PRIVACY POLICY

1. Controller

• Name: Hunajakeiju Oy (Business ID: 2348109-7)
• Contact person: Miia Tapio
• Address: Hakerinmäentie 38, 21340 Tortinmäki
• Phone: 040-575 5552
• Email: miia@hunajakeiju.fi

2. Name of the register

Hunajakeiju Oy's customer register.

3. Purpose of processing personal data

Personal data is processed for purposes related to managing, administering and developing customer relationships, providing and delivering services, and developing and invoicing services. Personal data is also processed for purposes necessary to resolve potential complaints and other claims.

In addition, personal data is processed in customer-oriented communications, such as for information and news purposes, and in marketing, as part of which personal data is also processed for purposes related to direct marketing and electronic direct marketing. The customer has the right to prohibit direct marketing targeted at him.

The controller processes the data itself and utilizes subcontractors acting on behalf of and on behalf of the controller (such as IT and payment systems).

4. Legal bases for processing

The legal bases for processing personal data are the following grounds in accordance with the EU General Data Protection Regulation (GDPR):

• Consent: The data subject has given his consent to the processing of his personal data for one or more specific purposes (GDPR Art. 6 1.a).
• Contract: Processing is necessary for the performance of a contract to which the data subject is a party or for taking steps prior to entering into a contract at the request of the data subject (GDPR Art. 6 1.b).
• Legitimate interest: Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party (GDPR Art. 6 1.f). This interest is based on the customer relationship.

5. Data content of the register

The register contains the following personal data, in principle, for all registered persons:

• Basic information and contact information (first name, last name, address, telephone number, email address).
• Information related to customer relationships, orders and use of the website (e.g. order history, purchased products, payment information, payment method, payment status, billing information).
• Information related to the person's company or other organization and the person's position or job title, if the person is a business customer.
• The person's direct marketing permissions and prohibitions.
• Technical information and cookie information related to website browsing (e.g. IP address, device used and page history).

6. Regular data sources

Personal data is mainly collected from the registered person himself/herself in connection with an order or contact. Personal data can also be collected and updated within the limits of applicable legislation from generally available sources (e.g. Posti's address information system) in order to maintain the customer relationship.

7. Retention period of personal data

Personal data is only stored for as long and to the extent necessary in relation to the purposes for which it was collected.

Customer data is mainly deleted from the register 5 years after the customer relationship has ended and all related obligations have been fulfilled. Accounting documents and invoices required by the Accounting Act are kept for the required 6 years from the end of the calendar year in which the financial period ended.

8. Recipients of personal data and regular disclosures

The data is not disclosed to external parties for independent marketing use. Data is routinely disclosed to the following service providers for the purpose of implementing online store operations, payment processing, logistics and analytics:

• Stripe Payments Europe Ltd: Processing payment card payments and fraud prevention.
• Klarna Bank AB: Processing invoice, installment and online banking payments.
• Google LLC: Implementation of website visitor tracking and analytics.
• Logistics partners (e.g. Posti/Matkahuolto): Necessary address and contact information for order delivery

9. Transfer of data outside the EU or EEA

Registered data may be transferred outside the EU or EEA (such as the United States) by service providers whose underlying companies are located outside the European Economic Area (such as Google and Stripe).

The lawful transfer of data is primarily ensured by using the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCC) approved by the European Commission, and by ensuring the necessary technical safeguards.

10. Principles of data protection

Any physical material is stored in locked premises, accessible only to authorized persons.

Electronic systems and databases are protected by firewalls, passwords and other technical methods. Access to the data is limited to those employees and partners of the controller who need the information to perform their work. All employees are bound by a duty of confidentiality.

11. Rights of the data subject

According to the EU General Data Protection Regulation, the data subject has the right to:

• Check the data: Get access to the personal data concerning him or her and check the data concerning him or her (GDPR Art. 15).
• Withdraw consent: Withdraw consent at any time, if the processing is based on consent (GDPR Art. 7).
• Rectify data: Request the rectification of inaccurate or incorrect data or the completion of incomplete data (GDPR Art. 16).
• Delete data: Request the deletion of your data ("right to be forgotten") if there is no longer a legal basis or statutory obligation for the processing of the data (GDPR Art. 17).
• Restrict processing: Request the restriction of processing, for example while the accuracy of the data is being verified (GDPR Art. 18).
• Object to processing: Object to the processing of your personal data for direct marketing purposes (GDPR Art. 21).
• File a complaint: File a complaint with the Data Protection Ombudsman if the data subject considers that the processing of their personal data has infringed the Data Protection Regulation.