Contract register

Privacy policy
Last updated
20.03.2024

Registrar

Oy Duell Bike-Center Ab (2464132-0)
Kauppatie 19
65610 Mustasaari

Contact person in matters concerning the register

Sami Ilvonen sami.ilvonen (at) duell.eu

Legal basis for processing

Legitimate interest

Purpose of personal data processing

The purpose of the register is to maintain, manage, archive and process the organisation's customer and other stakeholder contracts and to manage the customer relationship. The data may be used to develop the controller's activities, for statistical purposes and to produce more personalised targeted content. Personal data is processed within the limits allowed and required by the Personal Data Act. The data in the register may be used by the controller's own registers, for example to target advertising without disclosing personal data to third parties. The organisation may use partners to maintain customer and service relationships, in which case parts of the register data may be transferred to the partner's servers due to technical requirements. The data will only be processed through technical interfaces with the controller organisation for the purpose of maintaining the customer relationship.

Basis of legitimate interest

The controller needs to process personal data in order to carry out its business tasks. The processing of personal data in this context cannot necessarily be justified by a legal obligation or a contract with an individual. In the balancing test, the controller has identified legitimate interest as the most appropriate ground for processing in view of the nature and scope of the processing and the exercise of the rights and freedoms of data subjects. The controller has assessed that the legitimate interest will not cause serious harm to the rights and freedoms of the individuals concerned (data subjects).

The personal data groups in question

Name, organisation represented, contact details, matters agreed in the contract.

Recipients and recipient groups

The data controller’s personnel and outsourcing partners when applicable.

Data content of the register

Contract register contains the following information: - First and last name of person - Community represented - Business ID - Email address - Postal address - Phone number - Ordered services - Other jointly agreed upon business matters

Regular sources of information

Phone and other electronic methods of communication. Data can also be obtained from subcontractors related to the use or production of a specific service. 
Data on the customers’ other activities in the digital environment can be obtained from partner websites, data systems or other digital sources using electronic sign-in (link), cookies or customer-specific identifiers. Data in the contract register are used solely by the company, except when an external service provider is used either to provide added value services or to support credit-related decision-making. Data will not be disclosed to external parties or to the company’s partners except for purposes related to credit applications, debt collection or invoicing as well as in situations required by law. A data subject’s personal data will be removed upon the data subject’s request unless such removal is prohibited by legislation, outstanding invoices, or debt collection.

Personal data retention period

10 years after the end of the contract.

Regular transfers of information

Data in the filing system are used solely by the company, except when an external service provider is used either to provide added value services or to support credit-related decision-making. Data will not be disclosed to external parties or to the company’s partners except for purposes related to credit applications, debt collection or invoicing as well as in situations required by law. A data subject’s personal data will be removed upon the data subject’s request unless such removal is prohibited by legislation, outstanding invoices, or debt collection.

Data transfer outside the EU or EEA

The data in the register will be transferred outside the EU or EEA to the UK. It is also possible that service providers outside the EU/EEA are used for processing or that the clouds of service providers are located outside the EU/EEA, in which case SCC standard clauses are used as the basis for data transfer and additional safeguards are implemented for data transfers, such as internal guidelines (on pseudonymisation of personal data and the like) and possibly TIA analysis where appropriate.

Principles of register protection A: Manual material

After initial processing, contact information and other manually processed documents containing customer data collected during customer transactions are stored in locked and fire-safe storage facilities. Only designated employees who have signed a confidentiality undertaking are authorised to process manually stored customer data. The protection and processing of data in the register is in accordance with the provisions and principles of the Data Protection Act, the regulations of the authorities and good data processing practice.

Principles of register protection B: Electronic material

Only designated employees of the organisation and companies acting on its behalf are entitled to access and maintain the contract register. Each designated user has his/her own personal username and password. Each user has signed a confidentiality undertaking. The system is protected by a firewall which protects any external access to the system. The protection and processing of data in the register is in accordance with the provisions and principles of the Data Protection Act, the regulations of the authorities and good data processing practice.

Cookies

We use cookies on our website. A cookie is a small text file that is sent to and stored on the user’s computer. Cookies do not cause any harm to the user’s computer of files. The primary purpose for the use of cookies is to improve and personalise a visitor’s user experience on our website as well as to analyse and improve the functionality and content of our site. Data collected with cookies can also be used in targeted communication and marketing as well as optimising marketing activities. Visitors cannot be identified based solely on cookies. However, data collected with cookies can be linked with possible data received from the user in other situations, for example when the user fills in a form on our website. The following types of data are collected using cookies: - visitor’s IP-address - time of visit - browsed pages and time of browsing - visitor’s browser - other? Your rights A user visiting our website has the right to prohibit the use of cookies at any time by changing his or her browser settings. Most browser software give the option of disabling cookies and of removing cookies that have already been saved. Disabling cookies may affect the functionality of the website.

Inspection right, i.e. the right to get access to personal data.

The data subject has the right to check what information about him or her is in the register. The request for inspection must be made in writing or by means of a verifiable e-mail address. Data subjects have the right to object to the processing and disclosure of their data for the purposes of direct marketing, distance and direct selling, market research and opinion polling by contacting the controller's customer service desk.

The right to transfer data from one system to another

Where a legitimate interest is used as a ground for processing, the data subject does not have the right to transfer his or her data from one system to another.

The right to demand correction of information

Taking into account the purposes of processing, any data stored in the filing system that is inaccurate, unnecessary, incomplete, or outdated must be erased or rectified. A written request for rectification, signed by hand, should be sent to the company’s customer service or the personal data filing system’s administrator. The request should specify what information should be rectified and on what grounds. Rectification shall be carried out without delay. Notification of rectification will be sent to the party who provided the inaccurate data or to whom the data were disclosed. If a request for rectification is denied, the responsible person of the filing system will provide a written document stating the grounds for the denial of the request for rectification. The data subject concerned may then pass the matter along to the Data Protection Ombudsman.

Right of limitation

The data subject has the right to request restriction of processing, for example if the personal data in the register are inaccurate. Contact the person responsible for the register.

Right to object

The data subject has the right to request personal data concerning him or her and the right to request the rectification or erasure of personal data. Such requests may be addressed to the contact person of the register. If you are the contact person of a company or organisation, your data cannot be deleted during this period.

The right to file a complaint with the supervisory authority

If you consider that an infringement of the General Data Protection Regulation has occurred in the processing of your personal data, you have the right to lodge a complaint with a supervisory authority. The complaint can also be lodged in a member state where you are a permanent resident or where you are employed. Contact information for the Finnish national supervisory authority: Office of the Data Protection Ombudsman PL 800, Lintulahdenkuja 4, 00530 Helsinki tel. +358 29 566 6700 tietosuoja@om.fi www.tietosuoja.fi/en/

Other rights related to the processing of personal data

Data subjects have the right to object to the disclosure and processing of their data for direct marketing and other marketing purposes, to request anonymisation of their data where applicable, and to be completely forgotten after the expiry of the contract.