Privacy policy

Vestelli’s privacy policy

We publish our privacy statement on this page on 25 May 2018

– combined register description and information document

Personal Data Act (523/1999) Sections 10 and 24

From 6 November 2017

1. CONTROLLER OF THE REGISTER

Vestelli Oy (hereinafter Vestelli)

Tonttukaari 9, 10160 Degerby

Phone: switchboard 010 232 7220 (local/mobile rate)

2. COMPANY HANDLING REGISTER-RELATED ISSUES

Chief Executive Officer

Tonttukaari 9, 10160 Degerby

Phone: switchboard 010 232 7220 (local/mobile rate)

3. NAME OF THE REGISTER

Vestelli’s customer register

4. PURPOSE FOR PROCESSING PERSONAL DATA

The general prerequisite for the processing of personal data in accordance with Section 8 of the Personal Data Act is a customer relationship, the customer’s consent, an assignment given by the customer to Vestelli, or the implementation of rights and obligations arising from agreements between Vestelli and the customer as well as from legislation.

The purposes for using customer data in Vestelli’s customer register are:

Serving the customer and the operational management, administration and development of the customer relationship. Management of customer data and customer and contact history. Arranging support and advisory services for the customer as well as managing service measures and ensuring quality.

Implementation, analysis, reporting, development and personalization of Vestelli’s operations, services and payment. Ensuring and managing service and payment transactions. Ensuring the quality and security of operations.

Analysis, forecasting, segmentation and development of customer relationships. Research and statistical analyses. Targeting customer and marketing communications, developing the product and service offering, and developing and reporting on business operations.

Offering and marketing services as well as implementing and monitoring customer and marketing communications. Processing, analyzing and compiling statistics on customer feedback and the results of customer surveys and studies. Managing communication and campaign history.

Customer call recordings are used to verify service transactions, ensure the legal protection of customers and Vestelli, for training purposes, to develop service quality, and to prevent misuse and for security reasons.

5. DESCRIPTION OF THE GROUP OF DATA SUBJECTS AND THE DATA CONTENT OF THE REGISTER

Vestelli’s customer register contains the following information:

– Customer’s basic information

• Name details
• Contact details:
  • Address details
  • Phone number
  • Email address

– Municipality of residence

– Other customer demographic information

– Unique identifiers

– Customer’s unique identifiers:

• Identifiers used in marketing targeting

– Information related to the customer relationship

• Start, end, status and levels of the customer relationship
• Customer’s use of services and contact history
• Direct marketing consents and denials (see section 12)
• Subscriptions to customer and service messages and reminders
• Personalizing information provided by the customer
• Customer segmentation data and other data derived through analytics
• Information from external data sources (see section 6)
• Campaign information and related tracking data
• Information provided in surveys and studies, and discussions
• Customer call recordings
• Customer service transaction information
• Customer feedback
• Participation in Vestelli’s competitions and prize draws

– Sales and payment transaction information

• Service transaction and sales information

Vestelli only retains information that is necessary for Vestelli’s operations and the purposes of data use, and for which there are legal grounds for processing. Information that has become unnecessary for its purpose, outdated information, or information for which there is no longer any basis for processing is anonymized or securely destroyed.

6. ANONYMIZED INFORMATION

In order to develop our online services, we may use third-party analytics tools. Such tools include Google Analytics and Tawk.to. Data collection is automatic, and the data is anonymized during the collection phase. The data collected includes:

• IP address (and country of location)
• User activity in the online service
• Type of device used
• Browser type and language settings
• Referrer information

More information on analytics anonymization: https://support.google.com/analytics/answer/2763052?hl=en

7. USE OF ANALYTICS

We use anonymized analytics regularly for:

• Conducting and targeting market and other research, analyses and reports
• Ensuring usability and functionality, and investigating misuse
• Business planning and product development
• Producing, maintaining, protecting and developing services
• Personalizing services and targeting marketing

8. COOKIES AND OTHER TRACKING TECHNOLOGIES

The online service also contains cookies from third parties, such as measurement and tracking services. Third parties may set cookies on your device in connection with the use of the online services. Third parties may use anonymized information obtained from cookies for targeted advertising in other online services. Our online services may also contain social media plug-ins.

9. RIGHTS OF THE DATA SUBJECT

The data subject has the following rights, requests for the exercise of which must be made in writing and personally signed, or in person, to the address Vestelli Oy, Tonttukaari 9, 10160 Degerby.

Right of access

The data subject may check the personal data we have stored.

Right to rectification

The data subject may request that incorrect or incomplete information concerning him/her be corrected.

Right to object

The data subject may object to the processing of personal data if he/she feels that personal data has been processed unlawfully.

Direct marketing denial

The data subject has the right to deny the use of data for direct marketing.

Right to erasure

The data subject has the right to request the deletion of data if the processing of the data is not necessary. We will process the deletion request, after which we will either delete the data or provide a justified reason why the data cannot be deleted.

It should be noted that the controller of the register may have a statutory or other right not to delete the requested data. The controller of the register has an obligation to retain accounting material for the period defined in the Accounting Act (Chapter 2, Section 10) (10 years). For this reason, accounting-related material cannot be deleted before the expiry of the deadline.

Withdrawal of consent

If the processing of personal data concerning the data subject is based solely on consent, and not, for example, on a customer relationship or membership, the data subject may withdraw consent.

The data subject may appeal the decision to the Data Protection Ombudsman

The data subject has the right to require that we restrict the processing of disputed data until the matter can be resolved.

Right to lodge a complaint

The data subject has the right to lodge a complaint with the Data Protection Ombudsman if he/she feels that we violate current data protection legislation when processing personal data.

Contact details of the Data Protection Ombudsman: www.tietosuoja.fi/fi/index/yhteystiedot.html

10. REGULAR DATA SOURCES

The contact and customer information in the register is obtained from the data subject when a customer relationship or factual contact is established and during it from notifications made by the data subject to the controller of the register. The customer may also provide information via an online form. In addition, personal data may be collected from, among other things, social media related to the controller’s operations, where information about the registered person is available.

Anonymized information is collected using third-party analytics tools, such as Google Analytics and server data.

11. REGULAR DISCLOSURE OF DATA

We have ensured that all our service providers comply with data protection legislation. We do not transfer personal data outside the EU unless the company has joined the Privacy Shield system. We regularly use the following service providers:

Company	Country	If outside the EU	Function	Updated
Pipedrive	Estonia		CRM software	21.04.2018
Google	United States	Privacy Shield	Email, analytics, advertising	21.04.2018
Tawk.to	United States	Anonymized	Chat service	21.04.2018
Facebook	United States	Privacy Shield	Advertising	21.04.2018
Zapier	United States	Privacy Shield	Automation	21.04.2018

12. DURATION OF PROCESSING

• Personal data is generally processed as long as the customer relationship is in force
• The data subject can remove himself/herself from our marketing list via the link in each marketing email we send.
• Anonymized data is retained for 26 months

13. PERSONAL DATA PROCESSORS

Customer data is processed by persons who manage the customer relationship or stakeholder activities. The register is also accessible to employees responsible for maintaining server operations. We may also partially outsource the processing of personal data to a third party, in which case we ensure through contractual arrangements that personal data is processed in accordance with applicable data protection legislation and otherwise appropriately.

14. TRANSFERRING DATA OUTSIDE THE EU

Data is regularly transferred outside the EU or the European Economic Area. When data is transferred outside the EU and EEA, we ensure an adequate level of protection of personal data by, among other things, agreeing on matters related to the confidentiality and processing of personal data as required by law.

15. PROTECTION PRINCIPLES OF THE REGISTER

The register is accessible only to Vestelli Oy employees.
Electronic material:
Only those employees who, by virtue of their work, have the right to process customer data are authorized to use the system containing customer data and to modify customer data. They are bound by confidentiality obligations. Each user has their own username and password for the system. Data is collected in databases that are appropriately protected in accordance with industry standards. The databases and their backups are located in locked and guarded premises, and only certain pre-designated persons have access to the data. In addition to the situations described in these terms, information is disclosed or transferred to external parties only as a result of a statutory obligation to notify, such as at the customer’s own request or at the request of an authority based on law.
Manual material:
Stored in a locked space and only relevant persons have access to it.