This privacy policy is drafted in accordance with the Data Protection Act and the General Data Protection Regulation (2016/679/EU). This document is an information document and a record of processing activities in accordance with General Data Protection Regulation. This document was drafted on 28.8.2026 and last updated on 28.8.2026.


DATA CONTROLLER

Young Galaxy 

Helsinki, Finland

Contact person in Privacy Policy matters:

Young Galaxy
info@younggalaxy.co


REGISTER NAME AND CONTENT

Young Galaxy’s register of customer, user and marketing data (”Customer Register”).


LEGITIMATE GROUNDS FOR COLLECTING PERSONAL DATA / WHY Young Galaxy COLLECTS YOUR DATA?

Data collecting in general

Personal data is information which can be associated with a specific person. This privacy policy describes how Young Galaxy collects, processes, and stores personal data. This policy includes information of customers’ rights regarding the collected data. Young Galaxy complies with the General Data Protection Act (GDPR) and all other effective regulation, including laws, statutes, provisions, or other orders given by authorities relating to collecting and handling of personal data.

Purposes of collecting personal data

a) In order to use Young Galaxy’ services or to register as a user for services provided by Young Galaxy

  • The purpose of Customer Register is to maintain data of customers who are buying Young Galaxy’ services, or customers who have registered as a user in service provided by Young Galaxy.

  • In addition, register is used for Young Galaxy’ marketing and communication purposes.

Persons mentioned in section a) will be referred to as a ”Customer” in this privacy policy. 

b) Collecting of personal data based on explicit consent 

In case there is no legitimate ground to collect and process personal data, explicit consent to collect, process and store data will be requested. 

Consequences for not receiving the necessary information

If data controller does not receive information mentioned in sections a) and b) the service cannot be 


provided for the customer or any other actions or agreements with Young Galaxy cannot be made. 

How personal data is used

Personal data in Customer register may be used for following purposes:

  • Executing and developing services 

  • Producing, offering, improving, and securing services of Young Galaxy

  • Securing customer transactions 

  • Targeted marketing actions

  • Analyzing and collecting statistics of services

  • Customer communication, marketing, and advertising

  • Protecting the rights & ownership of data controller and other parties related to services or assignments 

  • Observing all applicable rules and regulations

  • Other necessary purposes


CONTENTS OF CUSTOMER REGISTER

Young Galaxy processes information to maintain services and the Customer Register. 

Young Galaxy processes or may process data included in the following groups:

  • Customer details: full name, address, email address, phone number

  • Details of the pregnancy and due date, date of birth of the child and size of the child.

  • Information related to devices, language preferences and payment method. Payments and other transactions will be handled by third party. Young Galaxy will not collect payment information in the customer register. 

  • Information related to billing and debt collection.

  • Details of the customer relationship. Services offered to customer, date of use, order confirmations and other necessary details.

  • Information of consents and prohibitions, for example consent or prohibition to direct marketing.

  • Information and other details given by customers.

  • Other necessary information of the actions occurred with the service.


STORAGE PERIOD

Personal data collected from the registration process of the customer will be stored for a period of ten (10) years starting from the day of registration. 

Other personal data will be deleted after there is no mandatory purpose to store the data. If collecting and processing of the data was based on consent only the data will be removed if the customer requests so.


REGULAR DATA SOURCES

Personal data is collected from the customer with forms filled by the customer, by using the services provided by the data controller or directly from the customer, from the contact forms, customer satisfaction surveys or draws. 

Data given based on consent is collected directly from the customer or from authorities or third parties’ registers with the customer’s consent. 


TRANSFERRING OF THE DATA / WHERE CAN WE TRANSFER YOUR PERSONAL DATA? 

Data controller may transfer data within the range of applicable regulation and to complete agreements made between parties. 

Data may be transferred to (or accessed in), jurisdictions outside the European Economic Area or the User’s domicile. Transfer is done with cloud services, such as OneDrive, iCloud, Google Drive or Dropbox. 


Data is transferred to authorities in situations required by the relevant legislation. 

Data controller may share data with third parties if customer gives explicit consent. 

In case Young Galaxy’ IT administration becomes outsourced, data may be shared with the subcontractor but only on behalf of the data controller. 


PROTECTION OF THE REGISTER

Only employees and subcontractors who must process personal data to carry out their duties have access to the register. Data is collected to database which is secured using firewalls, passwords, and other necessary technical measures. Databases are in locked and guarded facilities. Only persons who have been given access to database may use the data. The user log is recorded electronically. 

When data is processed by third parties on behalf of the data controller, appropriate contractual and organizational measures have been taken to ensure that data is processed exclusively for the purposes specified in this Privacy Policy and in accordance with all applicable laws and regulations and subject to our instructions and appropriate obligations of confidentiality and security measures.


CUSTOMER RIGHTS

The Customer has the right to check the data collected by the data controller. The Customer must send the request in written and signed form or in corresponding electronic form. 

The Data controller will provide the data within 30 days from the request. The customer is entitled to assign the personal data to a third party in electronical and commonly used format. The Data controller will store the transferred data in accordance with this Privacy Policy. 

The Customer has the right to have incorrect or incomplete personal data corrected or completed. The Customer has the right to prohibit the data controller from using personal data to direct marketing purposes, distance selling, marketing research or development purposes of the data controller’s business activities. Customer has the right to prohibit the processing of personal data and have the data removed from the register.

If the data was collected based on explicit consent it may be withdrawn at any time by notifying the data controller. If the request for withdrawal is presented the data controller will remove all data which is not required to be stored with legitimate grounds. 

The request for correcting or completing the data can be sent in written form or by contacting the data controller using the contact details mentioned in this privacy policy. The customer may bring the case to the data protection ombudsman if the data controller does not comply with the request to correct, complete, or remove data. 


PROFILING AND AUTOMATED DECISION-MAKING

The data controller will not use personal data in profiling or automated decision-making.


COOKIES

We use cookies on our website. By using our website, you agree the usage of cookies. Cookies are small text files sent and saved to computer, mobile phone, tablet, or another similar device. The cookies will not be used if the user has not given consent according to the notification on the website. Cookies are commonly used on most websites. 

We use cookies to:

  • improve the user experiences on our website 

  • save your personal settings and preferences

  • offer relevant content and information

  • secure the safety of our website

  • collect statistics of the use of our website and effectiveness of marketing actions

  • enable an Intercom-platform used on the website

You can delete the cookies in your browser’s settings after which the identifier which is used to collect data of you will be renewed. You can also prohibit the cookies entirely by changing your browser settings. Prohibiting the cookies may affect the functionality of our services. If you decide to prohibit the cookies you may not be able to fully utilize our online services. 


User monitoring

Monitoring program can be used on our website, for example Google Analytics, which gives us insight on your actions on our website. For this purpose, the monitoring program uses cookies and the information collected by using the cookies will be stored in Google or other service provider. We use encryption of the IP-addresses if the monitoring program is active. More information of monitoring programs and terms can be requested from the data controller. 


CHANGING OF PRIVACY POLICIES

The data controller improves its business constantly and therefore it may make updates to privacy policies. Updates can also be done due to changes in legislation. 

The data controller will notify customers and users and request their consent, if necessary, in case the updates include new purposes for collecting and processing personal data or other material changes.