Privacy Policy

Privacy Policy

Company Knotify Store FI22559964 Y-2255996-4 customer register, marketing register, stakeholder register, online service
user register, member register.

Legal basis and purpose of processing personal data

The legal basis for processing personal data under the EU General Data Protection Regulation
is:

  • person's consent
  • law EU General Data Protection
    Regulation (GDPR)
  • the legitimate interest of the controller (e.g. customer relationship before contract, employment, membership).

The purpose of processing personal data is to communicate with customers, maintain customer relationships, market, etc. The data is not used for automated decision-making or profiling.

Data content of the register

The information stored in the register includes:

the person's name, position, company/organization, contact information (telephone number, email address, address), website addresses, IP address of the network connection,
usernames/profiles in social media services, information about ordered services and their changes, billing information, other information related to the customer relationship and ordered services.

The information is stored until the customer wants it deleted or the need for it changes or disappears.

The IP addresses of website visitors and cookies necessary for the service's functions are processed on the basis of legitimate interest, for example, to ensure data security and to collect statistical information about website visitors in cases where they can be considered personal data. If necessary, consent is requested separately for third-party cookies.

Regular sources of information

The information stored in the register is obtained from the customer, for example, through messages sent via web forms, email, telephone, social media services, contracts, customer meetings and other situations in which the customer provides their information.

Information about contact persons of companies and other organizations can also be collected from public sources such as websites, directory services and other companies.

Regular data transfers and data transfers outside the EU or EEA

The data is not routinely disclosed to other parties. The data may be published to the extent agreed with the customer.

The data may also be transferred by the controller outside the EU or EEA. The data will not be transferred to the United States without the express consent of the data subjects.

Principles of register protection

The register is handled with care and the data processed by the information systems are protected appropriately. When the register data is stored on Internet servers, the physical and digital security of their equipment is
appropriately ensured.

The controller ensures that the stored data, as well as the access rights to the servers and other information critical to the security of personal data, are handled confidentially and only by employees whose
job description requires it.

Right to inspect and right to request correction of information

Every person in the register has the right to check their data stored in the register and to demand correction of any incorrect data or completion of incomplete data.

If a person wishes to check the data stored about them or to demand correction, the request must be sent in writing to the controller.

The controller may, if necessary, ask the person making the request to prove their identity. The controller will respond to the customer within the time period stipulated in the EU Data Protection Regulation (generally within one month).

Other rights related to the processing of personal data

A person in the register has the right to request that personal data concerning him or her be deleted from the register ("right to be forgotten"). Data subjects also have other rights under the EU General Data Protection Regulation, such as the restriction of the processing of personal data in certain situations.

Requests must be sent in writing to the controller. The controller may, if necessary, ask the person making the request to prove their identity. The controller will respond to the customer within the time period set out in the EU Data Protection Regulation (generally within one month).