Privacy Policy
Last updated: 16 August 2026
This Privacy Policy explains how Design Chess processes personal data when you visit our website, create an account, place or receive an order, contact us, exercise a right of withdrawal, return a product, make a complaint or warranty claim, subscribe to marketing, or submit a review.
On this page
1. Who we are
The controller responsible for your personal data is:
Controller: ITP International Trading Partners Ltd Oy
Trading as: The Design Chess Company (supplementary business name) and Design Chess (brand)
Finnish Business ID: 0932324-4
Address: Läntinen kehätie 22, 31400 Somero, Finland
Email: info@designchess.com
Email is our primary privacy contact.
2. Personal data we process
Depending on how you use our services, we may process:
- identity and contact data, such as your name, billing and delivery addresses, email address and telephone number;
- business and VAT data, such as the selected order type, company or organisation name, EU VAT number and VAT-validation information, including the result and date of a check and any registered name or address returned by the validation service;
- order and transaction data, such as products, quantities, prices, taxes, delivery method, order history, invoice information, payment status and transaction references;
- delivery and customs data, including tracking information and, only where required for delivery or customs clearance, a tax identification number, passport details or other identification requested by the carrier or destination authorities;
- account data, such as login and saved address details;
- communications and service data, including emails, messages, telephone notes, withdrawal notices and timestamps, returns, complaints, warranty claims, photographs and other evidence you provide;
- marketing and review data, such as newsletter choices, unsubscribe records, review invitations, reviews and feedback; and
- technical and usage data, such as IP address, device and browser information, security logs, cookie identifiers and information about how the website is used.
We do not receive or store your full card details. Payment providers process payment credentials under their own privacy notices. We receive information needed to confirm and administer the transaction, such as payment status and a transaction reference.
Please do not send passport details, tax identification numbers or other sensitive identification unless we or the carrier have confirmed that they are genuinely required and provided appropriate instructions.
3. How we collect personal data
We collect data:
- directly from you through checkout, account fields, forms, email, telephone or other communications;
- automatically when you use the website, subject to your cookie choices;
- from payment providers, carriers, customs service providers and other partners involved in your order;
- from EU VAT-validation systems and national tax authorities where we verify a VAT number or the tax treatment of an order;
- from the person who placed an order for you or gave us your details as the recipient of a gift; and
- from public authorities or other sources where this is necessary and lawful to manage an order, prevent fraud or comply with a legal obligation.
4. Why we use personal data and our legal bases
Orders, payment, delivery and customer service
We use identity, contact, order, payment-status and delivery data to process orders, take payment, deliver products, communicate about the order and provide customer service. This is necessary to perform a contract with you or to take steps at your request before entering into a contract.
If you are the recipient rather than the purchaser, we process the delivery data necessary to fulfil the purchaser’s order and our legitimate interest in delivering it correctly.
Withdrawals, returns, complaints and warranty claims
We use order and communications data to record notices, arrange returns, handle refunds, investigate reported problems, fulfil legal obligations and manage warranty claims. The legal bases are performance of the contract, compliance with legal obligations and, where necessary, our legitimate interest in establishing, exercising or defending legal claims.
Accounting, tax, customs and other legal duties
For a business or organisation order, we may validate or revalidate an EU VAT number through the EU VAT Information Exchange System (VIES), which retrieves information from national VAT databases. We may compare the result with the company, billing and delivery information provided with the order and keep a record of the check.
We process and retain this information where necessary to comply with tax and accounting obligations. We also have a legitimate interest in preventing misuse and documenting the basis for the VAT treatment applied.
We retain and disclose information where necessary to comply with customs, consumer-protection and other legal obligations.
Customer accounts
We process account data to provide the account features you request, including saved details and order history. Creating an account does not subscribe you to marketing.
Security, fraud prevention and service operation
We use technical, account and transaction data to operate and secure the website, prevent abuse and fraud, diagnose faults and protect our rights and those of customers. This is based on our legitimate interests in providing a secure and reliable service and, where relevant, compliance with legal obligations.
Product-review invitations
We may send one service message after a purchase asking you to review the product. Where permitted by law, this is based on our legitimate interest in obtaining feedback and improving our products and service. Where consent is required, we rely on consent. You may object to review invitations at any time.
5. Who receives personal data
We disclose or make data available only where it is needed for the purposes described above. Recipients may include:
- authorised Design Chess personnel;
- website, ecommerce, hosting, cloud, IT-support and email service providers;
- payment providers, including Stripe and PayPal;
- delivery providers, including FedEx, Posti and local delivery partners, and customs or clearance providers;
- accountants, auditors, the VIES service, relevant national tax administrations, customs authorities and other public authorities;
- Customer Reviews Ltd / CusRev, where used to send a review invitation or host a review;
- analytics, marketing and cookie-technology providers according to the services in use and your consent choices;
- manufacturers or service partners where their involvement is reasonably needed to provide an agreed repair or replacement;
- professional advisers, insurers, dispute-resolution bodies, courts or authorities where reasonably necessary to manage a claim, comply with law or protect legal rights; and
- a buyer or successor if all or part of the business is reorganised or transferred, subject to appropriate safeguards.
These parties may act as processors on our instructions or as independent controllers for their own legal responsibilities. Their own privacy notices apply when they determine how they process data.
We do not sell personal data.
6. International transfers
Some service providers, payment providers, carriers or their systems may be located outside the European Economic Area. A delivery to a country outside the EEA also requires us to send the recipient’s details to carriers, customs representatives or authorities in that destination.
Where data is transferred outside the EEA, we use a lawful transfer mechanism where required, such as an adequacy decision, the European Commission’s standard contractual clauses or another safeguard permitted by data-protection law. Information necessary to perform your order may also be transferred where the law specifically permits this.
You may contact us for more information about the safeguards relevant to your data.
7. How long we keep personal data
We keep personal data only for as long as needed for the purpose for which it was collected and for any applicable legal, accounting or claims period.
- Order, service, return and warranty records: normally for the three-year warranty period and a short administrative period afterwards. We may keep relevant records longer while a matter is open or where needed for a legal obligation or the establishment, exercise or defence of legal claims.
- Accounting and tax records, including EU VAT numbers and validation records: for the period required by law. In Finland, many transaction records and related correspondence must generally be kept for at least six years from the end of the relevant financial year, and some accounting material for ten years.
- Additional customs or identification data: deleted or securely redacted from active systems when the delivery and clearance purpose is complete, unless a law or unresolved matter requires longer retention. Copies in protected backups expire according to the backup cycle.
- Customer accounts: while the account is active. We close, delete or anonymise an account at your request, subject to records we must retain separately. Accounts with no activity for five years are reviewed and data that is no longer needed is deleted or anonymised.
- Marketing data: until you withdraw consent or we stop the relevant marketing. We may retain minimal suppression information so that we can honour an unsubscribe request.
- Review-invitation records: normally for no longer than 12 months after the invitation. A published review may remain available until it is deleted or anonymised in accordance with the review service and applicable law.
- Technical and security logs: for a limited period appropriate to their purpose, normally no longer than 12 months, unless a longer period is needed to investigate a security incident, fraud or legal claim.
- Cookie data: for the periods stated in the Cookie Policy or cookie preference tool.
When data is no longer required, we delete or anonymise it securely.
8. Your data-protection rights
Subject to the conditions in applicable law, you may have the right to:
- receive information about how your personal data is used;
- access your personal data and obtain a copy;
- correct inaccurate or incomplete data;
- have personal data erased;
- restrict processing;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive certain data in a portable format; and
- withdraw consent at any time where processing is based on consent.
These rights are not absolute. For example, we may need to retain invoice or transaction information to comply with accounting law even if you ask us to erase it.
To exercise a right, email info@designchess.com or write to the address in Section 1. No particular form is required. We may ask for additional information only where reasonably necessary to verify your identity. We normally respond without undue delay and within one month. Requests are generally free of charge, although the law permits a reasonable fee or refusal for requests that are manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/report-of-fault-in-personal-data-processing/. You may also contact the supervisory authority in the EEA country where you live or work or where you believe an infringement occurred.
9. Information security
We use reasonable technical and organisational safeguards designed to protect personal data. These include access controls, password protection, encryption where appropriate, secure service providers, backups and limiting access to people who need the data for their work.
No method of transmitting or storing data is completely secure. We review our safeguards and respond to suspected incidents in accordance with applicable law.
10. Other websites and third-party services
Our website may link to third-party websites or services. Their privacy practices are governed by their own notices. This policy does not control how an independent third party uses data that you provide directly to it.
11. Changes to this Privacy Policy
We may update this policy when our services, providers or legal obligations change. The current version and its last-updated date are published at https://www.designchess.com/privacy-policy/.
If a change materially affects processing that requires your consent, we will request new consent where required.
12. Contact us
For questions about this policy or our use of personal data, or to exercise a data-protection right, email info@designchess.com.