This Privacy Notice describes how Soluni Oy processes the personal data of its customers and prospective customers in accordance with the EU General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable data protection legislation. Where applicable, this Privacy Notice also covers the processing of personal data relating to contact persons of corporate and organizational customers, representatives, and other persons who interact with Soluni Oy.
Soluni Oy (2688911-9)
Fredrikinkatu 7
49400 Hamina
tel. +358 5 229 6777
Karri Holmberg
email: info@soluni.com
Soluni Oy
tel. +358 5 229 6777
Soluni Oy Customer Register
Soluni Oy processes personal data only for predetermined and lawful purposes. Depending on the purpose of the processing, the processing of personal data is based on the performance of a contract, compliance with a legal obligation of the data controller, the legitimate interests of the data controller or a third party, or the consent given by the data subject.
Personal data is processed for establishing, maintaining and managing customer relationships and for providing and delivering products and services ordered by customers. Data may be processed, for example, for identifying customers, processing and verifying orders and other customer transactions, customer service, communications with customers, invoicing, processing payments, and fulfilling contractual rights and obligations.
The legal basis for processing is the performance of a contract or taking steps at the request of the data subject prior to entering into a contract.
Personal data is processed in order to comply with legal obligations applicable to the data controller. These may include obligations relating to accounting, taxation, payment transactions and information provided to authorities.
The legal basis for processing is compliance with a legal obligation of the data controller.
Personal data may be processed for the planning, analysis, statistics and development of customer relationships, Soluni Oy's operations, products and services. Data may be used, for example, to analyse the use of services and the customer experience and to improve the quality and efficiency of operations.
Soluni Oy may use partners in the provision and development of its services who process personal data on behalf of Soluni Oy and in accordance with its instructions. In such cases, the processing of personal data is agreed upon as required by applicable data protection legislation.
The legal basis for processing is the legitimate interest of the data controller in developing its business operations, products, services and customer relationships. Where processing requires the data subject's consent under applicable law, the processing is based on consent.
Personal data may be processed to prevent, detect and investigate misuse, fraud and information security incidents and to protect the rights of Soluni Oy, its customers and other parties. Data may also be processed for the establishment, exercise and defence of legal claims.
The legal basis for processing is the legitimate interest of the data controller or a third party in protecting its operations, property, information systems and rights and in preventing and investigating misuse.
Personal data may be processed for customer communications, marketing and direct marketing concerning Soluni Oy's products and services, as well as for planning, analysing and targeting marketing activities.
Depending on the method of processing and applicable legislation, the legal basis for processing may be the legitimate interest of the data controller or the consent given by the data subject. Electronic direct marketing is carried out in accordance with the Finnish Act on Electronic Communications Services and other applicable legislation.
The data subject has the right at any time to object to the processing of their personal data for direct marketing purposes. Where marketing is based on consent, the data subject has the right to withdraw their consent at any time.
Personal data may be used to create customer groups and to target communications, services and marketing based, for example, on the customer's purchase history, customer relationship information and information obtained from the use of services.
Depending on the purpose and method of processing, the legal basis for profiling is the legitimate interest of the data controller or the consent given by the data subject. Where cookies and other similar tracking technologies are used, consent is requested when required by applicable legislation.
Soluni Oy does not make decisions based solely on automated processing of personal data that produce legal effects concerning the data subject or similarly significantly affect them.
Personal data may also be processed for other separately specified purposes based on the consent given by the data subject. When consent is requested, the data subject is informed of the purpose for which their personal data will be processed.
The data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Personal data is processed for the administration of Soluni Oy's compensation system, for determining and monitoring entitlement to bonuses, and for calculating and paying bonuses. Personal data is also processed in order to fulfil statutory reporting, accounting and taxation obligations relating to bonus payments.
A personal identity code is processed to uniquely identify a person where this is necessary for making bonus payments and fulfilling the related statutory reporting obligations. A personal identity code may also be used to ensure the unique identification of a person in the customer and compensation system so that multiple overlapping customer relationships or bonus entitlements are not created for the same person.
Depending on the purpose of processing, the legal basis for processing personal data in connection with the operation of the compensation system is the performance of a contract, compliance with a legal obligation of the data controller, or the legitimate interest of the data controller in ensuring the correct and reliable operation of the compensation system and preventing incorrect or unjustified accrual and payment of bonuses.
A personal identity code is processed only when unique identification of the person is necessary for the purpose of the processing. A personal identity code is not unnecessarily used as a customer number or other generally used identifier.
Services provided by Soluni Oy may use location information from the user's device in order to provide location-based functions.
Device location information is not stored in Soluni Oy's customer register and is not used to create a location history of the user. The precise location of the device is used only in connection with the relevant location-based function and in the manner permitted by the user's device.
The user controls the use of their device's precise location through the location and permission settings provided by the device and operating system. The user may allow or deny the application access to the device's location and may change the permission granted through the device settings.
The register may contain, among other things, data belonging to the following categories that is necessary for the purposes of the register.
Basic information that varies according to customer group (independent representative, promoter, Premium customer, Soluni customer, VIP customer, loyalty customer), such as:
Information relating to the customer relationship and other relevant connection, such as:
Personal data processed during the customer relationship is retained for the duration of the customer relationship. The customer relationship is valid until further notice and ends when the customer terminates it.
After the customer relationship has ended, personal data is retained for as long as necessary for the relevant purpose of processing, for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims. Thereafter, the data is deleted or anonymised.
Personal data is primarily obtained from the data subject themselves when the customer relationship is established and maintained and when the data subject uses Soluni Oy's services.
Data may also be obtained from Soluni Oy's representatives and agents and from systems and services used by Soluni Oy in connection with customer relationships, orders, payments, customer service and other use of services.
Data may also be collected and generated in connection with the use of Soluni Oy's websites and electronic services, for example through cookies and other similar technologies. The use of cookies and other tracking technologies is described in more detail in section ten (10) of this Privacy Policy.
Personal data may also be obtained, with the data subject's consent, from social media services and other similar services.
Within the limits permitted by law, data may also be obtained from authorities, public and private registers and other external data sources. Such sources may include, for example, Posti's address information system, the Population Information System of the Digital and Population Data Services Agency, credit information registers, registers maintained by the Finnish Association of Marketing, Data & Analytics, and other similar address, contact information and information services.
Data may also be obtained from Soluni Oy's partners where there is a basis for the disclosure and processing of the data in accordance with applicable data protection legislation.
New data may also be generated for the register on the basis of data already contained in the register and the use of Soluni Oy's services for the purposes of processing personal data described in section four (4) of this Privacy Policy.
Soluni Oy may use external service providers and partners in the processing of personal data who process personal data on behalf of Soluni Oy and in accordance with its instructions. Such processors of personal data may include, for example:
Processors of personal data may process personal data only for the purpose of providing the agreed services and in accordance with Soluni Oy's instructions. The processing of personal data is agreed upon as required by applicable data protection legislation.
Personal data may also be disclosed to authorities and other parties where Soluni Oy has a legal obligation or right to do so. Such disclosures may include, for example, disclosures relating to taxation, income register reporting, accounting or lawful requests for information by an authority.
Personal data is not disclosed to external parties for their own marketing purposes unless the data subject has given consent or there is another basis permitted under applicable legislation.
Soluni Oy aims to process personal data primarily within the European Union and the European Economic Area.
However, in connection with services provided by service providers, cloud services or other partners acting on behalf of Soluni Oy, personal data may in some cases also be processed or transferred outside the EU or EEA.
If personal data is transferred outside the EU or EEA, Soluni Oy ensures that the transfer has a lawful transfer mechanism in accordance with Chapter V of the EU General Data Protection Regulation and that personal data is protected as required by applicable data protection legislation. A transfer may be based, for example, on a European Commission adequacy decision or appropriate safeguards such as Standard Contractual Clauses (SCC) approved by the European Commission. Other supplementary safeguards are also used where necessary.
Personal data is protected by appropriate technical and organisational measures to prevent unauthorised or unlawful processing and accidental loss, destruction, alteration or damage.
Access to personal data is restricted to persons who require the data in order to perform their duties. Access rights relating to the processing of personal data are granted based on job responsibilities and the need to process the data.
Information systems and the personal data processed in them are protected by appropriate technical and organisational safeguards, such as access control, user identification and other information security solutions. Safeguards are assessed and developed as necessary, taking into account the nature of the personal data being processed and the risks associated with the processing.
Soluni Oy requires its employees and partners who process personal data to handle personal data confidentially and appropriately.
The data subject has the rights provided under the EU General Data Protection Regulation (GDPR) in relation to the processing of their personal data. The applicability and scope of these rights depend on the purpose and legal basis of the processing of personal data.
The data subject has the right to obtain confirmation from the data controller as to whether personal data concerning them is being processed. Where such personal data is being processed, the data subject has the right to access the personal data concerning them and to obtain the information concerning its processing required under the GDPR. The data subject also has the right to obtain a copy of the personal data being processed.
If the data subject's request is manifestly unfounded or excessive, in particular because of its repetitive character, the data controller may, within the limits permitted by the GDPR, charge a reasonable fee based on administrative costs for complying with the request or refuse to act on the request.
The data subject has the right to have inaccurate personal data concerning them rectified without undue delay. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed.
In situations provided for under the GDPR, the data subject has the right to request the erasure of personal data concerning them. However, the right to erasure does not apply where processing or retention of personal data is necessary, for example, for compliance with a legal obligation of the data controller or for the establishment, exercise or defence of legal claims.
In situations provided for under the GDPR, the data subject has the right to request restriction of the processing of their personal data. This right may apply, for example, where the data subject contests the accuracy of the personal data or the lawfulness of the processing.
The data subject has the right, on grounds relating to their particular situation, to object to the processing of their personal data where the processing is based on the legitimate interests of the data controller or a third party. In such a case, processing of personal data is discontinued unless the data controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
The data subject has the right at any time to object to the processing of their personal data for direct marketing purposes, including profiling related to direct marketing. If the data subject objects to the processing of their personal data for direct marketing purposes, the personal data will no longer be processed for this purpose.
Where the processing of personal data is based on the consent given by the data subject, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
In situations provided for under the GDPR, the data subject has the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning them or similarly significantly affects them.
Soluni Oy does not make decisions concerning the data subject based solely on automated processing that would produce such legal effects or similarly significantly affect the data subject.
The data subject may exercise the rights described above by contacting the person responsible for data protection matters referred to in section two (2). Where necessary, the data controller may request additional information from the data subject in order to verify their identity.
The data controller responds to the data subject's request without undue delay and, as a general rule, no later than one month after receipt of the request. In situations provided for under the GDPR, this period may be extended by up to two months, taking into account the complexity and number of requests. The data subject will be informed of any extension and the reasons for it within one month of receipt of the request.
If the data subject considers that the processing of their personal data infringes applicable data protection legislation, they have the right to lodge a complaint with the competent supervisory authority, which in Finland is the Office of the Data Protection Ombudsman.
Office of the Data Protection Ombudsman
PO Box 800
00531 Helsinki
www.tietosuoja.fi
Soluni Oy's website uses cookies and other similar technologies to enable the technical operation of the website, improve the user experience, analyse the use of the website and, with the user's consent, target marketing and measure advertising effectiveness.
Cookies are small files that a website may store on the user's device. Cookies and similar technologies can be used, for example, to maintain user selections and login information, enable technical website functions, collect information about the use of the website and measure and target marketing.
The website may use both cookies set by Soluni Oy and cookies and similar technologies set by third parties. Information collected through cookies may include, for example, information about the device and browser used, the IP address, information about visits to and use of the website, and identifiers generated through cookies and other similar technical identifiers.
Strictly necessary cookies are used to enable the technical operation of the website and services requested by the user. Non-essential cookies, such as cookies used for analytics, advertising and marketing targeting, are used on the basis of the user's consent where applicable legislation requires consent.
Soluni Oy may use third-party analytics and marketing services on its website.
Google Analytics may be used to analyse the use of the website and user behaviour. The service may be used to collect information, for example, about visits to the website and pages visited.
Meta Pixel technology may be used to measure advertising effectiveness, analyse events relating to the use of the website and target advertising. Meta may process information collected through the technology in accordance with its own privacy practices.
In connection with third-party services used on the website, personal data may in some cases be processed outside the European Union or the European Economic Area. Such transfers of personal data are subject to the principles concerning international transfers of personal data described in section seven (7) of this Privacy Policy.
The user may manage non-essential cookies through the cookie management tool available on the website. The user may give or withhold consent for different purposes and may later change their choices or withdraw their consent.
Withdrawing consent must be as easy as giving it. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
The user may also manage and delete cookies through their browser settings. However, blocking cookies through browser settings may affect the operation of the website or some of its functions.