Privacy statement of the customer and stakeholder register
Updated: 13 October 2022
This statement describes how we process the personal data of our customers, suppliers and other stakeholders’ contact persons as well as the visitors to our website.
1 Controller
Z-Forest Oy (3177669-6)
Address: Suonsaarentie 8 A, 50170 MIKKELI, FINLAND
(hereinafter referred to as “we”)
2 Contact details in matters regarding the register
Address: Suonsaarentie 8 A, 50170 MIKKELI, FINLAND
Email: tietosuoja@zertiforest.com
All contacts and requests regarding this statement must be submitted in writing or in person to the contact point indicated hereinabove.
3 Personal data to be processed, purpose and legal basis of the processing
| TYPES OF PERSONAL DATA | PURPOSE OF THE PROCESSING | LEGAL BASIS |
|---|---|---|
| The data subject’s basic details, such as name, date of birth, customer number and language of communication as well as property register information The data subject’s contact details, such as email address, telephone number and postal address information Information about the company and the company’s contact persons, such as contact persons’ names, titles and contact details | Provision, organisation and development of our services Fulfilment of our contractual and other promises and obligations Electronic direct marketing (including electronic surveys) Management of our customer relationship | Legitimate interest Execution of contract Consent (individuals) or legitimate interest (companies). Legitimate interest |
| Direct marketing consents and prohibitions | Electronic direct marketing (including electronic surveys) | Consent (individuals) or legitimate interest (companies). |
| Information related to the customer relationship and contracts, such as information on past and current contracts and mandates, information related to communication as well as invoicing information | Fulfilment of our contractual and other promises Customer relationship management and maintenance | Execution of contract Legitimate interest |
| Information regarding the technical connection and the terminal device you use, such as IP address, device ID or other identifying information and cookies | Analysis of behaviour, profiling | Consent |
4 Data sources
We receive information primarily from the following sources: the person themselves, the population register, authorities, credit reference agencies, contact information service providers and other similar trusted parties.
In addition, personal data may be collected and updated for the purposes described in this privacy statement also based on the information obtained from publicly available sources or other third parties within the limits of the applicable legislation. Such updating of data is carried out manually or by automatic means.
5 Who we disclose data to and whether we transfer data outside the EU or EEA
We may disclose personal data within the limits allowed and required by the current legislation to our associated companies participating in the provision of services and to legal and financial or other similar consultants who act as independent controllers with regard to the data.
We cannot name each of our subcontractors due to projects that are in the development phase and, therefore, we have opted to only name the types of subcontractors. When we use subcontractors, we have ensured through contractual arrangements, among other things, that the subcontractor processes personal data only in accordance with our written instructions and only for the purposes of processing as specified in this statement.
We process data primarily in the EU/EEA area. However, the IT management systems necessary to implement our services enable the transfer of data outside the EU/EEA area, such as to the United States. When personal data is processed outside the EU or EEA, we make sure that the subcontractor is committed to safeguards in accordance with the General Data Protection Regulation, such as the EU Commission’s model clauses regarding the processing of personal data.
6 Protection of data
Only those persons who have the right to process customer data in their duties are entitled to use systems and databases containing personal data. Each user has their own username and password for the system. Data is collected in databases that are protected by firewalls, passwords and other technical means. The databases and their backups are located in locked rooms and only certain predesignated persons can access the data.
7 Storage period
We store the personal data of customers and other stakeholders for the duration of the customership or contract as well as the necessary period for filing claims and suits thereafter. We store the data of potential customers for 5 years.
We regularly assess the necessity of data retention, taking into account the applicable legislation. In addition, we take reasonable steps to ensure that no personal data that is incompatible, outdated or inaccurate with regard to the purposes of the processing is stored in the register. We rectify or delete such data without delay.
8 Your rights as a data subject
You have the right to review the data concerning you in the person register and to demand the rectification or erasure of inaccurate, outdated, unnecessary or unlawful data. If you yourself have access to your data, you can edit your data yourself. Insofar as the processing is based on consent, you also have the right to withdraw or amend your consent at any time. Withdrawal of consent does not affect the lawfulness of the processing that took place prior to the withdrawal of consent.
For particular personal reasons, you also have the right to object to processing operations targeting you when the basis for the processing of data is a legitimate interest. In connection with your claim, you must specify the particular situation based on which you object to the processing. We can refuse to implement a request for objection only on the grounds provided by law.
To the extent that you yourself have provided data to the customer register, which is processed automatically based on your consent or mandate, you have the right to receive such data for yourself, generally in a machine-readable format, and the right to transmit this data to another controller.