Privacy Statement

Customer and Marketing Database Privacy Statement

1 Controller

Hublet Oy, Itälahdenkatu 22 B, 00210 Helsinki, Finland.

2 Contact Person in Matters Relating to the Personal Data File

The data protection officer of Hublet Oy. Contacts:

3 Name of the Personal Data File

Customer and Marketing Database Privacy Statement.

4 Purpose of Personal Data Processing

Personal data are collected for specified, explicit and legitimate purposes. The data are gathered for the purposes of taking care of the customer relations, keeping in contact with the customers and maintaining the marketing communications process with the customers and stakeholders.

The personal data are gathered in accordance with this privacy statement and they will not be used, altered or transferred in ways not mentioned in this privacy statement. The personal data are collected only with means agreed to in advance, which have been communicated to customers and stakeholder prior to collecting the data and their proven consent for the collection and processing of the data has been obtained. The customers have been notified of possible profiling and it has been made clear that they have the right to withdraw their consent, in which case profiling will cease without delay.

5 Content of the Data File

The data file contains personal data on the customers of Hublet Oy: first name, last name, email address, telephone number, indicator data related to profiling and the use of commodities, and data provided by customers and stakeholders directly to Hublet Oy.

6 Regular Destinations of Disclosed Data

Hublet Oy has decided not to transfer data in our possession to third parties or automatically to other Hublet Oy partners. In individual cases, Hublet Oy discloses data on a customer or stakeholder to the designated party if the data subject so requests or if a competent authority requires Hublet Oy on legal grounds to disclose specified data in the database in our possession.

7 Data Transfer to Third Countries or International Organizations

Hublet Oy has decided not to transfer data in our possession automatically to third countries or international organizations. In individual cases, Hublet Oy discloses data to third countries or international organizations if the customer or stakeholder has mandated us for such a purpose and if we have together with the data protection officer and the Finnish data protection authority assessed the risks and the quality system of the actual data security level of the third country.

8 Principles of Securing the Data File

Hublet Oy secures the personal data file referred to in this privacy statement based on the required security level derived from risk assessment. The data protection officer participates in the risk assessment process and provides an objective statement of the final decision regarding data protection, which Hublet Oy will adhere to. In securing the personal data file, Hublet Oy observes technical security as well as the requirements of both administrative and information technology requirements.

9 Right of Access

Data subjects have the right to inspect what data on them have been stored in the file. In addition, after a sufficiently detailed and accurate request, data subjects have the right of access to the data on them stored in the data files. The request for access must be delivered in written form and with the subject’s signature to the following address: Hublet Oy, Itälahdenkatu 22 B, 00210 Helsinki, Finland.

10 Right to Rectification and Erasure

The controller must rectify inaccurate data in the personal data file indicated by the data subject. The controller is also obligated to independently verify that the data in the data file are accurate and up to date. Data subjects may also request that the controller erases data on them from the file. This procedure is managed by the data protection officer.

11 Other Rights Pertaining to Personal Data Processing

Data subjects have the right to request a restriction of processing data on them. Data subjects also have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller. In addition, data subjects have the right to object to processing of personal data, automated decision-making and profiling.

12 Erasure of Data and Time of Storage

Hublet Oy removes data on a customer from the data file, when there no longer are operational grounds for their processing or if data subjects exercise their legal right to request from Hublet Oy the erasure of data on them. The data are erased by overwriting, when their processing or keeping is no longer justified. The data are not erased, however, if specific provisions have been issued by laws or regulations or if a competent authority has initiated a process that requires Hublet Oy to keep the data or if a Finnish court of law has been requested to decide on safeguarding the data.

13 Approval of the Privacy Statement

This privacy statement has been inspected and its continuation has been approved on the 25th of April 2018.