Data protection
Updated: 28.12.2022
Register and privacy policy
A register and privacy notice in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Data controller
ePress
P.O. Box 102
Helsinki,
Finland
1646321-0
info@epress.fi
Customer service: info@epress.fi
Data Protection Officer: Kimmo Laine, info@epress.fi
The name of the registry
ePress Nordic customer register
The grounds for keeping the register
Customer relationship
The purpose of the register
The register is used for customer relationship management, customer contact and marketing.
The name and address data in the register may be disclosed for direct marketing purposes if the customer has authorised the disclosure of the data for these purposes.
The data will not be used for decision-making based solely on automated processing.
Legal basis for processing personal data
The deal. The processing of personal data is necessary for the performance of a contract between the user and ePress, i.e. for the provision of ePress services. The controller cannot provide the service without sufficient information about the data subjects entitled to use the service.
A legal obligation. The controller must process the supporting documents relating to payments as required by accounting legislation.
Consent. The data subject may give his or her consent to the disclosure of his or her personal data for direct marketing purposes. The data subject has the right to withdraw his or her consent at any time, in which case the personal data will no longer be used for direct marketing purposes.
Vested interests. The controller processes data related to the use of the service in order to develop and improve the quality of its services.
The information contained in the register
Basic information such as first and last name, phone number, email address
Company, organization name, business ID and contact information
Customer number
Language preference
Active services
Services ordered
Other information obtained during the customer relationship
Billing information
Direct marketing opt-out
Login IP address
The register does not contain all this information on all users.
Sources
The customer data in the register is obtained at the time of the establishment of the customer relationship and during the course of the customer’s changes. A direct marketing opt-out is recorded at the time of customer registration or on the basis of a separate notification. The customer’s consent to electronic direct marketing is requested separately in accordance with the Electronic Communications Services Act.
Disclosure of information
ePress Nordic may disclose customer information to the extent permitted and required by applicable law. Information may be disclosed to those partners (e.g. magazine publishers) whose products or services are used by the user and for whom ePress Nordic acts as a reseller or service provider.
If we sell, merge or otherwise reorganise our business, personal data may be disclosed to buyers and their advisors.
As a rule, data will not be disclosed to third parties without the consent of the data subject.
The data will not be transferred outside the EU or EEA.
The retention period of personal data
Personal data is stored for the entire duration of the customer relationship and for a maximum of one year after the end of the customer relationship.
Vouchers and personal data relating to payments are processed for six years from the end of the financial year to which the voucher relates.
Data processed with the consent of the data subject will be kept for a maximum of 30 days after the withdrawal of consent.
Protection of the registry
The register is processed with due care and the data processed by the information systems are adequately protected. Where the data are stored on Internet servers, the physical and digital security of the hardware is adequately ensured and in accordance with general industry security practices. The controller shall ensure that the stored data, as well as server access rights and other information critical to the security of personal data, are treated confidentially and only by ePress Nordic employees or subcontractors whose job description includes this and who are bound by a binding obligation of confidentiality.
The right of inspection and the right to request that information be corrected
Every person in the register has the right to check the information stored in the register and to request that any inaccurate or incomplete information be corrected or completed. Similarly, everyone has the right to obtain confirmation that personal data concerning him or her are not being processed. If the data subject wishes to check or request the rectification of the data stored about him or her, the request should be sent to the controller. The controller may, if necessary, ask the applicant to prove his or her identity. The controller will respond to the customer within the time limits laid down in the EU General Data Protection Regulation.
Other rights relating to the processing of personal data
A person in the register has the right to request the erasure of personal data concerning him or her from the register (“right to be forgotten”). Data subjects also have the right to object to the processing of their personal data where the processing is based on the legitimate interests of the controller. Data subjects also have the right to restrict the processing of their personal data and the right to transfer their data from one system to another. Requests should be sent to the controller. The controller may, where necessary, ask the applicant to prove his or her identity. The controller will respond to the customer within the time limits laid down in the EU General Data Protection Regulation.
If the data subject considers that the processing of personal data is not in compliance with the General Data Protection Regulation, the data subject has the right to lodge a complaint with a supervisory authority. The Office of the Data Protection Ombudsman is the supervisory authority in Finland. The contact details of the Office of the Data Protection Ombudsman are available on its website at tietosuoja.fi/yhteystiedot.