This is Lännentila Oy's register and privacy statement in accordance with the EU's General Data Protection Regulation (GDPR). Prepared on May 16, 2024. Last modification on May 16, 2024.
1. Data Controller
Lännentila Oy, 2531220-3
Lännentie 43, 91980 Lumijoki
2. Contact Person Responsible for the Register
Joonas Karjula, joonas.karjula@lannentila.fi, 044 955 5372
3. Name of the Register
Lännentila Oy's Customer and Marketing Register
4. Legal Basis and Purpose of Processing Personal Data
According to the EU's General Data Protection Regulation, the legal basis for processing personal data is the person's consent (documented, voluntary, specific, informed, and unambiguous) a contract to which the data subject is a party the legitimate interest of the data controller (customer relationship prior to a contract, employment relationship).
The purpose of processing personal data is communicating with customers, maintaining customer relationships, and marketing.
The data is not used for automated decision-making or profiling.
5. Data Content of the Register
The data stored in the register includes: the person's name, position, company/organization, contact information (phone number, email address, address), website addresses, network connection IP address, IDs/profiles in social media services, information on ordered products and their changes, billing details, and other information related to the customer relationship and ordered services.
The IP addresses of website visitors and cookies necessary for the functioning of the service are processed on the basis of legitimate interest, among other things, to ensure information security and for the collection of statistical data on website visitors in cases where they can be considered personal data. Consent for third-party cookies is requested separately if necessary.
6. Regular Sources of Information
The data stored in the register is obtained from the customer, for example, through messages sent via web forms, by email, by phone, through social media services, from contracts, customer meetings, and other situations where the customer discloses their data.
The information of contact persons for companies and other organizations may also be collected from public sources, such as websites, directory services, and other companies.
7. Regular Disclosures of Data and Transfer of Data Outside the EU or EEA
Data is not regularly disclosed to other parties. Information may be published to the extent that it has been agreed upon with the customer. Data may also be transferred outside the EU or EEA by the data controller. Data will not be transferred to the United States without the express consent of the data subjects.
If you disclose personal data to different parties, specify here the potential recipients or categories of recipients (including personal data processors/subcontractors), the purposes of processing personal data related to them, and the grounds for transfer if the data is transferred outside the EU.
8. Principles of Register Protection
Diligence is observed in the processing of the register, and data processed using information systems is adequately protected. When register data is stored on internet servers, the physical and digital security of their hardware is appropriately taken care of. The data controller ensures that stored data, as well as server access rights and other critical information regarding the security of personal data, are treated confidentially and only handled by employees whose job description requires it.
9. Right of Access and Right to Request Correction of Data
Every person in the register has the right to check their data stored in the register and demand the correction of any incorrect information or the completion of incomplete information. If a person wishes to check the data stored about them or demand a correction to it, the request must be sent in writing to the data controller. The data controller may, if necessary, ask the requester to prove their identity. The data controller will respond to the customer within the time limit stipulated in the EU Data Protection Regulation (generally within one month).
10. Other Rights Related to the Processing of Personal Data
A person in the register has the right to request the removal of personal data concerning them from the register ("the right to be forgotten"). Likewise, data subjects have other rights in accordance with the EU's General Data Protection Regulation, such as restricting the processing of personal data in certain situations. Requests must be sent in writing to the data controller. The data controller may, if necessary, ask the requester to prove their identity. The data controller will respond to the customer within the time limit stipulated in the EU Data Protection Regulation (generally within one month).
