Privacy notice

Controller

Suomen Tuontiliike Oy, Business ID 2417329-9, Pitkäkatu 34, 65100 Vaasa, Finland. Contact in data protection matters: asiakaspalvelu@tuontiliike.fi.

We have not appointed a data protection officer. Our activities do not require one: we do not monitor individuals on a large scale and we process no special categories of personal data.

What data we collect

• Data given on the account application form: company name, Business ID, email address and telephone number.
• In connection with the account application: details of the point of sale and of the retail licence. We verify these in a public register — the register of retail licences maintained by the Finnish Licensing and Supervision Agency — so we do not obtain them from you.
• Analytics data: data on use of the site, such as pages visited, traffic source and device type.

Why we process the data

• To respond to enquiries and manage the customer relationship
• To open a B2B portal account and verify the retail licence
• To meet statutory obligations
• To improve how the site works and what it contains

Legal basis

The basis for processing is the preparation and performance of a contract, a statutory obligation, and a legitimate interest in managing the customer relationship and developing the site. Analytics cookies are based on consent.

Retention period

We retain data submitted through the account application form for as long as it is needed to handle the matter and manage the customer relationship. Data relating to accounting is retained for the statutory period. The retention period for analytics data is determined by the settings of the analytics service used.

Disclosure and transfer of data

We neither sell nor rent personal data. Data is processed on our behalf by the following service providers, each for the purpose shown:

• Google Ireland Limited — visitor measurement (Google Analytics 4). Only if you have accepted analytics cookies.
• Airtable, Inc. — receiving account applications and customer relationship management.
• Shopify Inc. — the B2B portal, which holds the customer account and order history.
• DigitalOcean, LLC — the server capacity on which the site and the account application form run. Technical maintenance of the site is handled in-house.

Some of these services process data outside the EU or the EEA. Such transfers rest either on an adequacy decision of the European Commission or on standard contractual clauses approved by the Commission, depending on the service. You may ask us which safeguard a particular transfer relies on, and for a copy of those clauses.

Cookies

On this site we use one necessary cookie (tl_evasteet), which remembers your cookie choice for 12 months, together with analytics cookies based on consent. Analytics cookies are not set until you have accepted them. You can change your choice at any time in the cookie settings, and every cookie is listed on the cookies page.

Is providing the data mandatory?

Providing the data is voluntary, but it is a precondition for handling the matter. The four fields of the account application — company name, Business ID, email and telephone — are needed to open the account and to verify the retail licence. If you do not provide them, we cannot open an account. Providing the data is not a statutory obligation; it is a requirement for entering into a contract.

Automated decision-making and profiling

We make no decisions based on automated processing and we do not profile users. Account applications are handled by a person. The check on the format of the Business ID in the form is a technical validation, not a decision concerning you.

Security of the data

The site and the form use an encrypted connection. Data from the account application is first stored in a separate application register, from which it is transferred into customer relationship management for handling the customer relationship. Access is limited to those of our employees who need it for their work. With each service provider we apply the data processing terms included in that provider's terms of service, which meet the requirements of Article 28 of the GDPR. We do not keep personal data on paper.

Your rights

• The right of access to your own data
• The right to rectification and erasure of data
• The right to restriction of and objection to processing
• The right to data portability
• The right to withdraw consent
• The right to lodge a complaint with the Office of the Data Protection Ombudsman

Contact

Requests concerning data protection should be addressed by email to asiakaspalvelu@tuontiliike.fi.