Description of the personal data file

Personal data file description in accordance with Section 10 of the Personal Data Act (Henkilötietolaki, 523/1999).

Controller

Hyvinvoinnin Tavaratalo Oy, Business ID 1908326-4, Alvar Aallon tie 275, 21540 Preitilä, Finland.

Contact person for register matters Hyvinvoinnin Tavaratalo Oy / Hanneli Salo, tel. +358 10 422 9100

Name of the register

Hyvinvoinnin Tavaratalon asiakasrekisteri (The Hyvinvoinnin Tavaratalo customer register). The register consists of several sub-registers. Purpose of the register

The purpose of the register is customer communication, maintenance and development of customer and trade relationships, and statistical purposes. Hyvinvoinnin Tavaratalo uses this and other information created during the customer relationship for planning the product and service range and for targeting the offering.

Personal information is used within the scope permitted and required by the Personal Data Act. The register is not surrendered to third parties.

Data stored in the register

The customer register consists of several separate registers compiled according to their intended main use. Together, the customer information forms data sets stored about each customer as follows:

• Contact information and information which enables ordering: first and last names, street address, postal code, city, country, telephone number, email address, date of birth, gender, and personal identity code. For businesses, associations, and organisations, even the name and business ID are required.
• Areas of interest, background information of the household, and other customer-specific additional information stated by the customer.
• Permission for direct marketing, if it has been granted.
• Information about the customer’s orders, deliveries, and returns.
• Identifiers required for logging in the Service.
• Customer-specific information related to the loyal customer programme: membership level, accrued purchases, collected, used, and available eco points, the customer’s special wishes. The personal information of a registered customer are deleted at the customer’s request.

Regular sources of data

The contact and customer information in the register are acquired as the customer relationship is formed and during the relationship from notifications by the customer to the controller. The customer relationship is formed when the customer registers in the service, orders direct marketing, or performs a purchase.

In accordance with the Personal Data Act, a separate permission is requested from the customer for electronic direct marketing (email and SMS marketing).

Security of the register

The right to use the Hyvinvoinnin Tavaratalo internal network is required for obtaining the right to use the register. The right is limited to information required for carrying out relevant work assignments, and all use of the register requires using the employee’s personal user identification. The customer register and the information system equipment which process it are located in closed server rooms.

To prepare for disturbances, the information is secured by copying regularly. The system is protected with a firewall against contact from the outside.

The employees who process customer register information are bound by confidentiality. Information is surrendered to third parties only when required by statutory notification requirement, including the request of the customer or a statutory request by authorities.