Privacy policy: Customer register of the online shop of the Hakku service
Updated: 6.3.2024
Data controller
Geologian tutkimuskeskus (Geological Survey of Finland)
P.O. Box 96, 02151 Espoo, Finland
Tel. +358 29 503 0000
gtk(at)gtk.fi
Contact person in matters related to the register
Jari Väätäinen
P.O. Box 96, 02151 Espoo, Finland
Tel. +358 29 503 0000
jari.vaatainen(at)gtk.fi
Contact details of the Data Protection Officer
tietosuojavastaava(at)gtk.fi
Tel. +358 29 503 0000
Purposes and legal grounds for processing of personal data
The purpose of use is the processing and monitoring of GTK’s Hakku service’s customer orders, the management of customer contacts and inquiries, and the development of services, reporting and other actions related to the customer relationship management.
Grounds for processing personal data:
- data subject’s consent
- the performance of a contract with the data subject or the implementation of precontractual measures at the request of the data subject
Data content
Data content of the register and categories of personal data
Customer’s first and last name, organisation, postal address, e-mail address, telephone number, customer type and order information. Only the e-mail address is mandatory for all subscribers. Name and address are mandatory if ordering products to be shipped by post.
Regular sources of data
The source of data is information provided by the person him or herself.
Storage period for personal data
The customer’s personal data will be deleted from the order and payment systems after five years from their storage.
Is the provision of personal data a statutory or contractual requirement or a prerequisite for the conclusion of a contract
The e-mail address is necessary for the delivery of the order. Name and address information is also required for the shipping of physical products. Providing other information is voluntary.
Data processing
Recipients or categories of recipients of personal data (To whom data may be disclosed)
Order processors and administrators of the service.
Processing of personal data on behalf of the controller
System administrator Solita Oy, server maintained by the State Information and Communication Technology Centre Valtori. Paytrail Oyj processes transaction data of payments made in the online store.
Transfer of personal data to third countries outside the EU/EEA
The data will not be transferred to countries outside the European Union or the European Economic Area.
Automated decision-making and profiling
No automated decision-making and profiling.
Rights of the data subject
Exercise of rights
The data subject may exercise their rights by submitting a request to this effect to the data controller (Geological Survey of Finland) at the address mentioned above under ‘Data Controller’. In order to expedite the processing of the request, we ask that you mention the register to which the request relates.
Right to file a complaint with the supervisory authority
If the data subject considers the processing of his or her personal data to be incompatible with the law, they may lodge a complaint with a supervisory authority in the Member State of his or her habitual residence, place of work or place of the processing of personal data in breach of the law. In Finland, the matter can be referred to the Office of the Data Protection Ombudsman:
Postal address: P.O. Box 800, FI-00521
Email: tietosuoja(at)om.fi
Tel.: +358 29 56 66700
Right to access personal data
The data subject has the right to obtain confirmation from the controller that their personal data are being processed or are not being processed, and if this personal data is being processed, the right to access the personal data.
Right to have data rectified
The data subject has the right to demand that the controller without undue delay corrects inaccurate or incorrect personal data concerning the data subject.
Right to restrict processing
The data subject has the right to request the controller to restrict the processing of their personal data if:
- the data subject contests the accuracy of his or her personal data.
- the processing of personal data is unlawful, but the data subject opposes the erasure of their personal data and instead requests the restriction of their use.
- the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims.
- the data subject has objected to the processing of his or her personal data pending the verification whether the legitimate grounds of the controller override those of the data subject.
Right to object
In situations where the processing of personal data is based on a public interest or a legitimate interest of the controller or a third party, the data subject has the right to object to the processing of their personal data.
If the data subject exercises the right to object, the controller shall cease processing the personal data unless the controller can demonstrate compelling legitimate grounds for the processing which override the rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
The data subject has the right to object to processing without specific justifications if the data is processed for direct marketing purposes.
In a situation where the data is processed for statistical or research purposes, the data subject may object to the processing of the data on grounds relating to his or her personal situation, in which case the controller must stop processing the data if the processing is not necessary for the performance of a task carried out in the public interest.
Right to have data erased
In situations where the processing of personal data is based on legal grounds other than compliance with a legal obligation of the controller or the performance of a task carried out in the public interest, the data subject has the right to request the erasure of their personal data. The requested data will be deleted unless the controller has a legal basis for refusing to delete the data, such as a legal obligation to retain the data.
Right to withdraw consent
To the extent that personal data is processed on the basis of the data subject’s consent, the data subject may withdraw their consent at any time by notifying the controller, see the contact details on the front page of this policy. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before the withdrawal.
