Privacy notice for the Kymdata Oy marketing and customer registry
1. Data controller’s name and contact information
Kymdata Oy and its subsidiary CADS Planner Ab
Business identity code: 1445607-6
Heikinkatu 7, 48100 Kotka
phone 05 227 5100
2. Contacts for registry issues
Customer service, Kymdata Oy, firstname.lastname@example.org
3. Name of registry and data subjects
Kymdata Oy marketing and customer registry. In our registry, we process the personal data of Kymdata Oy customers and potential customers as well as their representatives.
4. Purpose of the processing of personal data
The information in the marketing and customer registry is mainly used for the purposes of providing and producing services, customer communications, business planning and development, maintenance, care and development of customer relations, as well as improving the CADS user experience. Our goal is to target our communications in a way that ensures that you receive exactly the kind of communication that suits you. Furthermore, the information is used for various forms of marketing and carrying out opinion and market surveys.
The processing of your personal data may be based on your consent, on the fulfilment of a mutual agreement or for the safeguarding of our legitimate interests. If you are our direct contracting party, we will process your personal data at least for the purpose of fulfilling the obligations of said agreement. If at issue is the providing of training or services for you on the basis of an agreement signed with your employer or educational institution, we will process your personal data to further our legitimate interests, which in this case is the need to avoid neglecting the agreement and to fulfil the obligations of said agreement (in practice, the providing of training or other service acquired for your benefit).
When at issue is the marketing of our products or issuing notifications concerning our company, the processing of personal data is based on the need to promote our business for the realisation of our legitimate interest. In order to respect your basic rights, your privacy in particular, we will try to limit our communications to such messages as are relevant in terms of your profession, work tasks or stated interests, and we will limit the amount of communications as is possible.
In other cases, your personal data will only be processed by your consent.
5. Data content of the register
The registry contains the following data:
- Basic personal data, such as given and family names, address data, job at the company, telephone number, email address and profiling data based on the job description
- Company data, such as name of the company, contact information, business ID number, turnover class, personnel class and field of activity
- Data related to invoicing, payment behaviour and payment history
- Agreement data, such as information on ordered products and services
- Log in data for services
- Data related to client account management and communications (e.g., purchasing and cancellation data, customer feedback, communications between the customer and Kymdata and recordings of customer service events)
- Data related to network behaviour on the Kymdata website and on various web services
- Registration data for various events (trainings, webinars, seminars)
6. Registry data sources
We will mainly collect your personal data from yourself. We may also receive some data from your employer who signs you up for training or a seminar provided by us. We will collect your data when you use or download Kymdata services, sign an agreement, contact us or sign up for our events. Your data may be collected and updated or purchased as once-only packages from registries maintained by Asiakastieto or Fonecta or other similar public and private registries and sources, to the extent allowed by applicable laws.
If you wish to purchase or use our services, the signing of the agreement will require the submission of necessary personal data. If you choose not to submit such data, you will not be able to use our services.
7. Data transfers
Kymdata Oy may further transfer the data for the purposes of payment services, data processing (in this case invoice processing including invoice mailing and payment control) or similar comparable tasks on behalf of the data controller. Your data will not be transferred to other data controllers. We will however employ subcontractors for the processing of your personal data, who will realise procedures as data processors based on our instructions and orders and for the purposes stated in the registry.
8. Data transfers to countries outside the EU or EEA
We may transfer your data to countries outside of the EU or the European Economic Area when our partner taking care of the commission is located outside of these areas. In such cases, we will ensure that proper protective measures are implemented in order to guarantee the rights and freedoms of data subjects, in accordance with the applicable data protection legislation, such as the European General Data Protection Regulation (679/2016).
For example, a service provider doing marketing for us may transfer personal data to the United States during the providing of the service. In this case, the proper data protection has been implemented by committing to the Privacy Shield framework in effect between the USA and the EU. You may read more about the Privacy Shield framework here [https://www.privacyshield.gov/welcome].
9. Keeping and protecting the registry and the storage period of personal data
The personal data in the registry are stored confidentially, and may only be accessed by persons who process personal data as a part of their job. All persons with access to the registry are bound by confidentiality in terms of all customer data. The registry data have been collected in databases owned by Kymdata Oy, which are located in Finland and have been protected by firewalls, passwords and other technical means. We respect the confidentiality of your personal data. All outdated and unnecessary data are destroyed by appropriate means. We will only store your personal data for as long as is necessary to fulfil the processing purposes of personal data specified in this privacy notice. Due to obligations imposed by the Accounting Act or other applicable law, we may have to store your data for longer than the time period specified above.
10. Maintaining the registry
Kymdata Oy will remove, rectify or supplement all erroneous, unnecessary, incomplete or outdated data either on its own initiative or by your request. A request for rectification shall be executed in writing.
11. Rights of the data subject
If the processing of your personal data is based on your consent as presented above, you may withdraw your consent at any time. Withdrawing your consent shall have no impact on the legality of the processing taking place before the withdrawal, nor shall it prevent us from processing your data on other grounds specified above to the extent enabled by the grounds in question.
You are entitled at any time to object to the processing of your personal data for direct marketing purposes. Each direct email sent by Kymdata includes a link, which you can use to stop receiving direct emails in the future.
You are entitled to review your personal data stored in the registry and receive copies thereof. A review request must be submitted in writing with your signature and addressed to our customer service. We may ask you to specify your request and to confirm your identity before processing your request. We may reject your request on grounds specified in applicable law. Kymdata Oy will respond to your requests within 1 month of making the request, provided that there are no special reasons to increase the response time.
You are entitled to demand that all inaccurate or erroneous data are rectified without undue delay. If necessary, we may request that you submit necessary reports or information for the rectification, which you are obliged to submit.
If the conditions of the relevant legislation are fulfilled, you are entitled to demand that all of your personal data are deleted without undue delay.
If the conditions of the relevant legislation are fulfilled, you are entitled to demand that the use of your personal data is restricted.
Insofar as at issue is the automatic processing of your personal data based on your consent, you are entitled to receive all personal data pertaining to and submitted by you in a structured, commonly used and machine-readable format and to transmit said data to another data controller.
You may submit any requests and demands pertaining to your rights in writing or by email to the following contact information:
Customer service / Data protection
12. Changing the privacy notice
We reserve the right to make changes to this privacy notice by informing about the changes on this page.