Privacy Notice

Data controller

Host It Oy (3363423-7)
Later in this report Company

Data Protection Officer and/or Contact Person

Eerik Nurmi
0451974717
eerik@host-it.fi

Personal data register name

Host It Oy customer and marketing register

This privacy statement applies to the processing of personal data relating to our websites, marketing and customer relationship management, as well as the products and services we offer.

Personal data collected and sources of information

We collect personal data necessary for managing customer relationships.

We collect personal data from the data subject themselves, as well as from publicly available registers maintained by authorities and other external sources, such as the trade register or other corresponding public company registers. In addition, we collect information from those who have completed contact forms and use it for the aforementioned purposes related to customer relationship management.

The purpose of using personal data and the grounds for processing

Personal data shall be processed within the limits permitted by current legislation for the following purposes:

• Delivery of products and services and the conclusion of customer agreements (contractual relationship or its preparation)
• customer relationship management (legitimate interest)
• Communicating and advising on services (legitimate interest)
• Online service testing (legitimate interest)
• Product and service development (legitimate interest)
• Collection and analysis of user statistics (consent, legitimate interest)
• Improving the user experience of our website and other services (consent, legitimate interest)
• invoicing, credit decisions and debt collection (legitimate interest)
• marketing communications (legitimate interest)
• direct marketing, including electronic direct marketing and telephone marketing, as well as the planning and measurement of the effectiveness of advertising and marketing, and the combining and updating of personal data for direct marketing purposes (legitimate interest, consent)
• managing stakeholder relations and subcontracting, as well as cooperation with service providers (legitimate interest, contractual relationship or its preparation)
• Internal reporting and other administrative measures (compliance with statutory obligations)
• Handling warranty and defect liability matters, as well as processing complaints and managing court and authority procedures (legitimate interest).
• Prevention and investigation of abuse, as well as ensuring the security of data, persons, and property (legitimate interest).
• fulfilling other statutory obligations (e.g. accounting and tax-related actions) and reporting obligations

and, if the processing of personal data is based on the consent given by the person, the person may withdraw their consent at any time by notifying the aforementioned contact person.

The processing of personal data may be necessary to pursue the legitimate interests of the Company and the data subject in the context of their customer relationship. The Company has a legitimate interest in processing personal data for marketing, service and customer analysis, and for service testing. Marketing purposes may also involve profiling. In such cases, the data subject has the right to object to the processing of their personal data. When personal data is processed on the basis of a legitimate interest, we have assessed the benefits and potential disadvantages of the processing for the data subject and concluded that the data subject’s rights and interests do not override the legitimate interest. We will provide further information on the processing of personal data based on a legitimate interest upon request.

Personal data processors

Access to personal data is restricted to personnel responsible for customer relationship management and marketing.

Recipients of personal data

Various service providers and other third parties, such as providers of technical solutions or server space, or accounting and financial management service providers, can also be used in the processing of personal data. We ensure that the parties we use in the processing of personal data have contracts as required by data protection legislation.

Personal data may be disclosed to third parties in situations where it is required by legislation or authority, or for the investigation of misuse, as well as to ensure security. In addition, personal data may need to be disclosed in connection with legal proceedings or similar legal procedures.

If the Company is involved in a merger, business acquisition or other corporate reorganisation, personal data may be disclosed to the parties involved in the reorganisation or to entities assisting in the reorganisation.

We will provide further information on the recipients of personal data upon request.

Transfer of personal data outside the European Economic Area

Personal data will not be transferred outside the European Union or the European Economic Area unless it is necessary for the technical implementation of the service. In potential situations of disclosure and transfer of data, the level of data protection required by data protection legislation and other necessary safeguards will be observed.

We shall provide further information upon request regarding the transfer of personal data and the safeguards used.

Cookies

We use cookies and other similar technologies on our website. A cookie is a small text file that the browser saves on the user's terminal device. Cookies contain an anonymous, unique identifier which allows us to identify and count different browsers visiting our site. The purpose of using cookies and other similar technologies is to analyse and further develop our services to better serve users, as well as to target advertising. The user can manage their consent through the cookie tool on our website.

Data protection

We protect personal data using appropriate technical and organisational measures. Data is collected into databases that are protected by firewalls, passwords, and other technical security measures. The databases and their backups are located in locked and guarded premises, and access to the data is restricted to specific, pre-named individuals.

Personal data retention periods and disposal

Personal data shall be retained for as long as it is necessary for the purpose for which it was collected and processed, or for the performance of a contract, or as required by law and regulations. Thereafter, the personal data shall be properly destroyed.

Registrant rights

The registrant has the following rights:

1. Right of access to personal data. The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed, as well as other information on the processing of personal data in accordance with data protection legislation. The data subject has the right to obtain a copy of their personal data.
2. A registered person may request correction of data if it is incomplete or incorrect.
3. A data subject may request the erasure of their data when there is no legitimate reason under data protection legislation, independent of the data subject's consent, for processing them.
4. The data subject has the right to restrict the processing of personal data if the accuracy or legality of the data so requires, or in accordance with the right to object, the data subject requests to restrict the processing of personal data to storage only. The data subject has the right to object to the processing of data for direct marketing purposes based on the Company's legitimate interest.
5. The data subject may request the transfer of their data to another controller. The right to transfer applies, in principle, to personal data that the data subject has provided to the controller in a structured, commonly used and machine-readable format, and for the processing of which the basis is the data subject’s consent or a contract, and/or for which processing is carried out automatically.
6. The right to withdraw consent. If the processing of personal data is based on consent given by the data subject, the data subject has the right to withdraw their consent to the processing of their personal data. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
7. The registered person must submit requests concerning their rights in writing or by email to the following contact details:

Host It Oy
Inspection/other request concerning personal data
eerik@host-it.fi

The identity of the requestor can be verified before processing the request. The company will respond to requests within 1 month of submission, unless there are specific reasons to extend the response time.

The data subject has the right to lodge a complaint with the competent supervisory authority for data protection if the data subject considers that their personal data have been processed in contravention of data protection legislation.

The contact details for the Finnish data protection authority are here.