Zephyrian Oura Ring 4 Sweepstakes Privacy Notice

1. Controller and contact

Korpi Venture Oy, Painikuja 12, FI-70840 Kuopio, Finland (“Korpi,” “Sponsor,” “we”) is the controller for personal information processed to administer the Zephyrian Oura Ring 4 Sweepstakes.

Privacy questions and requests: [email protected]

2. Information we process

Depending on the administration stage, we may process:

• first and last name, personal email address and, if voluntarily provided, an Instagram handle;
• age, residence, exclusion, Official Rules and privacy acknowledgements;
• for purchase entries: the email address on the order, the order identifier, the order date and the months of Zephyrian supply in the order, received from our store systems;
• form, Rules and privacy-notice versions and submission timestamps;
• limited security and anti-abuse signals where lawful;
• correspondence and limited eligibility-verification records for potential winners and alternates;
• prize preference, U.S. shipping address, delivery confirmation and tax records where legally required;
• duplicate-review decisions, drawing records, audit records and limited winner-list information.

Entries can come from the free online entry form, from an eligible purchase (credited automatically per the Official Rules) and from the optional Instagram follow bonus. We process order information to credit, and where required void, purchase entries. No purchase is required to enter or win, and we do not need full payment-card data for Sweepstakes administration.

3. Why we process information

We process personal information to:

• receive and validate free, purchase and bonus entries;
• confirm eligibility and enforce the entry limits stated in the Official Rules;
• detect duplicate, automated, fraudulent or tampered submissions;
• conduct, document and audit the random drawing;
• contact and verify the potential winner and alternates;
• fulfill and document the prize;
• provide limited winner-list information on request or where required by law;
• maintain tax, accounting, legal and security records;
• answer questions, handle privacy requests and resolve disputes;
• send promotional communications about our products and services, as described in Section 4; and
• comply with applicable law.

Where the EU General Data Protection Regulation applies, the principal legal bases are performance of the promotion terms, our legitimate interests in fair and secure administration and in promoting our products and services, and compliance with legal obligations. Consent is used where genuinely optional or legally required, such as optional winner publicity consent.

4. Marketing communications

We may send entrants promotional communications about our products and services, such as product news and offers, using the contact information provided with an entry or order. You may unsubscribe from promotional communications at any time using the unsubscribe mechanism in each message or by contacting [email protected].

Entry is not conditioned on consent to receive marketing. Declining or unsubscribing from promotional communications does not affect eligibility, entries or odds, and unsubscribing does not withdraw an entry. We will continue to send non-promotional Sweepstakes administration messages, such as winner notification, to entrants who have unsubscribed from marketing.

5. Recipients and international processing

We may share only the information reasonably necessary with hosting and security providers, form and data-storage providers, authorized U.S. draw personnel, communications providers, legal and tax advisers, a U.S. retailer or fulfillment provider, and public authorities where legally required.

Korpi is located in Finland. Information submitted in the United States may therefore be transferred to and processed in Finland and in other jurisdictions where approved service providers operate. We use contractual, organizational and technical safeguards appropriate to the service and applicable law.

We do not sell Sweepstakes personal information or share it for cross-context behavioral advertising.

6. Retention

We retain entry, eligibility, duplicate-review, drawing and administration records for up to three years after the Sweepstakes closes, unless a longer period is reasonably needed for a dispute, investigation or legal hold. Short-lived security and anti-abuse signals are deleted or de-identified sooner when no longer needed. Winner fulfillment, accounting and tax records may be retained for the period required by applicable tax and accounting law. At the end of the applicable period, information is securely deleted or irreversibly de-identified unless a documented legal hold applies.

7. Rights and choices

Depending on where a person lives and which law applies, the person may have rights to request access, correction, deletion, restriction, objection or portability; withdraw consent where processing relies on consent; and appeal or complain to a regulator. We do not discriminate against a person for exercising a privacy right.

Some information may be retained or processing may continue where reasonably necessary to preserve Sweepstakes integrity, complete winner verification or fulfillment, comply with law, prevent fraud or establish or defend legal claims.

Submit a request to [email protected]. We may request proportionate information to verify the requester’s identity. Do not send government identifiers or identity documents through ordinary email unless we provide an approved secure method.

8. Security

We use reasonable administrative, technical and organizational safeguards appropriate to the information and risk, including access controls, encryption in transit, restricted administration access and separation of entry information from drawing records. No internet or storage system is completely secure.

9. Children

The Sweepstakes is open only to people who are at least 18 years old. It is not directed to children, and we do not knowingly accept entries from children.

10. Changes

We will not make a retroactive material change affecting an open Sweepstakes without appropriate legal review and any required notice or consent. Published versions are dated and archived.

Effective date: August 10, 2026
Version: 2.0. Supersedes Version 1.0.