Privacy and Data Protection Statement

This is Brande Oy’s privacy and data protection statement in accordance with the EU General Data Protection Regulation (GDPR).
Prepared: 9 October 2024.

1. Data Controller
Company: Brande Oy
Address: Kilpisenkatu 9, 40100 Jyväskylä, Finland
Business ID: 0983379-7
Email: jari.palonen@brande.fi
Phone number: +358 40 057 2860

2. Contact Person Responsible for the Register
Name: Saila Bovellan
Email: saila.bovellan@brande.fi
Phone number: +358 40 043 6736

3. Name of the Register
Brande Oy’s customer and marketing register.

4. Legal Basis and Purpose of Personal Data Processing
Legal bases for processing personal data include:

• The individual's consent
• A contract in which the data subject is a party
• A legal obligation
• The controller’s legitimate interest (e.g., customer relationship or marketing communication)

The purpose of processing personal data is to maintain customer relationships, communication, service development, marketing, and analysis of online service usage. The data is not used for automated decision-making.

5. Data Content of the Register
The register may include the following information:

• Name
• Position
• Company/organization
• Contact details (phone number, email address, postal address)
• IP address and cookie data
• Social media profiles and other public information
• Ordered services and any changes to them
• Billing and payment information

Data is retained as long as it is necessary for maintaining the customer relationship or as required by law. Data may be anonymized or deleted when no longer needed.

6. Regular Sources of Information
Data is collected from the customer, for example via web forms, email, or phone. Contact information for company representatives may also be collected from public sources such as company websites.

7. Regular Disclosures of Data and Transfers Outside the EU or EEA
Data is not regularly disclosed to third parties without consent. Data may be transferred outside the EU or EEA only if data protection regulations are met. No data is transferred to the United States without the data subject’s consent.

8. Principles of Register Protection
Register data is protected through technical and organizational measures, and access is limited to employees whose duties require it.

9. Right of Access and Right to Request Correction
Data subjects have the right to access their personal data stored in the register and request corrections. Requests must be submitted in writing, and identity verification may be required.

10. Other Rights Related to the Processing of Personal Data
Data subjects have the right to request deletion of their data, restrict processing, and object to processing, in accordance with GDPR. Requests must be submitted in writing and will be processed within one month.