KITTUIS Camping Privacy Policy

Updated on May 17, 2023

1. Data Controller

ELDA Interactive Oy / KITTUIS Camping

Houtskarintie 6, 21760 Houtskari

Business ID: 2718779-2

Phone: +358 50 400 7928

2. Person Responsible for Register Matters

Name: Kim Fredenberg

Mailing Address: Houtskarintie 6, 21760 Houtskari

Email: kim@eldainteractive.fi

3. Register Name

KITTUIS Camping customer register

4. Purpose of Processing Personal Data

The legal basis for processing personal data according to the EU General Data Protection Regulation is:

Legal obligation

Contract

The purpose of processing personal data is to manage customer relationships, fulfill the rights and obligations of the customer and the data controller, as well as process personal data in accordance with the Personal Data Act for purposes related to online services. We process personal data in order processing based on the contract (order).

5. Content of the Register

For the purpose of order processing, we process the following personal data based on the contract:

• Name
• Email address
• Date of birth
• City
• Country
• Travel and/or other phone number
• Organization
• Organization's address details
• Customer and order history

Connection log

Personal data is stored for at least the duration of the customer relationship. In longer storage, statutory obligations are followed, and the data controller is obliged to keep accounting records for the period defined in the Accounting Act (Chapter 2, Section 10) (10 years).

6. Rights of the Data Subject

The data subject has the following rights, and requests for exercising these rights should be made in writing to the contact information provided in the privacy policy.

KITTUIS Camping customer register:

Kim Fredenberg

kim@eldainteractive.fi

6.1 Right of Access

The data subject has the right to access the personal data we have stored.

6.2 Right to Rectification<

The data subject has the right to request the correction of inaccurate or incomplete information concerning them.

6.3 Right to Object

The data subject has the right to object to the processing of personal data if they believe that the personal data has been processed unlawfully.

6.4 Right to Erasure

The data subject has the right to request the erasure of data if the processing of the data is not necessary. We will process the deletion request, and after that, either delete the data or provide a justified reason why the data cannot be deleted. It should be noted that the data controller may have a statutory or other right not to delete the requested information. The data controller is obliged to retain accounting material for the period defined in the Accounting Act (Chapter 2, Section 10) (10 years). Therefore, accounting-related material cannot be deleted before the expiration of the deadline.

6.5 Withdrawal of Consent

If the processing of personal data concerning the data subject is based solely on consent and not, for example, on a customer relationship or membership, the data subject can withdraw their consent.

6.6 Restriction of Processing

The data subject has the right to request the restriction of the processing of disputed data until the matter is resolved.

6.7 Right to Lodge a Complaint

The data subject has the right to lodge a complaint with the Data Protection Ombudsman if they believe that we are violating the applicable data protection laws when processing personal data. Contact information for the Data Protection Ombudsman: www.tietosuoja.fi/fi/index/yhteystiedot.html

7. Regular Sources of Information

The information regarding the customer is obtained routinely from the following sources:

• From the user themselves via the form data on the website.
• Provided during the use of offered services.
• The website contains cookies from third parties (partners) for measurement and tracking services. Third parties may set cookies on your device when you visit the website. Cookies mainly collect technical, marketing, and analytics information. The use of cookies on the website is separately mentioned and subject to the user's acceptance.

8. Regular Disclosures of Data

Generally, your personal data is processed by our company's staff members in their work. The data is not used for marketing purposes without the customer's explicit consent. Data may be disclosed to authorities as required by laws and regulations, and we will inform the customer about this if it is legally permitted.

9. Transfer of Data outside the EU or the European Economic Area

Personal data is not regularly transferred outside the EU or the European Economic Area.

10. Storage of Personal Data

Personal data is stored only in the KITTUIS Camping online store system.

11. Duration of Processing

Personal data is retained only for the necessary period for its purpose or as required by the contract or law (the data controller is obliged to retain accounting material for the period defined in the Accounting Act, Chapter 2, Section 10, for 10 years). Unnecessary data is removed from the registers.

12. Register Protection

Personal data is kept confidential. The data controller's and its possible IT partners' network and equipment on which the register is located are protected by a firewall, personal usernames and passwords, and generally accepted technical means. Access to the register data is granted only to those whose job duties require access to this data. Physical copies of the register are not made. The data controller will immediately notify all parties concerned and the supervisory authority in the event of a possible data breach, in accordance with the General Data Protection Regulation. We may also partially outsource the processing of personal data to a third party, and in such cases, we ensure through contractual arrangements that the personal data is processed in accordance with the applicable data protection legislation and otherwise appropriately.

13. Changes to the Privacy Policy

The latest revision date of the privacy policy is always indicated. We reserve the right to make changes to this privacy policy, including changes resulting from changes in legislation, at any time without prior notice. The data subject is responsible for reviewing the current Privacy Policy.

14. Automated Decision Making

The data is not used for automated decision making or profiling.