Privacy Policy
Data Controller
Kluuvin Apteekki ()
Hereinafter referred to as Company in this notice
Data Protection Officer and/or Contact Person
096213663
kluuvinapteekki@apteekit.net
Name of Personal Data Register
Kluuvin Apteekki customer and marketing register
This privacy notice applies to the processing of personal data related to our websites, marketing and customer relationship management, as well as the products and services we provide.
Personal Data Collected and Data Sources
We collect personal data necessary for managing customer relationships.
| Data Category | Examples of Data Content |
| Identification and contact data | Customer and/or representative's name and contact information. |
| Data concerning products and services, their orders and customer communications | Information on orders, order delivery times, and data related to agreements, billing, customer communications and complaints. |
| Data related to marketing (including direct marketing) and events, as well as consents and objections provided by the data subject | Contact information for marketing purposes, and data collected in connection with events and occasions. Consents and objections concerning direct marketing. |
| Data concerning the use of websites and other electronic services | IP address, electronic communication identification data, search and browsing data, browser and operating system data, and registration data |
We collect personal data directly from the data subject and from publicly available registers maintained by public authorities and other external sources, such as the Business Register or similar public company registers. Additionally, we collect data from those who fill out contact forms and use this data for the aforementioned customer relationship management purposes.
Purpose and Legal Basis for Processing Personal Data
Personal data is processed within the limits permitted by applicable legislation for the following purposes:
- Delivery of products and services and conclusion of customer agreements (contractual relationship or its preparation)
- Customer relationship management (legitimate interest)
- Service information and advice (legitimate interest)
- Web service testing (legitimate interest)
- Product and service development (legitimate interest)
- Collection and analysis of user statistics (consent, legitimate interest)
- Improving the user experience of our websites and other services (consent, legitimate interest)
- Billing, credit decisions and debt collection (legitimate interest)
- Marketing communications (legitimate interest)
- Direct marketing, including electronic direct marketing and telephone marketing, as well as planning and measuring the effectiveness of advertising and marketing, and combining and updating personal data for direct marketing purposes (legitimate interest, consent)
- Stakeholder relationship management and subcontracting, as well as cooperation with service providers (legitimate interest, contractual relationship or its preparation)
- Internal reporting and other administrative measures (compliance with legal obligation)
- Management of warranty and liability issues, handling of complaints, and management of legal and administrative proceedings (legitimate interest)
- Prevention and investigation of misconduct, and ensuring information security, personal safety and property protection (legitimate interest)
- Performance of other legal obligations (e.g., accounting and taxation-related measures) and reporting obligations
If the processing of personal data is based on consent given by the data subject, the person may at any time withdraw their consent by notifying the aforementioned contact person.
Processing of personal data may be necessary for implementing the legitimate interests of the Company and the data subject in maintaining a customer relationship. The Company has a legitimate interest in processing personal data for marketing, service and customer analysis and service testing. Profiling may also be involved in marketing purposes. In such cases, the data subject has the right to object to the processing of their personal data. When personal data is processed based on a legitimate interest, we have assessed the benefits of processing and potential harm to the data subject, and we conclude that the rights and interests of data subjects do not override the legitimate interest. We provide additional information upon request regarding personal data processing based on legitimate interest.
Personal Data Processors
Access to personal data is restricted to personnel responsible for customer relationship management and marketing.
Personal Data Recipients
Various service providers and other third parties may be used in personal data processing, such as technical solution providers, hosting providers, or accounting and financial administration service providers. We ensure that the parties we use in personal data processing have the contracts required by data protection legislation in place.
Personal data may be disclosed to third parties when required by law or by a public authority, or to investigate misconduct and ensure security. Additionally, personal data may need to be disclosed in connection with legal proceedings or similar legal processes.
If the Company is involved in a merger, business acquisition or other corporate restructuring, personal data may be disclosed to the parties involved in the arrangement or those assisting in the arrangement.
We provide additional information upon request regarding personal data recipients.
Transfer of Personal Data Outside the European Economic Area
Personal data will not be transferred outside the European Union or the European Economic Area unless it is necessary for the technical implementation of the service. In cases where data is disclosed and transferred, we comply with the level of data protection required by data protection legislation and implement other necessary safeguards.
We provide additional information upon request regarding personal data transfers and the protection mechanisms used.
Cookies
We use cookies and similar technologies on our website. A cookie is a small text file that the browser stores on the user's device. Cookies contain an anonymous, unique identifier that allows us to identify and count different browsers visiting our website. The purpose of using cookies and similar technologies is to analyze and further develop our services to better serve users and to target advertising. Users can manage their cookie consent through the cookie tool on our website.
Protection of Personal Data
We protect personal data using appropriate technical and organizational measures. Data is collected into databases that are protected by firewalls, passwords and other technical security measures. Databases and their backups are located in locked and guarded premises, and only specific, pre-designated individuals have access to the data.
Personal Data Retention Period and Deletion
Personal data is retained as long as it is needed for the purpose for which it was collected and processed, for the performance of a contract, or as long as law and regulations require. After that, personal data is destroyed appropriately.
Rights of the Data Subject
The data subject has the following rights:
- Right of access to personal data. The data subject has the right to obtain confirmation of whether their personal data is being processed and other information required by data protection legislation regarding personal data processing. The data subject has the right to receive a copy of their personal data.
- The data subject may request correction of data if the data is incomplete or inaccurate.
- The data subject may request deletion of data when there is no reason for its processing as referred to in data protection legislation and independent of the data subject's consent.
- The data subject has the right to restrict personal data processing if the accuracy or lawfulness of the data so requires, or in accordance with the right to object, if the data subject requests that processing be restricted to data retention only. The data subject has the right to object to data processing for direct marketing purposes based on the Company's legitimate interest.
- The data subject may request that their data be transferred to another data controller. The right to transfer applies in principle to such personal data that the data subject has provided to the data controller in a structured and machine-readable format, and the processing of which is based on the data subject's consent or a contract, and/or for which processing is carried out automatically.
- Right to withdraw consent. If the processing of personal data is based on consent given by the data subject, the data subject has the right to withdraw their consent for the processing of personal data concerning them. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
- The data subject must submit requests concerning their rights in writing or by email using the following contact information:
Kluuvin Apteekki
Access/Other Personal Data Request
kluuvinapteekki@apteekit.net
The identity of the person making the request may be verified before processing the request. The Company will respond to requests within 1 month of receiving the request, unless there are specific reasons to extend the response period.
The data subject has the right to lodge a complaint with the competent data protection authority if they consider that their personal data has been processed in violation of data protection legislation.
The contact details of the Finnish data protection authority can be found here.
