Privacy policy for the marketing and communication register

1. Data controller

Kaarea Oy (2925981-7)
PL 180, 20101 Turku, Finland
Other contact details: www.kaarea.fi, tel. switchboard +358 20 764 9850

2. Contact person for matters concerning the register

Teija Silver
Postal address: PL 180, 20101 Turku, Finland
Visiting address: Lemminkäisenkatu 48, 20520 Turku, Finland
Email: teija.silver@kaarea.fi , tel. switchboard +358 20 764 9850

3. Name of the register

Kaarea’s marketing and communication register

4. Purposes and legal basis for processing personal data

Personal data is processed within the limits permitted by law for the marketing and direct marketing of our services, to improve communication and identify potential customers, to handle and respond to inquiries, for opinion or market research, and to monitor the use of our services.

The processing of personal data is based on the consent of the data subject, a customer contract, or Kaarea’s legitimate interest.

5. Legitimate interests of the data controller or a third party

Kaarea has a legitimate interest in marketing and communicating about its services to the data subjects.

6. Data content of the register

The register contains the following information about the data subjects: last name, first names, postal address, telephone number, email address, title or position, IP address, user ID, name of the company represented by the data subject and the company’s contact and address details, and mailing lists. In addition, the register may contain information related to the provision, purchase, use and development of services, as well as marketing and sales, and other information relevant to the management or development of the customer relationship, as well as media recordings such as images or videos. Media recordings can be used indefinitely or for the period agreed upon in the contract.

7. Regular sources of information

Personal data is obtained from the data subject or from the company represented by the data subject upon registration for a service or participation in marketing campaigns and events organised by Kaarea. The sources of information also include Kaarea’s employee register. Data is also collected from publicly available sources and from registers maintained by external service providers, such as publicly accessible online sources.

8. Recipients of personal data

Kaarea’s own personal data processors who require access to personal data to perform their tasks. In addition, data may be disclosed to service providers who process personal data on behalf of Kaarea in accordance with confidentiality obligations and contractual data protection obligations.

Personal data may also be disclosed within the limits permitted and required by applicable law, for example to authorities that have the right to access the data.

9. Transfers to third countries and related safeguards

No data will be transferred outside the EU/EEA.

10. Data retention period and applicable retention criteria

Personal data is retained for as long as necessary for the purposes for which it was collected, but for a maximum of 10 years after the person’s last use of our services, or until they withdraw their marketing consent.

11. Principles of data protection

Access to the register’s data is restricted to certain individuals to the extent required by their duties.

The data processed in information systems is protected from external use by means of information network access rights and user-specific access rights. IT equipment is located in secure and monitored facilities.

Manually processed data is retained under supervision in files or filing systems and stored in locked cabinets with restricted and monitored access.

12. Rights of the data subject

The data subject has the right to access, correct, and request the erasure of their personal data in accordance with Kaarea’s data protection principles. The data subject may, at any time and on grounds relating to their particular situation, object to the processing of personal data concerning them. Requests for objection must be addressed in writing to the contact person for the register.

13. Automated decision-making and profiling

No automated decision-making is performed based on the data in the register. Data subjects are profiled, and personal data is used to identify customer needs and target communications.