This is the Privacy Policy and Data Protection Statement of Yöpuu Yhtiö Oy in accordance with the Personal Data Act (Sections 10 and 24) and the EU General Data Protection Regulation (GDPR). Prepared on May 25, 2018. Last updated on May 27, 2018.
CONTROLLER
Yöpuu Yhtiö Oy
Yliopistonkatu 23
40100 Jyväskylä
info(at)hotelliverso.fi
CONTACT PERSON FOR THE REGISTER
Aino Pärnänen
+358 44 427 0253
aino.parnanen(at)yopuuyhtio.fi
NAME OF THE REGISTER
Yöpuu Yhtiö Oy customer register
LEGAL BASIS AND PURPOSE OF PROCESSING PERSONAL DATA
The legal basis for processing personal data under the EU General Data Protection Regulation is
– the consent of the individual (documented, voluntary, specific, informed, and unambiguous)
The purpose of processing personal data is to communicate with customers, maintain customer relationships, and for marketing purposes.
DATA CONTENT OF THE REGISTER
The data stored in the register includes: the person’s name, position, company/organization, contact information (phone number, email address, address), website addresses, IP address of the network connection, IDs/profiles on social media services, information on ordered services and changes to them, billing information, and other information related to the customer relationship and ordered services.
The data is stored for two years from the moment the data was last modified.
REGULAR SOURCES OF INFORMATION
The data stored in the register is obtained from the customer, for example, through messages sent via web forms, by email, by telephone, through social media services, from contracts, customer meetings, and other situations where the customer discloses their information.
REGULAR DISCLOSURES OF DATA AND TRANSFER OF DATA OUTSIDE THE EU OR EEA
Data is not regularly disclosed to other parties. Data may be published to the extent agreed upon with the customer.
Data may also be transferred by the controller outside the EU or the EEA.
Data may be disclosed to the following parties:
– Facebook
– Google
– Mailerlite
The reason for the disclosure of data is to provide better and targeted marketing.
PRINCIPLES OF REGISTER PROTECTION
Due diligence is observed in the processing of the register, and data processed by means of information systems is appropriately protected. When register data is stored on Internet servers, the physical and digital security of their hardware is appropriately managed. The controller ensures that stored data, as well as server access rights and other information critical to the security of personal data, are handled confidentially and only by employees whose job description includes it.
RIGHT OF ACCESS AND RIGHT TO REQUEST CORRECTION OF DATA
Every person in the register has the right to check their data stored in the register and to demand the correction of any incorrect information or the completion of incomplete information. If a person wishes to check the data stored about them or request a correction, the request must be sent in writing to the controller. The controller may, if necessary, ask the requester to prove their identity. The controller will respond to the customer within the time frame set out in the EU Data Protection Regulation (generally within one month).
OTHER RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA
A person in the register has the right to request the removal of personal data concerning them from the register (“the right to be forgotten”). Likewise, data subjects have other rights under the EU General Data Protection Regulation, such as restricting the processing of personal data in certain situations. Requests must be sent in writing to the controller. The controller may, if necessary, ask the requester to prove their identity. The controller will respond to the customer within the time frame set out in the EU Data Protection Regulation (generally within one month).
You can download a comprehensive privacy policy in accordance with the General Data Protection Regulation (GDPR) here:
Download the privacy policy
This privacy policy implements transparent information, communication, and detailed rules in accordance with the EU General Data Protection Regulation (EU) 2016/679, through which information under Articles 13 and 14 and all information concerning processing under Articles 15–22 and Article 34 can be provided to data subjects in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Yöpuu Yhtiö Oy is a company in the hospitality industry that provides accommodation and restaurant services to its customers. This privacy policy describes the principles of processing and protecting personal data, through which Yöpuu Yhtiö, as the controller, protects personal data in various situations.
In the privacy policy, the controller is hereafter referred to as “Yöpuu Yhtiö” or “the controller”.
