Privacy Policy

Last updated: October 1, 2026

Studio October Oy, trading as VYIR (“VYIR”, “we”, “us” or “our”), operates the VYIR online store and website and provides related products, services, content and features (collectively, the “Services”).

Our online store is powered by Shopify, which provides the ecommerce platform that enables us to offer the Services to you.

This Privacy Policy explains how we collect, use, disclose and otherwise process personal information when you visit or use our website, make a purchase, create an account, communicate with us, interact with our advertising, or otherwise use our Services.

Please read this Privacy Policy carefully. By using our Services, you acknowledge that you have received and understood the information contained in this Privacy Policy.

1. Who Is Responsible for Your Personal Information?

For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”), the data controller is:

Store: VYIR
Company: Studio October Oy
Business ID: 2699115-6
EU VAT number: FI26991156
Address: Valtakatu 6, 26100 Rauma, Finland
Phone: +358 400 728 264
Email: contact@vyir.com

2. Personal Information We Collect

The personal information we collect depends on how you interact with VYIR and the Services.

We may collect the following categories of information.

Contact and identification information

This may include:

• name;

• billing address;

• shipping address;

• email address;

• telephone number; and

• other information you provide when contacting us or placing an order.

Account information

If you create an account, we may process information such as:

• account username or login information;

• password or authentication information;

• account preferences;

• saved addresses;

• wishlist information; and

• account settings.

Order and transaction information

This may include:

• products you view;

• products added to your cart or wishlist;

• products purchased;

• order history;

• order value;

• returns;

• exchanges;

• cancellations;

• discount codes;

• shipping information; and

• other transaction-related information.

Payment information

Payments are processed through Shopify and/or our payment service providers.

Depending on the payment method you use, information processed in connection with your payment may include:

• payment card information;

• billing information;

• payment method;

• payment confirmation;

• transaction identifiers; and

• other information necessary to process or verify a payment.

VYIR does not necessarily receive or store complete payment-card details where those details are processed directly by our payment providers.

Device and technical information

When you access the Services, we or our technology partners may automatically receive information such as:

• IP address;

• browser type;

• operating system;

• device type;

• device or advertising identifiers;

• language;

• approximate location derived from an IP address;

• referring URL;

• pages visited;

• date and time of visits; and

• other technical information relating to your interaction with our website.

Website usage information

We may collect information about how you interact with VYIR, including:

• pages and products viewed;

• searches;

• links clicked;

• products added to or removed from your cart;

• checkout activity;

• purchases;

• interactions with advertisements;

• referral sources; and

• other browsing or engagement information.

Communications

If you contact us, we may process the information contained in your communication, including customer-service requests, questions, feedback and other correspondence.

Marketing and advertising information

Where permitted by applicable law and, where required, based on your consent, we may collect and process information relating to your interactions with VYIR and our advertising.

This may include information collected through cookies, pixels, tags, APIs and similar technologies provided by advertising and analytics partners such as:

• Google;

• Meta, including Facebook and Instagram;

• Pinterest; and

• TikTok.

Depending on the technology and your consent choices, information processed may include device identifiers, IP addresses, browser information, pages or products viewed, shopping-cart activity, purchase events, transaction values, advertisement interactions and similar online activity.

Certain advertising services may also process customer information such as an email address or telephone number in hashed or otherwise protected form for conversion measurement, audience matching and advertising purposes.

3. How We Collect Personal Information

We collect personal information from several sources.

Directly from you

For example, when you:

• place an order;

• create an account;

• subscribe to marketing;

• contact customer service;

• complete a form;

• participate in a promotion; or

• otherwise provide information to us.

Automatically

Information may be collected automatically when you use our website through technologies such as:

• cookies;

• pixels;

• tags;

• local storage;

• software development kits;

• server-side integrations; and

• similar technologies.

From Shopify and service providers

We receive information from Shopify and from companies that help us provide, secure, analyse, advertise or improve the Services.

From advertising and business partners

We may receive information relating to advertising campaigns, advertisement interactions, conversions or audiences from companies such as Google, Meta, Pinterest and TikTok.

4. How We Use Personal Information

We use personal information for the purposes described below.

Providing and fulfilling the Services

We process information to:

• process and fulfil orders;

• process payments;

• deliver products;

• provide order confirmations and shipping information;

• process returns, refunds and exchanges;

• manage customer accounts;

• provide customer support;

• remember preferences; and

• otherwise perform our obligations to you.

Where GDPR applies, this processing is generally necessary to perform a contract with you or to take steps at your request before entering into a contract.

Improving and personalising VYIR

We may process information to:

• understand how customers use our website;

• improve our website and product offering;

• troubleshoot technical issues;

• analyse shopping behaviour;

• improve website functionality;

• remember preferences;

• recommend relevant products; and

• improve the overall customer experience.

Depending on the processing involved, our legal basis may be our legitimate interests in operating and improving our business or your consent where consent is required.

Marketing communications

If you subscribe to marketing, we may use your contact information to send you information about:

• products;

• launches;

• promotions;

• offers;

• events;

• VYIR news; and

• other marketing communications.

Where legally required, we send electronic marketing only with your consent.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in our messages.

Unsubscribing from marketing does not prevent us from sending necessary transactional or service communications relating to your account, orders or customer-service requests.

5. Advertising, Remarketing and Conversion Measurement

VYIR uses digital advertising services to promote our products and measure the effectiveness of our advertising.

These services include advertising and measurement technologies provided by companies such as:

• Google, including Google Ads and related advertising and measurement services;

• Meta, including Facebook and Instagram advertising services;

• Pinterest; and

• TikTok.

Subject to your consent where required by applicable law, these providers may use cookies, pixels, tags and similar technologies to collect information about your activity on VYIR.

This information may include:

• pages visited;

• products viewed;

• advertisements viewed or clicked;

• products added to a shopping cart;

• checkout activity;

• purchases;

• transaction value;

• browser and device information;

• IP address;

• identifiers; and

• other interactions with VYIR.

We use these technologies for purposes including:

• measuring advertising performance;

• determining whether advertisements resulted in visits or purchases;

• analysing campaign effectiveness;

• optimising advertising campaigns;

• creating advertising audiences;

• excluding existing customers from certain campaigns;

• creating audiences of people with similar characteristics, where supported by the advertising platform;

• showing advertisements to people who previously interacted with VYIR; and

• personalising advertising.

The practice of showing advertisements to people based on previous visits or interactions with VYIR is commonly referred to as remarketing or retargeting.

For example, if you view a product on VYIR and later visit Facebook, Instagram, Google, Pinterest, TikTok or another participating website or application, you may see an advertisement relating to VYIR or the products you viewed.

Enhanced conversion and matching technologies

We may use enhanced conversion, advanced matching or similar technologies provided by our advertising partners.

These technologies may involve sending certain customer-provided information, such as an email address or telephone number, to an advertising provider in hashed or otherwise protected form.

We may use such functionality provided by platforms including Google, Meta, Pinterest and TikTok for purposes such as:

• matching conversions to advertising interactions;

• improving conversion measurement;

• attribution;

• advertising audience matching;

• measuring advertising performance; and

• improving campaign effectiveness.

For example, we use Google Enhanced Conversions to improve conversion measurement.

Where applicable law requires consent for this processing, we use these technologies only in accordance with the consent choices communicated through our consent-management system.

6. Cookies and Similar Technologies

VYIR and our service providers use cookies and similar technologies to operate, secure and improve the Services.

Cookies and similar technologies may fall into categories such as:

Strictly necessary technologies

These are required for functions such as:

• shopping-cart operation;

• checkout;

• payment processing;

• security;

• account login; and

• remembering privacy choices.

These technologies cannot always be disabled because they are necessary for the website to function.

Analytics technologies

These technologies help us understand how visitors use VYIR, such as which pages are visited, how visitors navigate the website and whether technical problems occur.

Where required by applicable law, analytics technologies are used only after the appropriate consent has been obtained.

Marketing and advertising technologies

These technologies are used for advertising, conversion measurement, audience creation, remarketing, retargeting and advertising personalisation.

They may be provided by companies such as Google, Meta, Pinterest and TikTok.

Where consent is required by applicable law, marketing and advertising technologies are used in accordance with your consent choices.

Managing your choices

When you visit VYIR, you may be presented with a cookie or privacy preference tool that allows you to accept, reject or manage non-essential technologies.

You can change or withdraw your consent at any time using the Cookie Settings or privacy settings available on our website.

Withdrawal of consent does not affect processing that occurred lawfully before consent was withdrawn.

You may also be able to control cookies through your browser settings. Blocking certain cookies may affect the functionality of the Services.

7. Legal Bases for Processing in the EEA and UK

If you are located in the European Economic Area or United Kingdom, we rely on one or more of the following legal bases when processing your personal information.

Performance of a contract

We process information where necessary to fulfil an order, provide the Services or take steps at your request before entering into a contract.

This includes processing necessary for:

• checkout;

• payment;

• fulfilment;

• delivery;

• returns; and

• customer-service matters connected with an order.

Consent

We rely on consent where required, including for certain:

• marketing communications;

• advertising cookies;

• advertising pixels;

• remarketing;

• personalised advertising;

• conversion measurement; and

• similar tracking technologies.

You may withdraw your consent at any time.

Legitimate interests

We may process personal information where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating and improving VYIR;

• protecting our business;

• preventing fraud;

• securing the Services;

• understanding general business performance; and

• providing effective customer support.

Compliance with legal obligations

We may process information where necessary to comply with legal requirements, including accounting, tax, consumer-protection and regulatory obligations.

8. How We Disclose Personal Information

We may disclose personal information to third parties where necessary for the purposes described in this Privacy Policy.

Shopify

Our store is hosted on Shopify.

Shopify processes information relating to your access to and use of the Services in order to provide ecommerce and related services to us and to you.

Information submitted through our store may therefore be processed by Shopify and its service providers.

Shopify may also process information in connection with Shopify features that operate across participating merchants. Where Shopify determines the purposes and means of such processing independently, Shopify may be responsible for that processing under applicable privacy laws.

You can find further information in Shopify's own privacy notices.

Payment providers

We disclose information to payment providers as necessary to process payments, prevent fraud and complete transactions.

Fulfilment and delivery providers

Information may be provided to logistics, fulfilment, postal and delivery providers in order to deliver your order and manage returns.

Technology and service providers

We use vendors that assist us with services such as:

• website hosting;

• IT services;

• data storage;

• analytics;

• email delivery;

• customer support;

• security;

• fraud prevention; and

• business operations.

Advertising and marketing partners

Subject to your consent where required, we may disclose or make information available to advertising and marketing providers including:

• Google;

• Meta;

• Pinterest; and

• TikTok.

These companies may process information received through pixels, tags, cookies, APIs, conversion integrations, audience tools or similar technologies for purposes described in this Privacy Policy.

Depending on the service and processing activity, these providers may act as our service providers/processors or may process certain information as separate or independent controllers under their own privacy terms.

We encourage you to review the privacy information provided by these companies for more information about how they process personal information.

Professional advisers and authorities

We may disclose information to professional advisers, courts, regulators, government authorities or law-enforcement agencies where necessary to:

• comply with applicable law;

• respond to lawful requests;

• establish, exercise or defend legal claims;

• investigate fraud or illegal activity; or

• protect our rights or the rights of others.

Corporate transactions

If Studio October Oy is involved in a merger, acquisition, restructuring, financing, sale of assets, insolvency or similar business transaction, personal information may be disclosed as part of that transaction where permitted by law.

9. International Transfers

Some of our service providers and advertising partners operate internationally.

As a result, personal information may be transferred to or processed in countries outside Finland, the European Economic Area or the country in which you live.

Where personal information protected by the GDPR is transferred outside the EEA to a country that has not been recognised as providing an adequate level of data protection, we use an appropriate transfer mechanism where required.

Such safeguards may include:

• an adequacy decision adopted by the European Commission;

• the European Commission's Standard Contractual Clauses;

• another legally recognised transfer mechanism; and

• supplementary safeguards where appropriate.

International transfers may occur in connection with services provided by Shopify and our technology, analytics and advertising partners.

10. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services and meet legal, accounting, tax and reporting requirements.

The relevant retention period depends on factors including:

• the type of information;

• why the information was collected;

• whether you have an active customer relationship with us;

• applicable statutory retention requirements;

• fraud-prevention requirements;

• dispute-resolution requirements; and

• whether information is necessary to establish, exercise or defend legal claims.

For example, information relating to orders and transactions may need to be retained for a period required under applicable accounting, taxation and consumer-protection laws even after the customer relationship has ended.

Information processed by advertising, analytics and technology providers may be subject to separate retention periods established by those providers.

Where information is no longer required, we will delete or anonymise it where appropriate, subject to applicable legal requirements.

11. Your Privacy Rights

Depending on where you live and applicable law, you may have some or all of the following rights.

Right of access

You may request information about whether we process your personal information and request a copy of personal information we hold about you.

Right to correction

You may request correction of inaccurate or incomplete personal information.

Right to deletion

You may request deletion of personal information in circumstances provided by applicable law.

Right to restriction

You may request that we restrict processing of your personal information in certain circumstances.

Right to object

Where processing is based on legitimate interests, you may have the right to object to that processing based on your particular circumstances.

You may object at any time to processing of your personal information for direct-marketing purposes.

Right to data portability

In certain circumstances, you may request personal information you provided to us in a structured, commonly used and machine-readable format and may have the right to transmit that information to another controller.

Right to withdraw consent

Where processing is based on your consent, you may withdraw your consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Marketing preferences

You may unsubscribe from marketing emails by using the unsubscribe link included in our marketing communications.

You may manage advertising and cookie consent using the Cookie Settings or privacy preference tool available through our website.

Depending on where you live, you may also have additional rights relating to targeted advertising or certain disclosures of personal information.

12. Exercising Your Rights

To exercise a privacy right, please contact us at:

contact@vyir.com

We may need to verify your identity before responding to certain requests.

Where legally permitted, an authorised representative may submit a request on your behalf. We may require evidence that the representative has authority to act for you.

We will respond to valid privacy requests within the timeframe required by applicable law.

We will not discriminate against you for exercising your privacy rights.

13. Complaints

If you have a concern about how we process personal information, we encourage you to contact us first at:

contact@vyir.com

If you are located in the European Economic Area, you also have the right to lodge a complaint with the competent data protection supervisory authority.

As Studio October Oy is established in Finland, the relevant Finnish supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

You may also contact the data protection authority in the EU or EEA country where you live or work or where you believe an infringement occurred.

14. Security

We use reasonable technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, loss, destruction or misuse.

However, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure.

You should take appropriate steps to protect your account credentials and should not share passwords or other authentication information with other people.

15. Children's Privacy

The Services are not directed at children.

We do not knowingly collect personal information from children in circumstances prohibited by applicable law.

If you are a parent or guardian and believe that a child has provided personal information to us improperly, please contact us at contact@vyir.com.

If appropriate and legally required, we will take steps to delete the information.

16. Third-Party Websites and Services

Our Services may contain links to websites, social-media services or online platforms operated by third parties.

We do not control the privacy practices of third-party websites or services.

If you follow a link to another website or interact with a third-party platform, we recommend reviewing that party's privacy notice and terms before providing personal information.

The inclusion of a third-party link does not mean that VYIR is responsible for that third party's privacy or security practices.

17. Relationship With Advertising Platforms

Our use of advertising platforms does not mean that those platforms operate under this Privacy Policy for all of their activities.

Google, Meta, Pinterest and TikTok maintain their own privacy policies describing how they process information within their respective services.

If you use those platforms, your interactions with them may also be governed by their own privacy terms, account settings and advertising preferences.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our Services;

• changes to our use of technology;

• changes to advertising or analytics providers;

• operational changes;

• changes in applicable law; or

• other legal or regulatory developments.

When we update the Privacy Policy, we will change the “Last updated” date at the top of this page.

Where required by law, we will provide additional notice of material changes.

19. Contact Us

If you have questions about this Privacy Policy, our privacy practices or your personal information, or if you would like to exercise your privacy rights, please contact:

VYIR / Studio October Oy
Valtakatu 6
26100 Rauma
Finland

Business ID: 2699115-6
EU VAT number: FI26991156
Phone: +358 400 728 264
Email: contact@vyir.com

For the purposes of applicable data protection laws, Studio October Oy is the controller of personal information processed as described in this Privacy Policy, except where another party acts as an independent controller for its own processing activities.