Privacy Statement

Last updated: March 17, 2023

This privacy statement applies to citizens and legal permanent residents of the European Economic Area, Switzerland, United States, and Canada.

This privacy statement explains what we do with the data we obtain about you via https://pikkuna.fi/. We recommend you carefully read this statement. In our processing, we comply with the requirements of privacy legislation. That means, among other things, that:

• we clearly state the purposes for which we process personal data. We do this by means of this privacy statement;
• we aim to limit our collection of personal data to only the personal data required for legitimate purposes;
• we first request your explicit consent to process your personal data in cases requiring your consent;
• we take appropriate security measures to protect your personal data and also require this from parties that process personal data on our behalf;
• we respect your right to access your personal data or have it corrected or deleted, at your request.

If you have any questions or want to know exactly what data we keep of you, please contact us.

1. Purpose, data and retention period

Last updated: March 17, 2023

We may collect or receive personal information for a number of purposes connected with our business operations which may include the following:

1.1 Contact — Through phone, mail, email and/or webforms

Data we collect:

• A first and last name
• A home or other physical address, including street name and name of a city or town
• An email address
• A telephone number

Legal basis: It is necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party.

Retention period: We retain this data until the service is terminated.

1.2 Payments

Data we collect:

• A first and last name
• A home or other physical address, including street name and name of a city or town
• An email address
• A telephone number

Legal basis: It is necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party.

Retention period: We retain this data upon termination of the service for the following number of months: 120

1.3 To be able to comply with legal obligations

Data we collect:

• A home or other physical address, including street name and name of a city or town

Legal basis: For compliance with a legal or regulatory obligation.

Retention period: We retain this data until the service is terminated.

1.4 Compiling and analyzing statistics for website improvement.

Data we collect:

• IP Address
• Internet activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement
• Geolocation data

Legal basis: It is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, and that interest outweighs the interest of the person concerned.

Retention period: Upon termination of the service we retain this data for the following period: 26 months.

1.5 Deliveries

Data we collect:

• A first and last name
• A home or other physical address, including street name and name of a city or town
• An email address
• A telephone number

Legal basis: It is necessary for the execution of a contract or preliminary procedures related to a contract to which the data subject is a party.

Retention period: We retain this data upon termination of the service for the following number of months: 120

2. Sharing with other parties

We only share this data with processors and with other third parties for which consent must be obtained.

Processors:

Name: Facebook: Facebook Inc.
Country: 1601 S. California Ave, Palo Alto, CA 94304, USA
Purpose: For analytical and marketing purposes

Name: Google, Google LLC
Country: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Purpose: For analytical and marketing purposes

3. Cookies

Our website uses cookies. For more information about cookies, please refer to our Cookie policy Cookie Policy.

4. Disclosure practices

We disclose personal information if we are required by law or by a court order, in response to a law enforcement agency, to the extent permitted under other provisions of law, to provide information, or for an investigation on a matter related to public safety.

If our website or organisation is taken over, sold, or involved in a merger or acquisition, your details may be disclosed to our advisers and any prospective purchasers and will be passed on to the new owners.

We have concluded a data Processing Agreement with Google.

5. Security

We are committed to the security of personal data. We take appropriate security measures to limit abuse of and unauthorized access to personal data. This ensures that only the necessary persons have access to your data, that access to the data is protected, and that our security measures are regularly reviewed.

Our security measures include:

• Standard business document management practices
• Access control to personal data
• Regular review of security measures

In case of a data breach, we will assess the situation and take appropriate measures to mitigate the impact and prevent future occurrences.

6. Third-party websites

This privacy statement does not apply to third-party websites connected by links on our website. We cannot guarantee that these third parties handle your personal data in a reliable or secure manner. We recommend you read the privacy statements of these websites prior to making use of these websites.

7. Amendments to this privacy statement

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly in order to be aware of any changes. In addition, we will actively inform you wherever possible.

The latest version of this privacy statement is always available on our website. We will update the “Last updated” date at the top of this privacy statement when we make changes.

Your continued use of our website after any changes to this privacy statement constitutes your acceptance of such changes.

8. Accessing and modifying your data

If you have any questions or want to know which personal data we have about you, please contact us. You can contact us by using the information below. You have the following rights:

• You have the right to know why your personal data is needed, what will happen to it, and how long it will be retained for.
• Right of access: You have the right to access your personal data that is known to us.
• Right to rectification: you have the right to supplement, correct, have deleted or blocked your personal data whenever you wish.
• If you give us your consent to process your data, you have the right to revoke that consent and to have your personal data deleted.
• Right to transfer your data: you have the right to request all your personal data from the controller and transfer it in its entirety to another controller.
• Right to object: you may object to the processing of your data. We comply with this, unless there are justified grounds for processing.

Please make sure to always clearly state who you are, so that we can be certain that we do not modify or delete any data of the wrong person.

9. Submitting a complaint

If you are not satisfied with the way in which we handle (a complaint about) the processing of your personal data, you have the right to submit a complaint to the Data Protection Authority.

10. Contact details

Suomen Pehmeä Ikkuna Oy
Teollisuustie 10, 54800 Savitaipale, Finland

Website: https://pikkuna.fi/en
Email: info@pikkuna.fi
Phone number: +358 40 0179039

11. Changes to this Privacy Statement

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly in order to be aware of any changes. In addition, we will actively inform you wherever possible.

The latest version of this privacy statement is always available on our website. We will update the “Last updated” date at the top of this privacy statement when we make changes.

Your continued use of our website after any changes to this privacy statement constitutes your acceptance of such changes.

12. Additional Rights for California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect about you
• The right to delete your personal information
• The right to opt-out of the sale of your personal information
• The right to non-discrimination for exercising your CCPA rights

To exercise these rights, please contact us using the information provided in the “Contact details” section.

13. Additional Rights for Canadian Residents

If you are a Canadian resident, you have additional rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):

• The right to access your personal information
• The right to challenge the accuracy of your personal information
• The right to withdraw consent for the collection, use, or disclosure of your personal information

To exercise these rights, please contact us using the information provided in the “Contact details” section.

14. Children’s Privacy

Our website is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us, and we will take steps to delete such information.

In accordance with the Children’s Online Privacy Protection Act (COPPA), we will not knowingly collect, use, or disclose personal information from children under the age of 13 without prior parental consent.

15. Cross-Border Data Transfers

Your personal information may be transferred to, and processed in, countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal information from Canada to other countries, we take appropriate safeguards to ensure that your personal information remains protected in accordance with PIPEDA.

When we transfer personal information from the European Economic Area to other countries, we ensure that appropriate safeguards are in place to protect your personal information in accordance with applicable data protection laws.

16. Additional Rights for Quebec Residents

If you are a resident of Quebec, you have additional rights under Law 25 (formerly Bill 64):

• The right to data portability — you can request your personal information in a structured, commonly used format
• The right to be informed about automated decision-making — we will inform you when your personal information is used to make an automated decision
• The right to withdraw consent at any time
• The right to request the cessation of dissemination of your personal information

We have implemented the following measures to comply with Law 25:

• Appointed a privacy officer responsible for the protection of personal information
• Conduct privacy impact assessments for new projects
• Maintain a register of confidentiality incidents
• Implement privacy by default in our systems and processes

In case of a confidentiality incident involving your personal information, we will:

• Notify you without delay if the incident presents a risk of serious injury
• Notify the Commission d’accès à l’information du Québec if the incident presents a risk of serious injury
• Take reasonable measures to reduce the risk of injury and prevent new incidents of the same nature

To exercise your rights under Law 25, please contact our privacy officer using the information provided in the “Contact details” section.