Privacy policy for the feedback register

1. Data controller

Kaarea Oy (2925981-7)
PL 180, 20101 Turku, Finland
Other contact details: www.kaarea.fi, tel. switchboard +358 20 764 9850

2. Contact person for matters concerning the register

Riikka Samuli
Postal address: PL 180, 20101 Turku, Finland
Visiting address: Lemminkäisenkatu 48, 20520 Turku, Finland
Email: riikka.samuli@kaarea.fi , tel. switchboard +358 20 764 9850

3. Name of the register

Kaarea’s feedback register

4. Purposes and legal basis for processing personal data

The purpose of the feedback channels is to provide an opportunity to contact us and give feedback on Kaarea’s operations, which can be used to develop our business and processes and review quality. The feedback channels ask for the contact details of the person sending the feedback so that it can be processed, but messages can also be sent anonymously.

The legal basis for processing personal data is the consent given by the data subject to the processing of their personal data for this purpose or the legitimate interest of the data controller.

5. Legitimate interests of the data controller or a third party

The data controller has a legitimate interest in processing personal data obtained through feedback channels in accordance with the requirements of the feedback process defined by Kaarea.

6. Data content of the register

Only information provided by the data subject via the feedback channels and any attachments to the data subject’s feedback are stored in the feedback register. The feedback register contains the following information: first and last name, street address, postal code, city, email address, telephone number, message, any personal data contained in the message, and the desired method of contact.

7. Regular sources of information

The information stored in the register primarily comes from the person giving feedback, i.e., the data subject. Feedback can be sent through email or the online store, for example.

8. Recipients of personal data

Kaarea’s own personal data processors who require access to personal data to perform their tasks. Personal data may also be disclosed within the limits permitted and required by applicable law, for example to authorities that have the right to access the data.

9. Transfers to third countries and related safeguards

No data will be transferred outside the EU/EEA.

10. Data retention period and applicable retention criteria

Personal data is retained for up to 2 years after the feedback has been fully processed.

11. Principles of data protection

Access to the register’s data is restricted to certain individuals to the extent required by their duties. All individuals who use the register’s data have signed a confidentiality agreement and are bound by confidentiality obligations.

The data processed in information systems is protected from external use by means of information network access rights and user-specific access rights. IT equipment is located in secure and monitored facilities.

12. Rights of the data subject

The data subject has the right to access, correct, and request the erasure of their personal data in accordance with Kaarea’s data protection principles. The data subject may, at any time and on grounds relating to their particular situation, object to the processing of personal data concerning them. Requests for objection must be addressed in writing to the contact person for the register.

13. Automated decision-making and profiling

The register does not involve automated decision-making or profiling.