Privacy policy

Privacy Notice – Finnish Personal Data Act (523/99), Section 10

Updated 11 June 2024

  1. Data controller: Kirjalan Kahvipaahtimo Oy, Business ID 3322751-9, Pihlasniementie 53, 52330 Heimari, Finland.
    Person responsible for register matters: Väinö Siitari, Kirjalan Paahtimo, tel: +358 40 0685 877, email: vaino@kirjalan.fi
  2. Name of the register: Kirjalan Kahvipaahtimo customer register
  3. Purpose of processing personal data: Personal data is processed for purposes related to managing, administering, and developing the customer relationship, providing and delivering services, and developing services and billing. Personal data is also processed for purposes required to investigate possible complaints and other claims. In addition, personal data is processed in communications directed at customers, such as for information and news purposes and marketing, which includes processing personal data for direct marketing and electronic direct marketing purposes. The customer has the right to prohibit direct marketing directed at them. The data controller processes data itself and also uses subcontractors acting on behalf of and for the data controller in the processing of personal data.
  4. Legal bases for processing: The legal bases for processing personal data are the following grounds under the EU General Data Protection Regulation (hereinafter also “GDPR”): the data subject has given consent to the processing of their personal data for one or more specific purposes (GDPR Art. 6(1)(a)); processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (GDPR Art. 6(1)(b)); processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (GDPR Art. 6(1)(f)). The aforementioned legitimate interest of the controller is based on the relevant and appropriate relationship between the data subject and the controller that arises from the data subject being a customer of the controller, where processing takes place for purposes the data subject could reasonably expect at the time the personal data were collected, and in the context of that appropriate relationship.
  5. Data content of the register (categories of personal data processed): The register generally contains the following personal data about all data subjects: basic personal and contact information (first name, last name, address, telephone number, email address); information related to the person's company or other organization, and the person's position or job title in that company or organization; the person's direct marketing permissions and prohibitions.
  6. Regular sources of data: Personal data is collected from the data subject themself. Personal data is also collected and updated, within the limits of applicable legislation, from generally available sources related to carrying out the customer relationship between the controller and the data subject, which help the controller fulfil its obligations related to maintaining customer relationships.
  7. Retention period of personal data: Data collected in the register is retained only for as long as, and to the extent, necessary in relation to the original or compatible purposes for which the personal data was collected. The need to retain personal data is assessed annually, and in any case data concerning a given data subject is deleted from the register six years after that data subject's customer relationship with the controller has ended and the obligations and actions related to the customer relationship have been completed. For example, accounting vouchers are retained for six years from the end of the financial year. The controller regularly assesses the necessity of retaining data in accordance with its internal policies. In addition, the controller takes all reasonable steps to ensure that personal data that is inaccurate, incorrect, or outdated in relation to the purposes of processing is erased or rectified without delay.
  8. Recipients (categories of recipients) of personal data and regular disclosures of data: Personal data is not disclosed to external parties.
  9. Transfer of data outside the EU or EEA: Personal data contained in the register is not transferred outside the EU or EEA.
  10. Principles of register protection: Materials containing personal data are stored in locked premises monitored by alarms, accessible only to named individuals authorized to access them due to their duties. The database containing personal data is on a server kept in a locked facility accessible only to named individuals authorized to access it due to their duties. The server is protected by an appropriate firewall and technical safeguards. Databases and systems can only be accessed with separately granted personal user credentials and passwords. The controller has restricted access rights and permissions to information systems and other storage platforms so that only persons necessary for their lawful processing can view and process the data. In addition, usage events in the databases and systems are logged in the controller's IT system logs. The controller's employees and other individuals have committed to observing confidentiality obligations and to keeping secret any information obtained in connection with the processing of personal data.
  11. Rights of the data subject: The data subject has the following rights under the EU General Data Protection Regulation: the right to obtain confirmation from the controller as to whether personal data concerning them is being processed, and if so, access to the personal data and the following information: (i) the purposes of processing; (ii) the categories of personal data concerned; (iii) the recipients or categories of recipients to whom the personal data have been or will be disclosed; (iv) where possible, the envisaged retention period of the personal data, or if not possible, the criteria used to determine that period; (v) the data subject's right to request from the controller rectification or erasure of personal data, or restriction of, or to object to, processing of such personal data; (vi) the right to lodge a complaint with a supervisory authority; (vii) where personal data is not collected from the data subject, any available information as to their source (GDPR Art. 15). These basic details (i)–(vii) described above are provided to the data subject via this notice; the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (GDPR Art. 7); the right to require the controller to rectify, without undue delay, inaccurate or incorrect personal data concerning them, and the right to have incomplete personal data completed, including by providing a supplementary statement, taking into account the purposes for which the data was processed (GDPR Art. 16); the right to obtain from the controller erasure of personal data concerning them without undue delay, provided that (i) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; (ii) the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; (iii) the data subject objects to processing on grounds relating to their particular situation and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes; (iv) the personal data has been unlawfully processed; or (v) the personal data must be erased to comply with a legal obligation under Union or national law to which the controller is subject (GDPR Art. 17); the right to have the controller restrict processing where (i) the data subject contests the accuracy of the personal data, for a period enabling the controller to verify its accuracy; (ii) the processing is unlawful and the data subject opposes erasure of the personal data and requests restriction of their use instead; (iii) the controller no longer needs the personal data for the purposes of processing, but it is required by the data subject for the establishment, exercise, or defence of legal claims; or (iv) the data subject has objected to processing on grounds relating to their particular situation, pending verification whether the controller's legitimate grounds override those of the data subject (GDPR Art. 18); the right to receive personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format, and the right to transmit that data to another controller without hindrance from the controller to whom the personal data was provided, where the processing is based on consent within the meaning of the Regulation and is carried out by automated means (GDPR Art. 20); the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data concerning them infringes the EU General Data Protection Regulation (GDPR Art. 77). Requests concerning the exercise of the data subject's rights should be addressed to the controller's contact person named in section 1.