1 Controller
The controller of the register is Helmi Promotion Oy (business ID 2000605-5).
Contact person for register matters: Saima Haapanen
Helmi Promotion Oy
Address: Takkatie 10b, 00370 Helsinki
Phone: +358 50 595 3968
Email: store@clubforfive.fi
2 Name of the register
The name of the register is the customer register of Helmi Promotion Oy.
3 Purpose of processing personal data
Personal data is processed for purposes related to managing, administering and developing the customer relationship, offering and delivering services, and developing and invoicing services. Personal data is also processed for the purposes required to investigate any complaints and other claims.
In addition, personal data is processed in communications to customers, such as announcements and news, and in marketing. As part of marketing, personal data is also processed for direct marketing and electronic direct marketing.
Customers have the right to object to direct marketing addressed to them.
The controller processes the data itself and also uses subcontractors that act on behalf of and for the account of the controller in processing personal data.
4 Legal basis for processing
The legal bases for processing personal data are the following bases under the EU General Data Protection Regulation (hereinafter also “GDPR”):
- the data subject has given consent to the processing of their personal data for one or more specific purposes (GDPR Art. 6(1)(a));
- processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject before entering into a contract (GDPR Art. 6(1)(b));
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (GDPR Art. 6(1)(f)).
The controller’s legitimate interest referred to above is based on a relevant and appropriate relationship between the data subject and the controller, which exists because the data subject is a customer of the controller, and on processing for purposes that the data subject could reasonably expect at the time the personal data was collected and in the context of that relationship.
5 Content of the register (categories of personal data processed)
As a rule, the register contains the following personal data on all data subjects:
- the person’s basic details and contact details (first name, last name, address, phone number, email address);
- information on the person’s company or other organisation, and the person’s position or job title in that company or organisation;
- the person’s direct marketing consents and refusals.
6 Regular sources of data
Personal data is collected from the data subjects themselves.
Within the limits of applicable law, personal data is also collected and updated from publicly available sources that relate to the customer relationship between the controller and the data subject and that the controller uses to fulfil its obligations in maintaining customer relationships.
7 Retention period of personal data
Data collected in the register is kept only for as long as, and to the extent that, it is needed for the original or compatible purposes for which the personal data was collected.
Data concerning a data subject is deleted from the register after the customer relationship between that data subject and the controller has ended and the related obligations and measures have been completed. Some data is kept longer where the law requires it. For example, under chapter 2, section 10(2) of the Finnish Accounting Act (1336/1997), the vouchers of a financial period must be kept for at least six years from the end of the year in which the financial period ended.
The controller regularly assesses the need to keep the data in line with its internal codes of practice. The controller also takes every reasonable step to ensure that personal data that is inaccurate, incorrect or out of date for the purposes of processing is deleted or corrected without delay.
8 Recipients of personal data (categories of recipients) and regular disclosures of data
Personal data is not disclosed to outside parties. The data is processed on behalf of the controller by the subcontractors referred to in section 3. For the website, these subcontractors are the website’s maintainer and hosting provider, MailPoet (Automattic), which sends the newsletters, and Cookiebot, which records visitors’ cookie choices.
In addition, data on the use of the website is passed to Google and Spotify as described in sections 12 and 13.
9 Transfer of data outside the EU or EEA
The website’s servers are located in Finland. Data processed by Google and by MailPoet (Automattic) may be transferred outside the EU and the EEA, for example to the United States. Google transfers data under the EU-U.S. Data Privacy Framework and, where needed, under standard contractual clauses approved by the European Commission. Automattic uses standard contractual clauses approved by the Commission for its transfers.
10 Principles of register security
Material containing personal data is kept in locked premises that only designated persons authorised by their duties can access.
The database containing personal data is on a server kept in locked premises that only designated persons authorised by their duties can access. The server is protected by an appropriate firewall and technical safeguards.
Databases and systems can be accessed only with personal user IDs and passwords that are granted separately. The controller has limited access rights and authorisations to information systems and other storage platforms so that only the persons needed for lawful processing can view and process the data. Use of the databases and systems is also recorded in the log data of the controller’s IT system.
The controller’s employees and other persons have committed to a duty of confidentiality and to keeping secret any information they receive while processing personal data.
11 Rights of the data subject
Under the EU General Data Protection Regulation, the data subject has the following rights:
- the right to obtain confirmation from the controller as to whether or not personal data concerning them is being processed and, where it is, the right to access the personal data and the following information: (i) the purposes of the processing; (ii) the categories of personal data concerned; (iii) the recipients or categories of recipients to whom the personal data has been or will be disclosed; (iv) where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period; (v) the data subject’s right to request from the controller rectification or erasure of personal data concerning them or restriction of processing of personal data, or to object to such processing; (vi) the right to lodge a complaint with a supervisory authority; (vii) where the personal data is not collected from the data subject, any available information as to its source (GDPR Art. 15). The basic information in points (i)–(vii) is given to the data subject in this privacy policy;
- the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (GDPR Art. 7);
- the right to have the controller rectify inaccurate and incorrect personal data concerning the data subject without undue delay, and the right to have incomplete personal data completed, including by providing a supplementary statement, taking into account the purposes for which the data was processed (GDPR Art. 16);
- the right to have the controller erase personal data concerning the data subject without undue delay, provided that (i) the personal data is no longer needed for the purposes for which it was collected or otherwise processed; (ii) the data subject withdraws the consent on which the processing was based and there is no other legal ground for the processing; (iii) the data subject objects to the processing on grounds relating to their particular situation and there is no justified reason for the processing, or the data subject objects to processing for direct marketing purposes; (iv) the personal data has been processed unlawfully; or (v) the personal data must be erased to comply with a legal obligation under Union or national law that applies to the controller (GDPR Art. 17);
- the right to have the controller restrict processing if (i) the data subject contests the accuracy of the personal data, in which case processing is restricted for a period that enables the controller to verify its accuracy; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; (iii) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defence of legal claims; or (iv) the data subject has objected to processing on grounds relating to their particular situation, pending verification of whether the legitimate grounds of the controller override those of the data subject (GDPR Art. 18);
- the right to receive the personal data concerning them that the data subject has provided to the controller in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent under the Regulation and is carried out by automated means (GDPR Art. 20);
- the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data concerning them infringes the EU General Data Protection Regulation (GDPR Art. 77).
Requests concerning the exercise of the data subject’s rights should be addressed to the controller’s contact person named in section 1.
12 Web analytics
The website uses Google’s web analytics service Google Analytics and the tag management service Google Tag Manager. Google Analytics collects information about visits to the site, such as pages viewed, clicks on links that lead away from the site and use of forms, as well as about the visitor’s device and browser. The data is used to follow how the website is used and to develop the website.
Analytics cookies are set only after the visitor accepts them in the website’s cookie notice. If the visitor does not give consent, Google receives information about page loads without cookies (Google Consent Mode).
13 Targeted marketing
Based on visits to the site, we may show targeted advertising in Google’s advertising service Google Ads. The website also uses Google Ads conversion tracking, which measures the results of advertising. Google Ads cookies are set only after the visitor accepts marketing cookies in the website’s cookie notice.
The YouTube videos and the Spotify player on the front page come from Google’s and Spotify’s services, and these services set their own cookies. In the website’s cookie notice, the cookies of these services are classified as marketing cookies.