Privacy policy

The data collected in the register is stored only for as long and to the extent necessary in relation to the original or compatible purposes for which the personal data was collected.

We retain data for the period required to fulfill the purposes stated in this privacy notice. If a customer account is deemed inactive, we will delete the personal data associated with it no later than five years after the last activity. Some data may be retained for a longer period if required by law—for example, accounting records are stored for six years after the end of the financial year.

The data controller regularly assesses the necessity of storing data in accordance with its internal policies. Additionally, the controller will take all reasonable steps to ensure that inaccurate, incorrect, or outdated personal data is deleted or corrected without delay.

8. Recipients (or Categories of Recipients) of Personal Data and Regular Disclosures

In some cases, we may need to transfer data to third parties for purposes such as storage, analytics, or marketing. We only use trusted partners for these purposes, with whom we have comprehensive data protection and data processing agreements. These agreements ALWAYS comply with applicable legislation and the requirements of the EU General Data Protection Regulation (GDPR).

Only the information necessary for providing the service is shared with each partner, and these service providers are not allowed to use your data for any purpose other than the provision of the agreed service. All data transfers are carried out over encrypted connections.

We ensure that all our service providers comply with data protection legislation. We regularly use the following service providers:

• Posti
• Matkahuolto
• Vipps MobilePay, collects the IP address, payment method, and time of transaction.
• Klarna, collects the IP address, payment method, and time of transaction.
• Meta (manages Facebook ad preferences)
• Unifaun
• Google (e.g., Analytics)

   

9. Transfer of Data Outside the EU or EEA

We conduct online marketing and advertising using services provided by, for example, Google and Meta. These companies do not receive personal data from us, and the marketing is not direct marketing. However, personal data is protected in accordance with data protection laws. Online marketing is based on cookies collected by your browser, as described in the section on cookies. 

Google and Meta are U.S.-based companies, which means that personal data may be transferred outside the European Union. These companies are certified under the EU-U.S. Privacy Shield Framework and comply with the EU General Data Protection Regulation. 

10. Principles of Register Protection

Materials containing personal data are stored in locked premises accessible only to designated persons authorized to access the data due to their duties.

Henkilötietoja sisältävä tietokanta on palvelimella, jota säilytetään lukitussa tilassa, johon on pääsy ainoastaan nimetyillä ja tehtäviensä vuoksi pääsyyn valtuutetuilla henkilöillä.  Palvelin on suojattu asianmukaisella palomuurilla ja teknisellä suojauksella.

Access to databases and systems is granted only through individually assigned usernames and passwords. The data controller has restricted access and permissions in systems and other storage platforms so that only individuals who need the data for lawful processing may access and process it. All access events are logged in the controller’s IT system.

Employees and other persons acting on behalf of the controller are bound by confidentiality obligations and must keep all personal data obtained during processing confidential.

11. Rights of the Data Subject

Under the EU General Data Protection Regulation, data subjects have the following rights:

1. Right of access to confirm whether personal data concerning them is being processed and, if so, to access that data and receive information about: (i) the purposes of processing; (ii) the categories of personal data; (iii) recipients or categories of recipients to whom the data has been or will be disclosed; (iv) where possible, the envisaged period for which the data will be stored, or, if not possible, the criteria used to determine that period; (v) the right to request correction or erasure of personal data, or restriction of processing, or to object to processing; (vi) the right to lodge a complaint with a supervisory authority; (vii) where the data is not collected from the data subject, any available information as to its source (Article 15 GDPR). These details (i–vii) are provided in this document.
2. Right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (Article 7 GDPR);
3. Right to rectification, meaning the right to have inaccurate or incorrect personal data corrected without undue delay and the right to have incomplete personal data completed (Article 16 GDPR);
4. Right to erasure, i.e., to have personal data deleted without undue delay, under certain conditions, such as: (i) data is no longer necessary for the purposes for which it was collected; (ii) consent is withdrawn and there is no other legal ground for processing; (iii) the data subject objects and there is no overriding legitimate interest; (iv) the data was processed unlawfully; or (v) the data must be erased to comply with legal obligations (Article 17 GDPR);
5. Right to restriction of processing, for example: (i) if the accuracy of the data is contested; (ii) processing is unlawful but the data subject opposes erasure; (iii) the data is no longer needed for processing but is required by the data subject for legal claims; or (iv) the data subject has objected pending verification of legitimate grounds (Article 18 GDPR);
6. Right to data portability, meaning the right to receive personal data in a structured, commonly used, and machine-readable format and to transfer that data to another controller where processing is based on consent and carried out by automated means (Article 20 GDPR);
7. Right to lodge a complaint with a supervisory authority if the data subject believes that the processing of personal data violates the GDPR (Article 77 GDPR).

Requests concerning the exercise of these rights should be addressed to the contact person mentioned in Section 1.