method, and payment status.
This information is used to process and deliver the order, provide customer service, and fulfil accounting and other legal obligations.
WooCommerce may also use cookies and session information that are necessary for the operation of the online store, for example to maintain the shopping cart and checkout functionality.
7. Payments and Stripe
Payments made through the online store are processed using Stripe.
When making a payment, information necessary to process the transaction may be transferred to Stripe and, depending on the selected payment method, to other parties involved in processing the payment.
Such information may include transaction details, order value, payment method, and information required for payment verification and fraud prevention.
Lapland Catering / Levi Black Operations Oy does not generally store customers’ full payment card numbers or card security codes in its own systems. Payment card data is processed by Stripe, as well as the banks and other payment service providers involved in the transaction.
Stripe processes personal data in accordance with its own privacy policy and applicable data protection legislation.
8. Contact and Quotation Request Forms
The forms on the website are implemented using Gravity Forms.
Depending on the form, we may request information such as your name, email address, telephone number, company or group information, event or order-related information, and any other information you choose to include in your message.
Information submitted through forms is used to respond to enquiries, prepare quotations, and manage potential or existing customer relationships.
Form submissions may be stored in the website’s WordPress database and may also be sent by email to recipients configured for the form.
Please do not submit unnecessary sensitive personal data through the forms.
9. Google Analytics 4
The website may use Google Analytics 4 (GA4) to analyse website usage and improve the usability and content of the website.
Analytics may provide information such as the number of visitors, pages viewed, traffic sources, device and browser types, and interactions with the website.
Google Analytics may use cookies or similar technologies. Analytics-related tracking is used in accordance with the user’s cookie preferences and applicable data protection legislation.
You can change your cookie preferences later through the cookie settings available on the website.
10. Google Search Console
We use Google Search Console to monitor the website’s visibility in Google Search, indexing status, search performance, and technical functionality.
Search Console provides the website administrator with aggregated information about how the website appears and performs in Google Search results.
Google Search Console does not require a separate visitor tracking cookie to be installed on the website in the same way as Google Analytics.
11. Cookies
The website uses cookies and similar technologies that are necessary for the operation of the website and online store.
Necessary cookies may be used, for example, to maintain the shopping cart, checkout session, language preferences, security functions, and other essential website functionality.
With the user’s consent, analytics-related and other optional cookies may also be used.
The website uses a cookie consent management solution that allows users to accept or reject optional cookies and change their preferences later.
Cookies necessary for the basic operation of the website may be used without separate consent where permitted by applicable legislation.
12. Recipients of Personal Data and Service Providers
Personal data may be processed by external service providers where this is necessary for the operation of the website and the provision of our services.
Such service providers may include website hosting and technical maintenance providers, WooCommerce and related technical services, Stripe and other parties involved in payment processing, Google services such as Google Analytics and Google Search Console, email service providers, and other technical service providers used in the operation of the website.
Service providers are only provided with, or given access to, information that is necessary for the provision of the relevant service.
We do not sell personal data to third parties.
13. Transfers of Personal Data Outside the EU or EEA
Some of the service providers used on the website, including certain Google and Stripe services, may process personal data outside the European Union or European Economic Area.
Where personal data is transferred outside the EU or EEA, appropriate safeguards required by applicable data protection legislation are used. These may include an adequacy decision by the European Commission, Standard Contractual Clauses approved by the European Commission, or another legally recognised transfer mechanism.
14. Retention of Personal Data
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or for as long as required by law.
Order and payment-related information may be retained for longer periods where necessary for accounting, taxation, payment and refund processing, complaints, or other legal obligations.
Information submitted through contact forms is retained for as long as necessary to process the enquiry or manage a potential or existing customer relationship.
The retention period for analytics data is determined by the settings of the analytics services in use.
Personal data that is no longer required will be deleted or anonymised where appropriate.
15. Protection of Personal Data
Appropriate technical and organisational measures are used to protect personal data.
These may include user accounts and access controls, encrypted HTTPS connections, regular software updates and maintenance, restricting access to administrative systems, and limiting access to personal data to persons whose duties require such access.
16. Your Rights
Under applicable data protection legislation, you may have the right to access personal data concerning you, request correction of inaccurate or incomplete data, request deletion of your personal data where there is no longer a lawful basis for retaining it, request restriction of processing in certain circumstances, object to processing based on legitimate interests, withdraw your consent at any time, and, in certain circumstances, receive personal data you have provided in a structured and machine-readable format.
These rights are not absolute in every situation. For example, a legal obligation may require us to retain certain order or accounting information even if deletion is requested.
Requests concerning your personal data may be sent to:
We may request additional information where necessary to verify your identity before fulfilling a request.
17. Right to Lodge a Complaint with a Supervisory Authority
If you believe that your personal data has been processed in violation of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
18. Changes to This Privacy Policy
We may update this Privacy Policy when our services, website functionality, service providers, or applicable legislation change.
The current version of this Privacy Policy is always available on this page.