Privacy Policy

Version date: 22 October 2026 (original content 7 October 2026)

1. Data Controller

The data controller is BlueBell Markets Ab Ltd (business ID 3543354-3), Piitie 1, 01510 Vantaa, Finland. Website: juomainfo.fi. The contact person for privacy enquiries, data subject requests and reports of security incidents is CEO Oxana Torres Contente. Contact: palvelu@juomainfo.fi. BlueBell Markets Ab Ltd operates JuomaInfo; business services are provided under the DrinkData name.

2. Scope

This policy explains how personal data is processed when you use JuomaInfo, including website browsing, product search and price comparison, following links to sellers or partners, newsletter subscription, the chat, feedback and contact, and registration as a Delivery Partner. When you purchase from an external seller, that seller processes your personal data as a separate controller under its own privacy practices.

3. Personal Data We Process

Depending on use, data may include:

technical connection information (IP address, browser, device and operating system) and the addresses of the pages requested, in the server logs of our service providers;
use of links to external stores: a click is recorded for statistics with the seller and the time only, without IP address or browser data; no reference is added to the seller’s address (see section 7);
a one-way (salted) hash of the network address, kept with chat conversations and Delivery Partner agreement acceptances to prevent misuse. JuomaInfo’s own database stores no IP addresses.

The chosen language and other choices are stored only in the visitor’s own browser (see the Cookie Policy). Search terms and filters are carried only in the page address; JuomaInfo does not store them, but like other page addresses they can appear in our service providers’ server logs. A 0.0% selection may be processed as a service preference; we do not infer health, religion, lifestyle or other personal characteristics merely from that choice.

We may process email address, language, optional interests, consent status, timestamp and wording version, source, confirmation and delivery data. We also record the confirmation that the subscriber is 18 or older, and unsubscribe and block status. Sign-ups that are not confirmed are deleted after 30 days. Newsletter subscription does not automatically create a JuomaInfo account.

Contact and Feedback

We may process name, email, message content, relevant product/page, time of contact and information necessary to handle the matter. Please avoid sending unnecessary personal data.

Chat

We process the messages, the page and page title where the chat was used, the language, the e-mail address if the visitor leaves one for a reply, a one-way hash of the network address to prevent misuse, and a hash of the conversation key.

Delivery Partners

For Delivery Partner applicants and partners we process name, e-mail address, telephone number, company status, business ID, VAT registration, invoicing service, how the applicant heard of the programme and the decision on the application. For each acceptance of the agreement we record its version and time, the self-billing acceptance where relevant, a one-way hash of the network address and the browser identification.

Future User Accounts

If user accounts are introduced later, account data, saved searches, favourites, preferences and other user-saved information may be processed. Further information will be provided before launch where necessary.

4. Purposes

Purposes may include providing and operating the service, search and comparison, remembering settings, security and misuse prevention, click statistics on links to sellers, developing the service on the basis of those statistics (no analytics tool is used), handling order reports from sellers and settling agreements with sellers and partners, newsletters and accepted marketing, handling contacts, correcting errors and complying with legal obligations.

5. Legal Bases

Each purpose has its own legal basis under Article 6(1) of the General Data Protection Regulation (GDPR):

Newsletter and other electronic marketing the visitor has accepted: consent (Article 6(1)(a)). Consent can be withdrawn at any time (section 6).
Delivery Partner applications and agreements: contract, or steps taken at the applicant’s request before entering into a contract (Article 6(1)(b)).
Accounting: legal obligation (Article 6(1)(c)) under the Finnish Accounting Act (1336/1997). Disclosures to authorities where the law requires them, and other statutory obligations, are also based on legal obligation.
Security and misuse prevention, including server logs and the one-way hash of the network address: legitimate interest (Article 6(1)(f)); the interest is keeping the service secure and available.
Click statistics on links to sellers: legitimate interest (Article 6(1)(f)); the interest is understanding which sellers visitors are interested in.
Order reports from sellers, where an integration exists, and the settlement of agreements with sellers and partners: legitimate interest (Article 6(1)(f)); the interest is handling the reports and settling the agreements correctly. Where the processing is needed to perform an agreement with a seller, a partner or a Delivery Partner, it is also based on contract (Article 6(1)(b)).
Contact, feedback and the chat: legitimate interest (Article 6(1)(f)); the interest is answering the visitor’s enquiry.
Providing and operating the service, search and comparison, remembering settings, correcting errors and developing the service: legitimate interest (Article 6(1)(f)); the interest is offering a working, accurate and up-to-date service. Development is based on the service’s own click statistics; JuomaInfo uses no analytics tool (section 8).
Keeping records after a Delivery Partner agreement has ended (section 11): legitimate interest (Article 6(1)(f)) in establishing, exercising or defending legal claims, and legal obligation where the law requires retention.

Consent to storing or reading information on the device. Consent to storing information on the visitor’s device or reading it from the device, under section 205 of the Finnish Act on Electronic Communications Services (917/2014), which implements the EU ePrivacy Directive, is separate from the legal bases for processing personal data listed above. JuomaInfo’s own browser storage described in the Cookie Policy does not require it. At present no processing relies on consent to storing information on the visitor’s device or reading it from the device. For planned changes, see section 7.

6. Newsletter and Electronic Marketing

Electronic marketing is sent on an appropriate legal basis. Where based on consent, consent can be withdrawn at any time, for example through the unsubscribe link. Interest topics are optional.

7. Links to Sellers

When a visitor follows a link to a seller, JuomaInfo’s server records the click for statistics (the seller and the time, without IP address or browser data) and forwards the visitor to the seller’s ordinary address. JuomaInfo does not add a purchase-attribution identifier to the link. When you visit the seller’s website, the seller receives your browser’s request and processes the associated information under its own privacy policy. Purchase attribution is not in use: no purchase is attributed to JuomaInfo or to a partner. The tracking of the affiliate network Adtraction AB is not in use either.

Where an integration with a seller exists and the seller sends order notifications to JuomaInfo, JuomaInfo processes only the order number or identifier, the amount, the currency, the status and, where applicable, cancellation and refund information. No notification is matched to a click while purchase attribution is not in use. The preferred implementation is a notification limited to these fields. Where a seller’s platform sends a full notification (for example a Shopify order notification), it may contain buyer details such as name, address or e-mail address; JuomaInfo discards them without storing or logging them. JuomaInfo does not store the buyer’s name, address, e-mail address or payment details.

Planned changes

Before JuomaInfo’s own purchase attribution or Adtraction’s affiliate tracking is introduced, visitors will be given a clear choice to accept or reject each of them separately, a permanent "Cookie settings" link will be added to the footer of every page, and this policy will be updated and published before the tracking starts.

8. Cookies and Similar Technologies

JuomaInfo does not use Google Analytics or any other analytics tool, and does not use advertising cookies. JuomaInfo’s own technologies (the age confirmation, the language choice, session storage for the chat and scroll positions, and the security cookie `__cf_bm`) are necessary or store the visitor’s own choice, and do not require consent; the Cookie Policy gives the reason and duration of each. The choice made on the newsletter invitation is not stored in the browser. Purchase attribution and Adtraction’s affiliate tracking are not in use, and at present no technology is used on the basis of consent, so there is no consent choice and no "Cookie settings" link (for planned changes, see section 7). See the Cookie Policy, which lists every technology in use.

9. Recipients and Service Providers

We use the following service providers, which process personal data on our behalf:

Equinode AB (Sweden): technical service provider that builds and operates the service. Its engineers use an AI-assisted development tool from Anthropic (United States); under BlueBell’s conditions, identifiable personal data is not submitted to it unless BlueBell has given its separate prior approval and the applicable data-protection and transfer safeguards have been confirmed, and the data is not used to train AI models.
Supabase: database, file storage, server functions and backups, stored in the EU (Ireland, on Amazon Web Services); the server functions run in the EU. Contracting entity Supabase Pte. Ltd. (Singapore). Its network provider Cloudflare protects the platform’s server addresses.
Microsoft Azure: web hosting, logs and the nightly backup export, in Sweden, in BlueBell’s own Azure environment.
Postmark (AC PM, LLC, United States): sending e-mail.

When a visitor follows a link to a seller, JuomaInfo does not add a purchase-attribution identifier to the link. The seller receives the visitor’s browser request and processes the associated information under its own privacy policy. See section 7. Information may be disclosed to authorities where required by law.

10. Transfers Outside the EU/EEA

Where data is transferred outside the EU/EEA, transfer mechanisms and safeguards required by applicable data-protection law are used. Postmark (AC PM, LLC) processes e-mail in the United States under the European Commission’s standard contractual clauses. Supabase stores data in the EU, but the provider and its sub-processors, including Cloudflare, may access the service from outside the EU/EEA under standard contractual clauses. Cloudflare processes IP addresses in its global network to protect the service. Identifiable personal data is submitted to Equinode’s AI-assisted development tool (Anthropic, United States) only exceptionally, and only when BlueBell has given its separate prior approval and the applicable data-protection and transfer safeguards have been confirmed. Other data stays in the EU/EEA. Further information on these safeguards, including a copy or summary of the standard contractual clauses, can be requested from palvelu@juomainfo.fi (section 1).

11. Retention

We retain personal data only for as long as necessary.

Contact form submissions and chat conversations: 365 days from the date of receipt.
Newsletter subscribers: for the duration of the subscription. Sign-ups that are not confirmed are deleted after 30 days. After unsubscribing, the subscriber’s data is deleted from our database after 30 days; to prevent further messages, our e-mail service provider (Postmark) keeps the e-mail address on its suppression list. To be able to demonstrate a consent that was given or withdrawn, a minimal record of the consent is kept for 3 years after the latest consent event: a keyed one-way hash of the e-mail address (the address itself is not kept), the purpose, the event (given, confirmed or withdrawn), its time and the version of the consent text.
E-mail delivery events (delivery, bounce, complaint): 365 days.
Click records: 12 months from the click.
Order reports from sellers: reports that are not matched to a click, and rejected reports, are deleted after 90 days, and handled order-report review items after 90 days.
Commission calculation and reconciliation records, where they exist: three years from the final confirmation of the commission.
Delivery Partner registration and agreement records: for the duration of the agreement and three years after it ends; longer where legal claims or statutory obligations require. Applications that are rejected or never confirmed are deleted after 180 days.
Accounting records: according to applicable statutory retention requirements (typically six or ten years depending on the record category).
Security logs: at most 90 days, unless longer retention is justified for security, incident investigation or legal reasons.
Backups: deleted data can remain in backups and in the nightly backup export for up to 44 days before it is overwritten.

These are the retention principles approved by the controller.

12. Security

We apply appropriate technical and organisational security measures. Access is limited according to responsibilities, and system security is maintained as part of technical operations. As data controller, BlueBell Markets Ab Ltd is responsible for privacy enquiries, assessing personal data breaches and making any required notifications to the supervisory authority and affected individuals. Technical service provider Equinode AB investigates incidents within its services and notifies BlueBell without undue delay of any personal data breach it becomes aware of. Security incidents can be reported to palvelu@juomainfo.fi.

13. Your Rights

Depending on applicable law, users may have rights to information, access, correction, deletion, restriction, objection, portability in certain cases and withdrawal of consent. Requests: palvelu@juomainfo.fi. We respond to requests within one month.

14. Complaints

Users may lodge a complaint with the competent supervisory authority. In Finland this is the Office of the Data Protection Ombudsman.

15. Changes

The policy is updated when necessary and material changes are communicated appropriately.