REGISTER AND PRIVACY POLICY
This is Yöpuu Yhtiö Oy’s register and privacy policy in accordance with the Personal Data Act (sections 10 and 24) and the EU General Data Protection Regulation (GDPR). Prepared on May 25, 2018. Last updated on May 27, 2018.
REGISTER DESCRIPTION
1. DATA CONTROLLER
Yöpuu Yhtiö Oy
Yliopistonkatu 23
40100 Jyväskylä
info(at)hotelliverso.fi
2. CONTACT PERSON RESPONSIBLE FOR THE REGISTER
Aino Pärnänen
+358 44 427 0253
aino.parnanen(at)yopuuyhtio.fi
3. NAME OF THE REGISTER
Yöpuu Yhtiö Oy customer register
4. LEGAL BASIS AND PURPOSE OF PROCESSING PERSONAL DATA
The legal basis for processing personal data under the EU General Data Protection Regulation is
– the individual’s consent (documented, voluntary, specific, informed, and unambiguous)
The purpose of processing personal data is to communicate with customers, maintain customer relationships, and conduct marketing.
5. DATA CONTENT OF THE REGISTER
The information stored in the register includes: the person’s name, position, company/organization, contact information (phone number, email address, postal address), website addresses, IP address of network connection, usernames/profiles on social media services, information about ordered services and their changes, billing information, and other information related to the customer relationship and ordered services.
The data is retained for two years from the moment the information was last modified.
6. REGULAR SOURCES OF INFORMATION
The information stored in the register is obtained from the customer through messages sent via web forms, email, telephone, social media services, contracts, customer meetings, and other situations where the customer provides their information.
7. REGULAR DISCLOSURE OF DATA AND TRANSFER OF DATA OUTSIDE THE EU OR EEA
Data is not regularly disclosed to other parties. Data may be published to the extent agreed upon with the customer.
Data may also be transferred by the data controller outside the EU or EEA.
Data may be disclosed to the following parties:
– Facebook
– Google
– MailChimp
The reason for data disclosure is improved and targeted marketing.
8. PRINCIPLES OF REGISTER PROTECTION
Due care is exercised in processing the register, and data processed using information systems is appropriately protected. When register data is stored on Internet servers, the physical and digital security of their hardware is properly maintained. The data controller ensures that stored data, server access rights, and other information critical to the security of personal data are handled confidentially and only by employees whose job description includes such tasks.
9. RIGHT OF ACCESS AND RIGHT TO DEMAND CORRECTION OF INFORMATION
Every person in the register has the right to check the information stored about them and to demand correction of any incorrect information or completion of incomplete information. If a person wishes to check the information stored about them or request corrections, the request must be sent in writing to the data controller. The data controller may, if necessary, ask the requester to prove their identity. The data controller will respond to the customer within the time specified in the EU Data Protection Regulation (generally within one month).
10. OTHER RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA
A person in the register has the right to request the deletion of their personal data from the register (“right to be forgotten”). Likewise, data subjects have other rights under the EU General Data Protection Regulation, such as restriction of processing of personal data in certain situations. Requests must be sent in writing to the data controller. The data controller may, if necessary, ask the requester to prove their identity. The data controller will respond to the customer within the time specified in the EU Data Protection Regulation (generally within one month).
PRIVACY POLICY
You can download the comprehensive privacy policy in accordance with the General Data Protection Regulation (GDPR) here:
Purpose of the separate privacy policy
This privacy policy implements the transparent information, communication, and detailed rules under the EU General Data Protection Regulation (EU) 2016/679, which enable the provision of information to data subjects under Articles 13 and 14 and all information concerning processing under Articles 15–22 and Article 34 in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Yöpuu Yhtiö Oy is a hospitality industry company that provides accommodation and restaurant services to its customers. This privacy policy describes the principles of processing and protecting personal data through which Yöpuu Yhtiö, as data controller, protects personal data in various situations.
In this privacy policy, the data controller is later referred to as “Yöpuu Yhtiö” or “data controller”.
