Privacy policy
This statement describes the processing of personal data in accordance with the EU General Data Protection Regulation (679/2016).
Data controller
Kuatro Oy
Business ID: 3421992-4
Address: Mursketie 6, 36220 KANGASALA
Contact for data protection matters
Giuseppe Baruffa
Data subjects are encouraged to contact the person named above with any questions concerning the processing of personal data or the exercise of their rights.
Name of the personal data register
Kuatro Oy Customer Register
Legal basis and purposes of processing personal data
The legal bases for processing personal data are:
- The data subject's consent to the processing of personal data
- A contractual relationship between the data subject and the controller
- Compliance with the controller's statutory obligations
- The controller's legitimate interest based on the customer relationship between the data subject and the controller
The purposes of processing personal data include providing and maintaining services, managing and developing customer relationships, marketing and communications, complying with statutory obligations, developing the business and services, preventing fraud and ensuring security.
Personal data processed
The controller collects only personal data that is relevant and necessary for the purposes described in this privacy statement.
The following data is processed:
- Email address
- Name
- Company details and other contact details provided by the data subject
Disclosure of personal data
Personal data is not disclosed to third parties unless required by law. In exceptional cases, data may therefore be disclosed to authorities, for example, where required by law.
Transfers of personal data to third countries
Personal data is not transferred outside the EU and the European Economic Area.
Data retention period
The controller processes personal data for as long as necessary to fulfil the purposes of processing. After this period, the controller deletes or anonymises the data within a reasonable time in accordance with its deletion procedures.
The controller may be required to process some personal data in the register for longer than stated above to comply with legislation or regulatory requirements.
The controller processes personal data for as long as required by law.
Rights of the data subject
Right of access to personal data
The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and, if so, to receive a copy of their personal data.
Right to rectification
The data subject has the right to request the correction of inaccurate or incorrect personal data concerning them. They also have the right to have incomplete personal data completed by providing the necessary additional information.
Right to erasure
The data subject has the right to request the erasure of their personal data if:
a. the data is no longer necessary for the purposes for which it was collected;
b. the data subject withdraws the consent on which processing was based and there is no other lawful basis for processing; or
c. the personal data has been processed unlawfully.
Right to restriction of processing
The data subject has the right to restrict the processing of their personal data if:
a. they contest the accuracy of their personal data;
b. processing is unlawful and they oppose erasure and request restriction of use instead; or
c. the controller no longer needs the data for the original purposes of processing, but the data subject needs it to establish, exercise or defend legal claims.
Right to object
The data subject has the right to object at any time to the processing of their personal data on grounds relating to their particular situation.
The controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for processing that override the data subject's interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing, the data subject has the right to object at any time to processing for such marketing, including profiling insofar as it relates to direct marketing.
Right to withdraw consent
The data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Right to data portability
The data subject has the right to receive personal data concerning them that they have provided in a structured, commonly used and machine-readable format, and to transmit that data to another controller.
Right to lodge a complaint with a supervisory authority
The Office of the Data Protection Ombudsman, operating under the Ministry of Justice, is the national supervisory authority for personal data matters. You have the right to bring your case before the supervisory authority if you consider that the processing of your personal data infringes the applicable legislation.