Privacy Policy, Picnic Finland Oy

1 CONTROLLER

Picnic Finland Oy
Business ID: 0789907-1
Visiting address: Kalevankatu 12, 00100 Helsinki

Postal address: Kalevankatu 12, 00100 Helsinki, Finland

2 CONTACT PERSON FOR MATTERS CONCERNING THE REGISTER

Data Protection Officer:CFO, Picnic Yhtiöt Oy
Telephone: 020 753 0600
E-mail address: taloushallinto@picnic.fi

3 NAME OF THE REGISTRY

Picnic Finland Oy’s customer register

4 PURPOSE AND BASIS OF THE PROCESSING OF PERSONAL DATA

The primary basis for the processing of personal data is the customer relationship between Picnic Finland Oy and the customer, an order or the customer’s consent to the processing of personal data.

Personal data may be processed for the following purposes by Picnic Finland Oy or its authorised partner or professional:

Offering, delivering, producing and designing Picnic Finland Oy’s services and products.
Managing and maintaining the customer relationship between Picnic Finland Oy and the customer, implementing, developing and monitoring customer service and related communications and marketing.
Personal data may also be processed in connection with other activities related to the management of the customer relationship.
Personal data is also processed for the purposes of ordering, invoicing, contacting, handling and reporting, and for the development of Picnic Finland Oy’s business.
Processing tasks may be outsourced to external service providers or professionals in accordance with and within the limits of data protection legislation.

5 CONTENT OF THE REGISTER

The categories of persons whose data may be processed are persons who are or have been customers of Picnic Finland Oy and persons who have been in contact with Picnic Finland Oy.

The following information may be stored about the data subject:

Basic information about the person who is or has been a customer of Picnic Finland Oy, such as name, personal identification number, gender, language and contact information (address, e-mail address, telephone number).
Data relating to the customer relationship between Picnic Finland Oy and data subjects, such as order information, customer history (e.g. service usage data including the professional category of the person handling the order, e.g. purchase handler, seller), any direct marketing authorisations and prohibitions and other communications between the parties, information about communications including. call recording and other data related to the provision of the service.
Any other information provided by the customer and any content generated by the customer (e.g. a contact request submitted via a website).
Information on any disclosures and the grounds for such disclosures.
Other customer-related information, such as information collected about the use of the website that can be linked to the data subject, such as the user’s browser, IP address, time of visit, pages visited, the network address from which the user accessed the website and the server from which the user accessed the website.
Necessary information related to the use of identification and authentication tools and services.
Information relating to the processing of the data, such as the date of recording and the source of the data.
The profiling purposes described in more detail in section 11 of this Privacy Policy.

Processing tasks may be outsourced to Picnic Finland Oy’s group companies and/or external service providers in accordance with and within the limits of data protection legislation.

6 RETENTION PERIOD OF PERSONAL DATA

Picnic Finland Oy will keep the personal data in the register until the reason for keeping the personal data expires. The retention periods are governed by the legislation in force at the time.

7 REGULAR SOURCES OF INFORMATION

The main sources of information are:

From the data subject and from events related to the data subject’s customer relationship, use of services, communications and transactions.

A party providing an identification, verification, addressing, updating, credit reference or similar service.

Population Information System of the Population Register Centre, and other known systems.

The register may also include information provided by other partners of Picnic Finland Oy, such as an insurance company.

8 REGULAR DISCLOSURES AND TRANSFERS OF DATA OUTSIDE THE EUROPEAN UNION OR THE EUROPEAN ECONOMIC AREA

Personal data will be disclosed to Picnic Finland Oy’s marketing register and any other Picnic Finland Oy’s personal registers, but always in accordance with and within the limits of data protection legislation.

Personal data will not be disclosed outside Picnic Finland Oy or parties involved in the production, development or maintenance of services and communications on behalf of Picnic Finland Oy, except in accordance with a contract, separate consent and/or explicit regulations.

In principle, customer data will not be transferred outside the European Union or the European Economic Area, but where necessary, data may be transferred outside the European Union or the European Economic Area, including to the United States, in accordance with and within the limits of data protection legislation.

9 PRINCIPLES OF REGISTER PROTECTION

Any manual material is kept in a locked room, accessible only to authorised persons. Only Picnic Finland Oy’s employees, professionals bound by a confidentiality agreement or subordinates of a partner who are entitled to process personal data by virtue of their work and who are bound by a separate data protection requirement are entitled to use the system or digital material containing personal data. Access to the workplace is controlled by badges. The information is collected in databases protected by firewalls, passwords and other technical means, including. the controlled granting and monitoring of access rights, the use of encryption techniques, the training of staff involved in the processing of personal data and the careful selection of subcontractors.

10 DATA SUBJECT’S RIGHTS IN RELATION TO THE PROCESSING OF PERSONAL DATA

10.1 Right to object to the processing of personal data and direct marketing

The data subject has the right to object, on grounds relating to his or her particular situation, to processing operations concerning him or her which Picnic Finland Oy carries out on the data subject’s personal data in so far as the processing is based on a customer relationship between Picnic Finland Oy and the data subject. The data subject may lodge an objection in accordance with point 12 of this Privacy Notice. The data subject must identify the specific situation on the basis of which he or she objects to the processing. Picnic Finland Oy may refuse to comply with a request for objection on the grounds provided for by law.

10.2 Right of access to data

The data subject has the right to check what information concerning him or her has been stored in Picnic Finland Oy’s customer register. The request for inspection should be made in accordance with point 12 of this Privacy Notice. The right of inspection may be refused on the grounds laid down by law.

10.3 Right to request rectification, erasure or restriction of processing.

A request for rectification of inaccurate, unnecessary, incomplete or outdated information will be made in accordance with point 12 of this Privacy Policy.

The data subject also has the right to require Picnic Finland Oy to restrict the processing of his or her personal data, for example, when the data subject is waiting for Picnic Finland Oy’s response to a request to rectify or erase his or her data.

10.4 Data subject’s right to data portability

To the extent that the data subject has himself/herself provided data to the customer register which are processed on the basis of the data subject’s consent or on the basis of a mandate, the data subject has the right to receive such data for himself/herself, as a rule in machine-readable form, and the right to transfer these data to another controller.

10.5 Right of the data subject to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority if Picnic Finland Oy has not complied with the applicable data protection regulation.

11 PROFILING

As part of the processing of personal data stored in the customer register, Picnic Finland Oy may also use the data for profiling purposes. Profiling is carried out by creating a customer identifier for the data subject, which can be used to combine various data concerning the data subject that are generated in connection with the use of the service. A profile created as described above can then be compared, for example, with profiles created for other registrants.

The purpose of profiling is to identify the demand for services and customer behaviour.

11.1 Use of cookies

We may collect information about a user’s terminal device through cookies and other similar technologies, such as the browser’s local data store. A cookie is a small text file that the browser stores on the user’s terminal. Cookies often contain an anonymous, unique identifier that allows us to identify and count the browsers visiting our site.

11.2 Data collection by third parties

Third parties refers to parties outside Picnic Finland Oy, such as advertisers, advertising networks and providers of measurement and monitoring services. These so-called. third parties may place cookies on your terminal device when you visit our services, for example, to provide you with targeted advertising or statistics on the number of visitors to different websites. Since the user’s browser then requests third-party advertisements from a server outside Picnic Finland Oy, these third parties can view, edit or set their own cookies as if the user were on their websites. Our contractual arrangements aim to ensure that these third parties comply with the legislation and industry self-regulatory guidelines in force at the time.

Our services may include the use of so-called. community plug-ins, such as the Facebook like button. For example, you may see buttons for Facebook community plugins on some of our services, but the content comes directly from Facebook. When a visitor visits our service, the Facebook Community Plug-in recognises that the user is logged in to Facebook, and the page then displays the customised content in the plug-in as if the user were on Facebook.com. If a user is not signed in to Facebook, community plugins will not display customised content. Facebook may collect information about a visitor’s visit in accordance with its privacy policy from time to time. Facebook will not disclose the information it collects to Picnic Finland Oy unless the user has given their explicit consent.

You can check the terms and conditions of the community services on each service. You can read the privacy policy for Facebook here, for Twitter here, for Google+ here and for LinkedIn here.

Our Services may also contain links to sites other than those listed above, but we are not responsible for the privacy practices or the content of such external sites. We recommend that you read the privacy policy of each site.

12 CONTACTS

For all questions relating to this privacy statement and in situations related to the exercise of the rights of the data subject, the person mentioned in section 2 should be contacted.

Picnic Finland Oy may, if necessary, ask the data subject to specify his or her request in writing and the identity of the data subject may, if necessary, be verified before taking any other action.

If Picnic Finland Oy finds that requests for information are being used for clearly abusive and harmful purposes, the requester may be required to pay reasonable costs for the effort required to carry out the request, or Picnic Finland Oy may refuse to carry out the request.

13 AMENDMENT OF THE PRIVACY STATEMENT

We are constantly developing our services and reserve the right to change this Privacy Statement by posting a notice on our services. Changes can also be based on changes in legislation. We recommend that you consult the contents of the privacy statement regularly.