News and event letter register privacy policy

This privacy policy applies to the processing of personal data in the Finnish Commerce Federation’s News and event letter register.

1. Data controller

The Finnish Commerce Federation is the data controller and is responsible for the processing of personal data. You can contact the controller in the following ways:

tietosuoja@kauppa.fi
tel. +358 9 1728 5151
Eteläranta 10, PL 340, FI-00131 HELSINKI, FINLAND

2. What information do we process?

Name and e-mail address.
Information about opening e-mails and clicking on links in them.
Your consent to receive marketing communications by e-mail.
Information about a cancellation notice you make.

Personal data have been obtained from the data subject themself.

3. For what purposes is your personal data processed?

The purposes of the processing of personal data and the data retention period for each purpose are described below. We process personal data based on your consent.

Purpose of processing
Electronic communicatiions and news as well as electronic direct marketing

Processed categories of personal data
Name, e-mail address, consent, information about openings and clicks,

In addition, we may process personal data in order to comply with a legal obligation under the statute of limitations or when the processing is necessary to prepare, file or defend a legal claim.

4. Data retention period

The personal data (name, e-mail) of the subscriber of the News and event letter are processed for marketing communication, information and news purposes until the order is cancelled. Information about the cancellation of the News and event letter subscription (consent, unsubscription) is transferred to the Cancelled list. In this way, we can technically ensure that the person no longer receives membership newsletters. The need to use the personal data in the Cancelled list is assessed regularly, generally on an annual basis. Personal data can be completely removed from the list upon request.

5. Your right to withdraw consent

You can withdraw your consent by clicking the Cancel subscription button at the end of the newsletter. You can also contact the Data controller directly and request the deletion of your personal data. Your personal data will be removed from the mailing lists immediately upon cancellation of the subscription and will be moved to the Cancelled list.

6. What other rights do you have?

You have the right to know, at your request, whether the Data controller processes your personal data. If we process your personal data, you have the right to receive a copy of the information we process. If we do not process your personal data, you have the right to receive confirmation of this as well.
You have the right to demand rectification or supplement of your personal data that is incorrect or incomplete in terms of processing
You may have the right to have the controller erase your personal data in certain situations covered by the Regulation. We will erase the personal data at your request if the criteria set out in the legislation are met.

According to the Regulation, you have the right to have the Data controller erase your personal data from our system if

(a) your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; or

(b) you have withdrawn your consent on which the processing was based and there is no other legal basis for the processing; or

(c) you object, referring to personal reasons, to processing that is necessary for implementing the legitimate interests of the Data controller or a third party, such as profiling;

In this case, the Data controller may no longer process the personal data unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or if it is necessary for the establishment, exercise or defence of a legal claim.

(d) your personal data have been processed unlawfully;

(e) your personal data have to be erased to meet a statutory obligation arising from EU or Member State law to which the Data controller is subject;

(f) the personal data have been collected from a child in relation to the offer of information society services.

You may have the right to restrict the processing of your personal data. We will limit the processing of your personal data at your request in the case of situations defined by law.

You may restrict the processing of your personal data if

(a) you contest the accuracy of your personal data, in which case the processing is restricted for the period during which we are able to verify the accuracy of the personal data;

(b) the processing is unlawful and you object to the deletion of personal data and request the restriction of its use instead;

(c) the personal data in question is no longer required by the Data controller for the purposes of the processing, but are required by the data subject for the establishment, exercise or defence of a legal claim; or

(d) you have objected, on grounds relating to personal reasons, to processing that is necessary for either the performance of a task concerning the public interest or in the exercise of official authority vested in the Data controller or in implementing the legitimate interests of the Data controller or a third party pending the verification whether the legitimate grounds of the controller override your legitimate grounds.

If the processing of your personal data is restricted, the personal data shall, with the exception of storage, only be processed with your consent; or to establish, exercise or defend a legal claim; or protect the rights of another natural or legal person; or for reasons of important public interest of the EU or of a Member State.

In certain situations, you have the right to receive the personal data we hold and have it transmited to you or to another data controller. The right applies to such personal data that you have provided to us yourself and that we process with your consent or in order to carry out an agreement to which you are a party. The right applies to data that is processed by means of automatic data processing. Some of the information is in hard copy and the right does not apply to such documents.
You may have the right to object to the processing of your personal data. We will no longer process your personal data at your request in the case of situations defined by law.

You can object to the processing of your personal data

(a) that is necessary for implementing the legitimate interest of the controller or a third party, such as profiling, referring to personal reasons;

(b) at any time, if your personal data are processed for the purpose of direct marketing, including profiling, where it relates to such direct marketing.

7. How do you exercise your rights?

You can send us a request to exercise your rights by filling out the form on our website and sending it to us signed either by e-mail or by mail to the Data controller’s address.

If the response contains your personal data, we will primarily provide the information by mail as a registered letter. The letter cannot be acknowledged as received by anyone other than the person marked as the recipient. This will ensure the confidentiality of the data of the correct recipient of the letter.

8. About the recipients of personal data

The Finnish Commerce Federation, as the Data controller, processes personal data itself but also uses various service providers. The Finnish Commerce Federation strives to use the best and most reliable partners and is responsible for the activities of the service providers of its choice when processing personal data.

Our service provider may transfer personal data outside the EU or the European Economic Area when the service provider is established outside these territories. In these cases, we will take appropriate safeguards to ensure the rights and freedoms of the data subjects.

Some authorities also have a statutory right of access to information. Such authorities include, for example, the police, the customs, the border guard and tax authorities.

9. Appeal instructions

If you feel we are not processing your personal data in accordance with the EU’s General Data Protection Regulation, you can file a complaint with the supervisory authority in the EU Member State where you have your permanent address or workplace or where you believe the breach has taken place. In Finland, this authority is the Data Protection Ombudsman.

10. Personal data necessary for the service

In order to provide you with the News and event letter, we need to process certain necessary personal data. Such information is the personal data described in section 3.

Consent to electronic direct marketing is not necessary, but without consent, we cannot provide you with electronic direct marketing communications.

11. Use of personal data for other purposes

We will not use your personal data for purposes other than those stated in this document. If new needs for use arise later, we will inform you and provide you with the legal processing criteria for the processing of your personal data or, if necessary, we will ask you for your consent to the processing of your personal data for new uses.