Privacy Policy

Last Updated: 17. June 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

MightyMerch
Owner: Sven Wiese
Leenantie 18
FIN-01400 Vantaa
Finland
Phone: +358 456 327 328
Email: shop@mightyworkwear.com
VAT-ID: FI22430888

If you have questions regarding this Privacy Policy or the processing of your personal data, please contact us using the email address above.

2. General Information

We take the protection of your personal data seriously and process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Finnish data protection laws.

This Privacy Policy explains what personal data we collect, how we use it, and what rights you have regarding your personal information.

3. Data We Collect

Depending on how you use our website, we may collect and process the following categories of personal data:

First and last name
Billing address
Shipping address
Email address
Telephone number
Company name (where applicable)
VAT identification number (where applicable)
Order and payment information
Customer account information
Contact form submissions
Communications with customer support
Technical and usage information

We only process personal data where there is a lawful basis for doing so.

4. Server Infrastructure and Hosting

This website is operated on a Virtual Private Server (VPS) provided by:

IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany

The server infrastructure is provided by IONOS, while the website, web server, databases, analytics platform, backups, and associated services are administered and operated directly by MightyMerch.

When you visit our website, the server automatically records technical information in log files, including:

IP address
Date and time of access
Browser type and version
Operating system
Referrer URL
Requested pages and resources
HTTP status codes

These logs are processed for system security, fraud prevention, error analysis, website stability, and technical administration.

The legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

5. WooCommerce Store

We use WooCommerce to operate our online store.

When you place an order, create an account, or use our store, we process personal data required for:

Order processing
Payment processing
Delivery of products
Customer support
Account management
Legal compliance

The legal basis for this processing is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations).

6. Customer Accounts

Customers may voluntarily create a customer account.

Account information may include:

Name
Email address
Billing and shipping addresses
Order history
Saved account preferences

You may request deletion of your customer account at any time, subject to legal retention obligations.

7. Guest Checkout

Customers may place orders without creating a customer account.

The same information required for order fulfillment and legal compliance is processed during guest checkout.

8. Payments and Stripe

We use Stripe Payments to process online payments.

Depending on the selected payment method, personal data may be transmitted to Stripe and its affiliated payment partners.

Supported payment methods may include:

Credit cards
Debit cards
Apple Pay
Google Pay
Klarna

The following information may be processed:

Name
Billing address
Email address
Payment information
Transaction details
IP address

Payment processing is necessary for contract performance under Art. 6(1)(b) GDPR.

Further information is available at:

https://stripe.com/privacy

Additional privacy policies of Apple, Google, and Klarna may apply when those payment methods are selected.

9. Invoices and Tax Processing

We use WooCommerce PDF Invoices & Packing Slips to generate invoices and shipping documents.

Generated documents may contain:

Customer name
Billing address
Shipping address
Ordered products
VAT information
Transaction details

We also use EU VAT Assistant for WooCommerce to process and validate VAT-related information where applicable.

Accounting and tax-related data is retained in accordance with applicable legal requirements.

10. Contact Forms

We provide contact forms through SureForms.

When you submit a form, we may process:

Name
Email address
Subject
Message content
Any additional information voluntarily provided

This information is used solely to respond to your inquiry and provide customer support.

11. Transactional Emails

We use WP Mail SMTP together with SendLayer for the delivery of transactional emails.

Examples include:

Order confirmations
Order status updates
Password reset emails
Customer account notifications
Contact form replies

To deliver these communications, SendLayer may process email addresses, email metadata, and delivery information.

12. Analytics

We use a self-hosted installation of Umami Analytics.

Our analytics platform:

Is hosted on infrastructure under our control
Does not share analytics data with third-party analytics providers
Uses IP anonymization
Is configured with privacy-focused settings

Analytics information may include:

Visited pages
Referrer information
Browser type
Device information
General geographic region
Website interactions

Analytics data is used exclusively to improve website functionality, optimize user experience, monitor website performance, and analyze website traffic trends.

13. Cookies

Our website uses cookies and similar technologies necessary for the operation of the store.

These may include cookies required for:

Shopping cart functionality
Checkout functionality
Customer login sessions
Security features
Payment processing
Website preferences

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

14. Data Recipients

Personal data may be shared with the following categories of recipients where necessary:

IONOS (server infrastructure provider)
Stripe and associated payment partners
Shipping and logistics providers
SendLayer (email delivery service)
Professional advisors where legally required
Government authorities where required by law

We do not sell personal data to third parties.

15. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy.

Retention periods may depend on contractual obligations, tax and accounting requirements, legal obligations, and dispute resolution requirements.

When data is no longer required, it will be securely deleted or anonymized.

16. Backups and Security

For security and disaster recovery purposes, website and database backups may be created regularly.

Backups are protected using appropriate technical and organizational measures and are retained only for as long as necessary for recovery purposes.

We implement reasonable technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, or disclosure.

17. International Data Transfers

Certain service providers may process personal data outside the European Economic Area (EEA).

Where such transfers occur, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful transfer mechanisms recognized under GDPR.

18. Your Rights

Under the GDPR, you have the following rights:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time where processing is based on consent

Requests may be sent to:

shop@mightyworkwear.com

19. Right to Lodge a Complaint

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.

In Finland, this is generally:

Office of the Data Protection Ombudsman

https://tietosuoja.fi/en/home