Privacy Policy

This is ABL Finland Oy’s Customer, Supplier and Marketing Register Privacy Notice. We at ABL Finland Oy (hereinafter ABL or "we") are committed to protecting your personal data and follow applicable laws and regulations concerning the processing of personal data. Below we provide more information on how we process your personal data. (Updated 7th Oct 2021)

1. CONTROLLER

ABL Finland Oy (Business ID 1455541-0)
Kirkonkyläntie 103
00740 Helsinki
tietosuoja(a)abl.fi

2. NAME OF THE REGISTER

Customer, Supplier and Marketing Register

3. PURPOSE OF THE PROCESSING OF PERSONAL DATA

We collect your personal data in connection with your visit to our store or online service platform, for example when you book an appointment for planning, ask for quotation, purchase a product, subscribe to our newsletter or answer our customer survey.

We use personal data stored in the Customer, Supplier and Marketing Register for maintaining the customer relationship as well as for the purposes of customer service, development of products and services, informing, and marketing. Below you can find a list of the types of personal data we collect:

Personal data	Purpose of processing	Legal basis
Basic information of the data subject and Information of the company’s contact persons, such as the names of the contact persons, contact details and professional title (email address, phone number, address)*	a) Delivery and development of products and services you have ordered b) Fulfilling our contractual duties b) Billing c) Direct marketing d) Bookkeeping	a) Legitimate interest b) Performance of a contract c) Legitimate interest (companies) or consent (private persons) d) Legal obligation
Possible direct marketing opt-outs	Serving customers interest of not receiving direct marketing	Legitimate interest in being able to fulfil our legal obligation to ensure opt-out from direct marketing in accordance with the law
Information you provide in connection with the events we host, registration data, special diets, invoicing data	Organizing events	Legitimate interest in being able to host events and invoice when applicable Consent regarding health data (e.g. allergies)
Information of the customer relationship and the contract such as information of past and current contracts and orders, correspondence with you and other communications, payment information* Other information which you have voluntarily provided to our systems	a)Compliance with our contractual and other promises and obligations a) Billing b) Managing the customer relationship and providing information b) Acquiring and ordering products and services necessary for maintaining our business c) Bookkeeping	a) Performance of a contract b) Legitimate interest in managing and developing the customer relationship c) Legal obligation
Video surveillance data	Securing and monitoring the outer areas of our company’s facilities. A person might be identified.	Legitimate interest
Photographing at events	Organizing and hosting events	Legitimate interest
Data of the connection and terminal device you are using such as the IP address, device ID, operating system or other device identifier and cookies	Targeting advertising in our online services. Analyzing and profiling behavior target marketing and to improve our services to better meet our customers’ needs.	Consent

*Providing information marked with and asterisk is a requirement for our contractual and/or customer relationship. Without the necessary information we are not able to provide our product or service.

4 FROM WHAT SOURCES DO WE RECEIVE INFORMATION?

We receive information primarily from you when you use our services. In addition, we receive information from authorities, credit information companies, contact information service providers and other similar reliable sources.

For the purposes described in this privacy notice, personal data may also be collected and updated from publicly available sources, such as newspapers and news, professional social media networks and company websites, as well as based on information received from authorities or other third parties within the limits of the applicable laws and regulations. Such updating of data is performed manually or by automated means.

5 TO WHOM DO WE DISCLOSE INFORMATION,
AND DO WE TRANSFER INFORMATION OUTSIDE OF THE EU OR EEA?

We may disclose information contained in this customer, supplier and marketing register to our partners who perform marketing or arrange campaigns and events with us and on our behalf, and who consider themselves as controllers and not processors acting on our behalf (such entities are e.g. different social media service providers and marketing networks). In other instances, we do not disclose the data contained in the register to outsiders, unless obliged to do so by law or by an order from an authority.

We process data ourselves, in addition to which we use subcontractors who process personal data on our behalf. We have outsourced IT management as well as management of our customer and marketing systems to external service providers, and personal data is stored in systems managed and protected by such parties.

As part of our operations, we transfer personal data outside the EU/EEA area. When personal data is transferred, we ensure that such information is protected appropriately and as required by applicable data protection laws, by using EU commission’s standard contractual clauses and additional safety measures, where necessary.

6 HOW DO WE PROTECT INFORMATION AND HOW LONG DO WE STORE THEM?

Only those of our employees, who on behalf of their work are entitled to process customer data, are entitled to use the system containing personal data. Each user has a personal username and password to the system. The data is collected into databases that are protected by firewalls, passwords and other technical measures. The databases and their backup copies are in locked premises and can be accessed only by certain pre-designated persons.

We store personal data for as long as necessary for the purposes for which the data is used. Personal data stored in the customer, supplier and marketing register will be deleted after the time period for submitting claims and complaints relating to a specific customer or partner relationship has expired. This time period is typically ten (10) years. Data processed for marketing purposes is stored indefinitely.

We estimate regularly the need for data storage taking into account the applicable legislation. In addition, we take care of such reasonable actions that ensure no incompatible, outdated or inaccurate personal data is stored in the register taking into account the purpose of the processing. We correct or erase such data without delay.

7 WHAT ARE YOUR RIGHTS?

You have the right to inspect the personal data stored in the register concerning yourself and the right to demand rectification or erasure of outdated, unnecessary or unlawful data. If you have access to your data, you may edit the data yourself. Insofar as the processing is based on consent, you also have the right to withdraw or change your consent. Withdrawing your consent does not affect the lawfulness of processing before the withdrawal of the consent.

You have the right to object or to demand restriction of the processing of your data and to lodge a complaint with the supervisory authority.

Office of the Data Protection Ombudsman:

PL 800, 00521 Helsinki
tietosuoja@om.fi
029 566 6700

On grounds relating to your particular situation, you also have the right to object other processing activities when the legal basis of processing is legitimate interest. In connection with your request, you shall identify the specific situation, based on which you object to the processing. We can refuse the request of objection only on legal grounds.

8 CHANGES TO THIS STATEMENT

When we make changes to this statement, we will update the new statement to our website and state the date of the update. If the changes we make are substantial, we may inform you of them by other means, for example by sending you an email or providing an announcement on our website. We recommend that you visit this statement regularly to stay informed of possible changes.