Gebwell Ltd. stores and processes personal data in accordance with the EU General Data Protection Regulation (GDPR).
We may periodically update this privacy statement by publishing a new version on our website. For this reason, we recommend that you revisit the privacy statement regularly.
Business ID 2008956-7
FI-79100 Leppävirta, Finland
Tel. +358 20 1230 800
2 Contact person for register matters
Saima Havukainen, email@example.com, +358 400 897 791
3 Data Protection Officer
The Data Protection Officer for Gebwell Ltd. is Jarmo Poimela, firstname.lastname@example.org, +358 400 897 292.
4 Name of register
Gebwell Ltd. marketing register
5 Legal basis and purpose of processing personal data
We collect personal data for a specific, explicit and lawful purpose. Data stored in the register are collected by means of telemetry and with the consent of our customers and stakeholders. Consent from customers and stakeholders has been requested with separate forms that by which they have given their truthful and genuine consent. The data are collected for processing in connection with customer relationships.
The marketing register may be used for the following purposes:
- management and development of the customer relationship,
- provision of services,
- verification of customer transactions,
- development of customer service and business operations,
- customer communications,
- marketing activities,
- analyses and statistics,
- opinion polls and market studies and other similar uses.
We process personal data within the limits and requirements of the Finnish Personal Data Act and Data Protection Act.
Data subjects have been informed of profiling activities and it has been made expressly clear that data subjects may revoke consent to profiling at any time. Personal data are collected in accordance with this privacy statement and are not, in any circumstances, processed, altered or transferred in a manner other than those specified herein. We collect personal data only in a manner that is agreed in advance and made clear to customers and stakeholders before collecting the data and only after they have demonstrably consented to the collection and processing.
6 Data content of the register
The register may contain the following personal data of customers and potential customers:
- contact details, such as name, address, telephone numbers and email addresses
- date of entry into the register
- native language
- information on the customer relationship, such as billing and payment details, product and order information, customer feedback and communication
- information on responses to prize draws and competitions and cancellation information
- information supplied by the customer related to profiling and interests
- permissions and consents
- information on marketing restrictions
- other information supplied by the customer or stakeholder to Gebwell Ltd.
7 Regular sources of data
Our regular sources of personal data are from data subjects themselves via telephone, forms available on our website, email or other similar means, such as by filling in a prize draw entry ticket.
If you do not want us to collect the aforementioned information via cookies, most browsers allow you to disable and delete cookies. However, please note that cookies may be necessary for the proper functioning of some of our webpages or services.
8 Regular disclosures of personal data
At the controller’s discretion, personal data may be disclosed to our partners within the limits of applicable legislation, unless the data subject has objected to the disclosure of data. We disclose data to our partners only for purposes that support the aims of the register.
We disclose personal data to third parties with restrictions. In practice, this means the following:
- We use tools for email marketing. These tools store your name, company, domicile and email address.
- We use a tracking tool for offer requests that stores your name, address, phone number and email address.
- We supply our equipment via retailers. We forward offer requests submitted via our website or by other means to the nearest retailer. We require that our retailers comply with the requirements of the EU GDPR.
- We use a survey tool that stores your name and email address and contact details that you provided when participating in a prize draw, for example.
9 Transfers of data to third countries or international organisations
Some of the services we use operate outside the EU member states or the European Economic Area. In transferring personal data to external services, we comply with the requirements of data protection legislation and the principles of data minimisation and risk mitigation. We only use companies committed to complying with the requirements of the EU GDPR.
10 Principles of register protection
Manual data is collected in the form of prize draw tickets or offer request forms, for example. After storing it in the electronic filing system, the manual data is destrLtd.ed with a shredder.
Gebwell Ltd. protects the personal data register described in this privacy statement in accordance with the results of a risk assessment on the required level of security. The Data Protection Officer takes part in the risk assessment process and issues an impartial opinion on the final decision for data protection with which Gebwell Ltd. shall comply. In protecting the personal data register, Gebwell Ltd. takes into account technical security and organisational and technical requirements.
Systems that store the personal data of customers may only be used by emplLtd.ees entitled to process the data as part of their duties. Each user is issued a unique username and password to the system. Access to the work premises is monitored by access permits. The data are collected into databases that are protected by firewalls, passwords and other technical measures. The databases and their backups are located in locked spaces and accessible only to specific individuals designated in advance.
11 Right of access and objecting to processing
Data subjects have the right to access and view their personal data stored in the register. In addition, after submitting a sufficiently precise and individualised request for access, data subjects have the right to receive their personal data stored in the filing system. Requests for access must be made in writing and signed to the following address:
FI-79100 Leppävirta, Finland
Data subjects have the right to object to the processing of their personal data for the purposes of direct advertising, distance selling and other direct marketing, as well as market research or opinion polls.
In matters related to objections and rectifications, data subjects may contact our customer service by phone at +358 20 1230 800 or by mail at the address listed in section 1.
We will erase personal data upon the data subject’s request unless otherwise required by legislation, pending invoices or debt collection measures.
12 Right to rectification and erasure
The controller must rectify inaccurate personal data that the data subject has brought to its attention. The controller is also obligated to verify the appropriateness and accuracy of its stored personal data. Data subjects also have the right to request that their personal data is erased from the register. The erasure is overseen by the Data Protection Officer.
13 Other rights related to processing of personal data
Data subjects have the right to restrict the processing of personal data. Data subjects also have the right to receive personal data that they have provided to the controller in a structured, commonly used and machine-readable format and the right to transfer the data to another controller. In addition, data subjects have the right to object to processing and to automated decision-making and profiling.
14 Erasure of data and retention period
Gebwell Ltd. will erase the personal data of customers from its register once processing is no longer justified from a business perspective or if the data subject requires that Gebwell Ltd. erase their personal data under legal grounds. The data are erased by overwriting once a basis for their processing or storage no longer exists. However, the data will not be erased if provided otherwise by law or if a competent authority has initiated a process that requires Gebwell Ltd. to retain the data or another party has applied Finnish courts for a ruling to retain the data.
15 Approval of the privacy statement
This privacy statement has been reviewed and approved as valid until further notice on 25 May 2018.