Privacy Statement
1. Data controller
Assarisi, Business ID 2547170-6
Maamiehentie 1C
01630 VANTAA
Contact details regarding the register
2. Registered persons
Persons who have purchased an Assarisi service or have interacted with the company’s website or online store.
3. Purpose of processing personal data
Basis for maintaining the register:
Personal data is processed on the basis of the customer relationship with the registered person.
Purpose of processing personal data and using the register
Personal data is processed only for predetermined purposes, which are:
- Managing customer relationships
- Providing information about our services
4. Personal data stored in the register
The customer register contains the following information:
- Contact details
- Name
- Address
- Telephone number
Customer information
- Information about purchased products or services
- Information about marketing permissions and prohibitions
- Possible usernames and passwords for the online store
5. Rights of the registered person
The registered person has the following rights. Requests concerning the exercise of these rights should be sent to info@assarisi.fi
Right of access:
The registered person can check the personal data we have stored.
Right to rectification:
The registered person can request that incorrect or incomplete information concerning them be corrected.
Right to object:
The registered person can object to the processing of personal data if they believe that their personal data has been processed unlawfully.
Direct marketing prohibition:
The registered person has the right to prohibit the use of their information for direct marketing.
Right to erasure:
The registered person has the right to request the deletion of their information if processing the information is not necessary. We will process the deletion request, after which we will either delete the information or provide a justified reason why the information cannot be deleted.
It should be noted that the data controller may have a statutory or other right not to delete the requested information. The data controller has an obligation to retain accounting records for the period specified in the Accounting Act (Chapter 2, Section 10), which is 10 years. For this reason, accounting-related material cannot be deleted before the retention period has expired.
Withdrawal of consent:
If the processing of personal data concerning the registered person is based solely on consent, and not, for example, on a customer relationship or membership, the registered person may withdraw their consent.
The registered person can appeal a decision to the Data Protection Ombudsman:
The registered person has the right to request that we restrict the processing of disputed information for the time needed to resolve the matter.
Right to lodge a complaint:
The registered person has the right to lodge a complaint with the Data Protection Ombudsman if they believe that we are violating applicable data protection legislation when processing personal data.
Contact details for the Office of the Data Protection Ombudsman:
6. Regular sources of information
Customer information is regularly obtained from:
- The customer themselves when the customer relationship is established
- The customer themselves through an online form
- The customer themselves by telephone
- The customer themselves during a meeting
- By email or other similar means
7. Regular disclosures of information
As a general rule, information is not disclosed outside Assarisi for marketing purposes.
If we use external service providers, we ensure that they comply with data protection legislation. At present, we use external partners for delivering orders, accounting, the website platform, collecting unpaid invoices, and for authorities when required by them and permitted by law.
8. Duration of processing
- Personal data is generally processed for as long as the customer relationship remains active
- However, order, invoicing and payment information is retained in the same way as other accounting material
- Information that is no longer necessary is securely destroyed.
9. Processors of personal data
The customer register is processed by employees working for Assarisi.
The data controller and its employees process personal data. We may also outsource the processing of personal data in part to a third party, in which case we ensure through contractual arrangements that personal data is processed in accordance with applicable data protection legislation and otherwise appropriately.
10. Transfer of data outside the EU
Personal data is not transferred outside the European Union or the European Economic Area.
11. Automated decision-making and profiling
We do not use data for automated decision-making or profiling.