Drawn up in accordance with the EU General Data Protection Regulation (GDPR, 2016/679). Valid until further notice.

Controller

Harmaa Kissa Oy (HK-Hirsityökalut)

Tourunkulmantie 867D, 31160 Nuutajärvi, Finland

hirsi@hirsityokalut.fi

+358 400 500 811

Contact for register-related matters

hirsi@hirsityokalut.fi

Name of register

Customer register of the Hirsityökalut.fi online shop

Purpose and legal basis for processing personal data

Personal data is processed for the following purposes:

• Managing the customer relationship and fulfilling orders (legal basis: performance of a contract, GDPR art. 6.1 b)
• Fulfilling statutory obligations, such as accounting (legal basis: legal obligation, GDPR art. 6.1 c)
• Direct marketing and newsletters (legal basis: legitimate interest or consent, GDPR art. 6.1 f or 6.1 a)

Customers have the right to object to the use of their data for direct marketing at any time. Objections should be sent by e-mail to the address above.

Contents of the register

The register may contain the following data:

• Name and contact details (address, telephone number, e-mail address)
• Customer number
• Information on orders, deliveries, and invoicing
• Username and password, where applicable (stored in encrypted form)

Regular disclosures of data

Data is used solely for managing the customer relationship and is neither sold nor regularly disclosed to third parties.

Data may, however, be disclosed to:

• Carriers for the purpose of delivering orders
• Payment service providers for processing payments
• Service providers responsible for the technical administration of the online shop platform and server
• Debt collection agencies for the recovery of outstanding receivables
• Authorities where required or permitted by law

Transfer of data outside the EU or EEA

No data is transferred outside the European Union or the European Economic Area.

Retention period

Customer data is retained for the duration of the customer relationship. Order, invoicing, and payment records are retained for the period required by accounting legislation (generally six years from the end of the financial year). Data that is no longer needed is deleted securely.

Cookies

The online shop may use cookies to monitor visitor traffic and improve the quality of the service. Cookies are small text files stored in the user’s browser. They do not harm the device and do not contain personally identifying information.

Users can manage cookie settings in their browser or via any cookie consent banner displayed on the site.

Rights of the data subject

Every data subject has the right to:

• Access their personal data held in the register
• Rectify any incorrect or incomplete data
• Request erasure of their data (“right to be forgotten”) where there is no longer a basis for processing
• Restrict the processing of their data
• Data portability — to receive their data in a structured format for transfer to another controller
• Object to the processing of their data for direct marketing or for purposes based on legitimate interest

Requests should be sent by e-mail to the contact address above. Requests will be responded to without undue delay and within one month at the latest.

Right to lodge a complaint with a supervisory authority

If a data subject considers that the processing of their personal data violates the GDPR, they have the right to lodge a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman

www.tietosuoja.fi

tietosuoja@om.fi

P.O. Box 800, FI-00531 Helsinki, Finland