According to the General Data Protection Regulation (GDPR), the data controller is obligated to inform data subjects in a clear and transparent manner. This privacy notice fulfills that obligation.

1. Data controller

Spatium Toimitilat Oy
Salpausselänkatu 7, 15110 LAHTI

Contact information regarding matters related to the register:
Spatium Toimitilat Oy / Jouni Kanervo
Salpausselänkatu 7, 15110 LAHTI
044 716 1638
jouni.kanervo@spatium.fi

There is no need to appoint a Data Protection Officer (DPO) for the company.

2. Data subjects

Customers of Spatium Toimitilat Oy, representatives of stakeholders, and potential customers.

3. Legal basis and purpose of data processing

Legal basis for maintaining the register:

• Personal data is processed based on the data subject’s customer relationship
• Personal data is processed based on the data subject’s consent
• Purpose of personal data processing and use of the register

Personal data is processed only for predefined purposes, which are as follows:

• Managing the customer relationship
• Communication and marketing

4. Personal data stored in the register

The customer register contains the following information:

• Contact details
• Name of the company and individual
• Email address

5. Rights of the data subject

The data subject has the following rights. Requests to exercise these rights should be submitted to: jouni.kanervo@spatium.fi

Rights of access
The data subject has the right to review the personal data we have stored about them.

Right to rectification
The data subject may request the correction of any inaccurate or incomplete information concerning them.

Right to object
The data subject may object to the processing of their personal data if they believe it is being processed unlawfully.

Right to prohibit direct marketing
The data subject has the right to prohibit the use of their data for direct marketing purposes.

Right to erasure
The data subject has the right to request the deletion of their data if processing is no longer necessary. We will review the request and either delete the data or provide a justified reason why it cannot be deleted.

Please note that the data controller may have a legal or other right to retain certain information. For example, accounting records must be retained for the period defined in the Finnish Accounting Act (Chapter 2, Section 10), which is 10 years. Therefore, material related to accounting cannot be deleted before the retention period has expired.

Right to withdraw consent
If the processing of personal data is based solely on the data subject’s consent (and not, for example, on a customer relationship or membership), the data subject may withdraw their consent at any time.

The data subject may appeal a decision to the Data Protection Ombudsman.

The data subject also has the right to request that we restrict the processing of disputed data until the matter is resolved.

Right to lodge a complaint
The data subject has the right to lodge a complaint with the Data Protection Ombudsman if they believe that their personal data is being processed in violation of applicable data protection laws.

Contact details for the Data Protection Ombudsman:  www.tietosuoja.fi/en/contact-information

6. Regular sources of data

Customer information is regularly obtained:

• Directly from the customer when the customer relationship is established
• Directly from the customer via an online form

7. Regular disclosures of data

As a rule, data is not disclosed outside Spatium Toimitilat Oy.

We have ensured that all our service providers comply with data protection legislation. We regularly use the following service providers:

MailChimp
Our newsletter service provider, The Rocket Science Group LLC d/b/a MailChimp, is registered under the Privacy Shield framework and is therefore authorized to process data. www.privacyshield.gov

8. Duration of processing

Personal data is generally processed for as long as the customer relationship is active. Data subjects can unsubscribe from our marketing list at any time by using the link provided in each marketing email we send.

9. Processors of personal data

Personal data is processed by the data controller, Spatium Toimitilat Oy, and its employees. We may also outsource the processing of personal data in part to third parties. In such cases, we ensure through contractual arrangements that personal data is processed in accordance with applicable data protection legislation and handled appropriately.

An external party processing personal data from the customer register is our newsletter provider: INNOSTA Marketing and Training Services (Business ID: 2639626-9) / Krisse Törö.

10. Data transfers outside the EU

Personal data is not transferred outside the EU or European Economic Area, except when using the MailChimp newsletter service. We ensure an adequate level of data protection by, among other things, entering into agreements covering confidentiality and data processing in accordance with legal requirements.

11. Automated decision-making and profiling

We do not use personal data for automated decision-making or profiling.

© 2020 Spatium Toimitilat Oy | Salpausselänkatu 7 | 15110 Lahti | +358 44 716 1638