Privacy Notice

1. Data Controller
The data controller is Meritta Bra Oy (business ID 1915517-6).

Contact person for matters concerning the register: Andreas Ögård, entrepreneur

Meritta Bra Oy
Address: Aleksanterinkatu 4
Phone: 050-599 4387
Email: info (at) merittabra.fi

2. Name of the Register
The register is called the Meritta Bra Oy customer register.

3. Purpose of Processing Personal Data
Personal data is processed for purposes related to managing, administering, and developing customer relationships; providing, delivering, and developing services; and billing. Personal data is also processed as necessary to investigate potential complaints and other claims.

In addition, personal data is processed for customer communications, such as providing information and news, and for marketing, including direct marketing and electronic direct marketing.

Customers have the right to opt out of direct marketing addressed to them.

The controller processes data itself and also uses subcontractors that process personal data on its behalf.

4. Legal Grounds for Processing
The legal grounds for processing personal data under the EU General Data Protection Regulation (also referred to below as the “GDPR”) are:

The data subject has given consent to the processing of their personal data for one or more specific purposes (GDPR Article 6(1)(a));
Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the data subject’s request before entering into a contract (GDPR Article 6(1)(b));
Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party (GDPR Article 6(1)(f)).
The controller’s legitimate interest mentioned above is based on a relevant and appropriate relationship between the data subject and the controller arising from the data subject being a customer of the controller. Processing is carried out for purposes that the data subject could reasonably have expected when the personal data was collected and in the context of that relationship.

5. Data Contained in the Register (Categories of Personal Data Processed)
The register generally contains the following personal data for all data subjects:

Basic information and contact details: [first name, last name, address, phone number, email address];
Information about the individual’s company or other organization and their position or job title within that company or organization;
The individual’s direct marketing permissions and opt-outs.

6. Regular Sources of Data
Personal data is collected from the data subject.

Personal data is also collected and updated, within the limits of applicable law, from publicly available sources related to the customer relationship between the controller and the data subject. The controller uses these sources to fulfill its obligations related to maintaining customer relationships.

7. Personal Data Retention Period
Data collected in the register is retained only for as long as and to the extent necessary for the original or compatible purposes for which the personal data was collected.

The need to retain personal data is reviewed every five years. In any case, a data subject’s information is deleted from the register after their customer relationship with the controller has ended and the obligations and actions related to that relationship have been completed. For example, accounting records are retained for five years after the end of the fiscal year.

The data controller regularly assesses the need to retain data in accordance with its internal policies. The data controller also takes all reasonable steps to ensure that personal data that is inaccurate, incorrect, or outdated in relation to the purposes for which it is processed is promptly erased or corrected.

8. Recipients of personal data (categories of recipients) and regular disclosures
As part of delivering our products and services to you, we share your personal data with carefully selected third-party partners who perform various services on our behalf. You can request a list of our third-party partners at any time by contacting our customer service team. Our third-party partners may use only the data they need to provide their services. If you have concerns about our third-party partners, please contact our customer service team.

9. Transfers of data outside the EU or EEA
We always strive to process your data within the EU/EEA. However, in some circumstances, data may be transferred to and processed in countries outside the EU/EEA by a Meritta Bra group company or another supplier or subcontractor. Meritta Bra is committed to protecting your data and will take all reasonable legal, technical, and organizational measures to ensure that your data is processed securely and with an adequate level of protection comparable to that provided in the EU/EEA.

10. Principles for protecting the register
Materials containing personal data are stored in locked premises accessible only to designated individuals who are authorized to access them because of their duties.

The database containing personal data is located on a server kept in a locked facility accessible only to designated individuals who are authorized to access it because of their duties. The server is protected by an appropriate firewall and technical safeguards.

Access to databases and systems is limited to individually issued user IDs and passwords. The data controller has restricted access rights and permissions to information systems and other storage platforms so that only individuals whose access is necessary for the lawful processing of the data can view and process it. In addition, database and system activity is recorded in the data controller's IT system logs.

The data controller's employees and other individuals are bound by confidentiality obligations and must keep confidential any information they obtain while processing personal data.

11. Rights of the data subject
Data subjects have the following rights under the EU General Data Protection Regulation:

the right to obtain confirmation from the data controller as to whether personal data concerning them is being processed and, if so, the right to access that data and the following information: (i) the purposes of the processing; (ii) the categories of personal data concerned; (iii) the recipients or categories of recipients to whom the personal data has been or will be disclosed; (iv) where possible, the envisaged retention period or, if that is not possible, the criteria used to determine that period; (v) the data subject's right to request that the data controller rectify or erase their personal data, restrict its processing, or object to its processing; (vi) the right to lodge a complaint with a supervisory authority; and (vii) where the personal data is not collected from the data subject, any available information about its source (GDPR Article 15). The basic information described in (i)–(vii) is provided to the data subject in this notice;
the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (GDPR Article 7);
the right to require the data controller to correct inaccurate or incorrect personal data concerning the data subject without undue delay and to have incomplete personal data completed, including by providing a supplementary statement, taking into account the purposes for which the data was processed (GDPR Article 16);
the right to have the data controller erase personal data concerning the data subject without undue delay, provided that (i) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; (ii) the data subject withdraws the consent on which the processing was based and there is no other legal basis for the processing; (iii) the data subject objects to the processing on grounds relating to their particular situation and there are no legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes; (iv) the personal data has been unlawfully processed; or (v) the personal data must be erased to comply with a legal obligation under EU or national law applicable to the data controller (GDPR Article 17);
the right to have the data controller restrict processing if (i) the data subject contests the accuracy of the personal data, for a period enabling the data controller to verify its accuracy; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; (iii) the data controller no longer needs the personal data for the purposes of processing, but the data subject needs it to establish, exercise, or defend legal claims; or (iv) the data subject has objected to the processing on grounds relating to their particular situation, pending verification of whether the data controller's legitimate grounds override those of the data subject (GDPR Article 18);
the right to receive the personal data concerning them that they have provided to the data controller in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent as defined in the regulation and is carried out by automated means (GDPR Article 20);
the right to lodge a complaint with a supervisory authority if the data subject believes that the processing of their personal data violates the EU General Data Protection Regulation (GDPR Article 77).
Requests to exercise data subject rights should be directed to the data controller's contact person named in section 1.