Controller
Toolcat Oy (1059567-7)
Kalustetie 1
01720 Vantaa
Contact person for matters concerning the register
Pauli Parkkinen
Kalustetie 1
01720 Vantaa, Finland
+358 44 270 3795
pauli.parkkinen@toolcat.fi
Purpose of processing personal data
The purpose of the register is to maintain the organisation’s customer register, to manage, archive and process customers’ orders, and to manage the customer relationship. The data may be used for developing operations, for statistical purposes and for producing more personally targeted content in our online services.
Personal data is processed within the limits permitted and required by the General Data Protection Regulation. The data in the register may be used in the organisation’s own registers, for example for targeting advertising, without disclosing personal data to external parties.
The organisation may use partners to maintain the customer and service relationship, in which case parts of the register data may be transferred to the partner’s servers for technical reasons. The data is processed only for maintaining the controller organisation’s customer relationship through technical interfaces. The organisation has the right to publish data contained in the customer register as an electronic or written list, unless the customer specifically prohibits this. In this case, a list means e.g. mailing labels for direct advertising or similar. The customer has the right to prohibit publication of the data by notifying the controller’s customer service by email (myynti@toolcat.fi) or the register’s contact person. The legal basis for processing is a contract.
Basis of legitimate interest
The legal basis for processing is a contract.
Categories of personal data concerned
- Name
- Organisation represented
- Contact details
- Invoicing details
Recipients and categories of recipients
The controller’s own staff and outsourcing partners (product delivery, financial administration) where applicable. Separate written agreements on the processing of personal data have been drawn up with partners who process personal data.
Consent
The legal basis for processing is a contract.
Data content of the register
- Identification data: username, first name, surname, nickname.
- Details of any company: name, address and invoicing details, and Business ID.
- Contact details: invoicing address, delivery address, email address and telephone number.
- Payment details: the name of the payment method used with the order. Payment details are not stored.
- With the customer’s consent, location data, which is used among other things to calculate delivery costs and to locate the nearest reseller.
- The email address and credential used when logging in with Google or Facebook.
- Data observed from the use of the services and derived through analytics: purchase history, including ordered products and their price information, delivery details such as the chosen delivery method and delivery address, product reviews, webshop usage and browsing data, and device identification data. The processing operations involve no notable risk.
Regular sources of data
Data is obtained from registrations made by the customer and from notifications made by the customer during the customer relationship. Updates to name and contact details are also obtained from authorities and companies offering update services. Data may also be obtained from subcontractors connected with the use or provision of the service. Data on customers’ other activities in the digital environment may be obtained from partners’ websites, information systems or other digital sources that are accessed via an electronic invitation (link), via cookies or by using credentials issued to customers.
The data in the customer register is used only by the organisation, except when an external service provider is used either to produce a value-added service or to support a credit decision. Data is not disclosed outside the organisation or for the use of its partners, except in matters relating to credit applications, debt collection or invoicing, and where required by legislation.
Personal data is not transferred outside the European Union unless this is necessary to ensure the technical implementation of the controller or its partner. The personal data of a registered person is deleted at the user’s request unless legislation, open invoices or debt collection measures prevent deletion of the data.
Retention period of personal data
10 years from the end of the customer relationship.
Regular disclosures of data
The data in the customer register is used only by the organisation, except when an external service provider is used either to produce a value-added service or to support a credit decision. Data is not disclosed outside the controller or for the use of its partners, except in matters relating to credit applications, debt collection or invoicing, and where required by legislation. The personal data of a registered person is deleted at the user’s request unless legislation, open invoices or debt collection measures prevent deletion of the data.
Transfer of data outside the EU or EEA
Personal data is not transferred outside the European Union unless this is necessary to ensure the technical implementation of the organisation or its partner.
Principles of register protection A: Manual material
Contact details collected at customer events and other manually processed documents containing customer data are kept, after initial processing, in locked and fire-safe storage facilities. Only designated employees who have signed a confidentiality undertaking are entitled to process manually stored customer data. The provisions and principles of the Data Protection Act, the regulations of the authorities and good data processing practice are followed in protecting and processing the data in the register.
Principles of register protection B: Electronic material
Only designated employees of the organisation and of companies acting on its behalf are entitled to use the customer-owner and customer register and to maintain its data. Each designated user has a personal username and password. Every user has signed a confidentiality undertaking. The system is protected by a firewall that protects the system against external connections. The provisions and principles of the Data Protection Act, the regulations of the authorities and good data processing practice are followed in protecting and processing the data in the register.
Cookies
We use cookies on our pages. A cookie is a small text file that is sent to and stored on the user’s computer. Cookies do not harm users’ computers or files. The primary purpose of using cookies is to improve and personalise the visitor’s user experience on the website and to analyse and improve the functionality and content of the website. Data collected with cookies may also be used for targeting communications and marketing and for optimising marketing measures. A visitor cannot be identified by cookies alone.
However, information obtained with cookies may be combined with information possibly obtained from the user in another context, for example when the user fills in a form on our website. The following data is collected with cookies:
- The visitor’s IP address
- The time of the visit
- Pages browsed and page viewing times
- The visitor’s browser
Your rights: A user visiting our pages can prevent the use of cookies at any time by changing their browser settings. Most browser programs allow the cookie function to be switched off and cookies already stored to be deleted. Preventing the use of cookies may affect the functionality of the website.
Google Analytics. Usage statistics are collected from the website into the Google Analytics service, the purpose of which is to monitor and develop the website and to plan marketing. The data collected cannot be used to identify an individual user or person. In addition, the website uses the collection of audience and interest data (Google Analytics Demographics), which records, among other things, the user’s age, gender and interests. You can change the settings for the collection of this data in your own Google account at https://www.google.com/settings/ads. If you wish, you can disable Google Analytics tracking with a Chrome browser add-on.
More information about cookies and their detailed descriptions can be found on our website at: https://toolcat.fi/evastekaytanto-eu/.
Automated processing and profiling
Users are not profiled.
Right of access, i.e. the right to access personal data
The data subject has the right to check what data about them is held in the register. The request for access must be made in writing by contacting the controller’s customer service or the register’s contact person in Finnish or English. The request for access must be signed or sent from a verifiably identifiable email address. The data subject has the right to prohibit the processing and disclosure of their data for direct advertising, distance selling and direct marketing, and for market and opinion research, by contacting the controller’s customer service point.
Right to transfer data from one system to another
The data subject has the right to transfer their own data from one system to another. The transfer request may be addressed to the register’s contact person.
Right to demand rectification of data
Personal data in the register that is incorrect, unnecessary, incomplete or outdated with regard to the purpose of processing must be rectified, erased or supplemented. A request for rectification must be made by a personally signed written request to the organisation’s customer service or to the maintainer of the personal data register, or from a verifiably identifiable email address. The request must specify which data is required to be rectified and on what grounds. Rectification is carried out without delay. The rectification of an error is notified to the party from whom the incorrect data was obtained or to whom the data was disclosed. If a request for rectification is refused, the person responsible for the register issues a written certificate stating the reasons for which the request for rectification was refused. The person concerned may refer the refusal to the Data Protection Ombudsman for a decision.
Right to restriction
The data subject has the right to request restriction of the processing of data, e.g. if the personal data in the register is incorrect. Contact the person responsible for the register.
Right to object
The data subject has the right to request personal data concerning them, and the data subject has the right to request rectification or erasure of personal data. Requests may be addressed to the register’s contact person. If you act as the contact person for a company or organisation, your data cannot be deleted during this time.
Right to lodge a complaint with a supervisory authority
If you consider that the General Data Protection Regulation has been infringed in the processing of personal data concerning you, you have the right to lodge a complaint with the supervisory authority. You may also lodge the complaint in the Member State of your habitual residence or place of work. The contact details of the national supervisory authority are:
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PL 800, 00531 Helsinki
Switchboard: 029 566 6700
Registry: 029 566 6768
tietosuoja@om.fi
www.tietosuoja.fi
Other rights relating to the processing of personal data
The data subject has the right to prohibit the disclosure and processing of their data for direct advertising and other marketing, to demand anonymisation of the data where applicable, and the right to be completely forgotten.