Register and Privacy Statement

Register and Privacy Statement

This is Nils Master's registration and data protection statement in accordance with the EU General Data Protection Regulation (GDPR). Version 3.5.2024.

1. Registrar

Contact person:

CEO Lauri Kuusisto

2. Name of the register

Finlandia-uistin Oy's customer, marketing and online service user register.

3. Legal basis and purpose of personal data processing

According to the EU General Data Protection Regulation, the legal basis for processing personal data is the consent of the person and the legitimate interest generated by the customer relationship. We process your personal data for managing, managing and developing the customer relationship. We also need your personal data to implement our services, such as delivering your orders and invoicing.

We also process personal data to implement customer communication, for example when announcing a product withdrawal and when delivering order and delivery confirmations, as well as communicating in connection with exchange and return situations. In addition, we use your personal data for direct marketing and other marketing as well as market and opinion research, including electronic direct marketing if the person has consented to it.

We also organize raffles and competitions, for the implementation of which we process your personal data. In addition to these, we process your data to offer discounts and benefits and to investigate complaints, error situations and other disruptions.

The information is not used for automated decision-making or profiling.

4. Data content of the register

Information stored in the register includes: first and last name, contact information (phone number, e-mail address, address), information about orders, their contents, tracking information and order history, other information related to the customer relationship and ordered services or products, such as complaints and feedback. Direct marketing permits and prohibitions.

We store order information and information collected in connection with customer service for six (6) years from the end of the calendar year in which you last shopped in our online store or dealt with our customer service. If you have subscribed to our newsletter, we will store your personal data as long as the subscription to the newsletter is valid.

If you cancel the subscription to the newsletter, i.e. cancel your consent to sending electronic direct marketing, we will stop delivering the newsletter to you without undue delay, but after cancellation we will retain information about the marketing ban as long as your personal data is processed for other purposes, for example based on transactions in an online store.

5. Regular sources of information

We collect information to be stored in the register from you when you provide information when shopping in the Nils Master online store. You can provide information about yourself, for example, when filling out the order form. We also collect personal data in connection with campaigns and customer service situations and when you subscribe to our newsletter.

6. Regular transfers of data and transfer of data outside the EU or EEA

We hand over personal data within the limits permitted and required by the legislation in force at any given time, and we share customer data only with those third parties who produce services on our behalf and are our partners, such as payment service providers and transport companies. When necessary, we also hand over personal data to entities that according to legislation have the right to access the data, such as the competent authorities.

We regularly transfer personal data outside the EU and EEA to the United States to the service provider producing our newsletter. Our service provider belongs to the Privacy Shield arrangement, which means that our service provider is committed to complying with the level of data protection applied in EU countries.

7. Principles of registry protection

Care is taken when processing the register and the information processed with the help of information systems is properly protected. When registry data is stored on internet servers, the physical and digital data security of their hardware is taken care of accordingly. The registrar ensures that stored data as well as server access rights and other data critical to the security of personal data are handled confidentially and only by those employees whose job description it is.

Through contractual means, we have also ensured that the partners who process personal data for our chapter are committed to protecting personal data also with regard to the actions of their own employees. Material in manual form is stored in locked offices used by Finlandia-uistin Oy.

8. Right of inspection and right to demand correction of information

Every person in the register has the right to check their information stored in the register and demand the correction of any incorrect information or the completion of incomplete information. If a person wants to check the information stored about them or demand correction, the request must be sent in writing to the controller. If necessary, the registrar may ask the requester to prove his identity. The controller responds to the customer within the time stipulated in the EU data protection regulation (generally within a month).

We may charge a reasonable fee based on administrative costs if you request multiple copies or if you make repeated requests. We cannot give you information that could reveal trade secrets or violate the rights or freedoms of another person. For example, we will not disclose other people's personal data despite your request.

10. Other rights related to the processing of personal data

A person in the register has the right to request the removal of personal data about them from the register. Data subjects also have other rights according to the EU General Data Protection Regulation, such as limiting the processing of personal data in certain situations. Requests must be sent in writing to the controller. If necessary, the registrar may ask the requester to prove their identity. The controller responds to the customer within the time stipulated in the EU data protection regulation (generally within a month).