This is a description of the processing of personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 (GDPR).
Controller
- Astu Labs Oy
- Business ID: 3487158-4
- Address: Hevosenkenkä 3, FI-02600 Espoo, Finland
- Email: sales@astulabs.fi
Contact for data protection matters
- Lenni Laukkanen
- Tel. +358 45 279 279 4
- Email: lenni@astulabs.fi
In all matters relating to the processing of personal data and the exercise of their rights, data subjects are advised to contact the contact person named above.
Name of the register
Customer and marketing register
Legal basis and purposes of the processing of personal data
The legal basis for the processing of personal data is:
- the consent given by the data subject to the processing of their personal data
- a contractual relationship between the data subject and the controller
- the controller’s legitimate interest, based, for example, on a customer relationship between the data subject and the controller
The purposes of the processing of personal data include marketing, the maintenance and development of customer relationships and partnerships, and the organisation of events such as webinars and training sessions.
Regular sources of data
The personal data processed is regularly obtained from the following sources:
- The data subjects themselves
- The Finnish Trade Register
Personal data processed
The controller collects only such personal data on data subjects as is relevant and necessary for the purposes described in this privacy policy.
The following data concerning data subjects is processed:
- Name
- Contact details (e.g. email address, telephone number, postal address)
- Company name and position within the company
- Information relating to the customer relationship (e.g. orders, billing information, correspondence)
- Direct marketing consents and opt-outs
- Any other information provided by the data subject
Disclosure of personal data
Personal data is not disclosed to third parties unless required by law. Data may therefore, in exceptional cases, be disclosed, for example, to public authorities where required by law.
Transfers of personal data to third countries
Personal data is not transferred outside the EU or the European Economic Area.
Protection of personal data
The controller processes personal data in a manner designed to ensure appropriate security of the personal data, including protection against unauthorised processing and against accidental loss, destruction or damage.
The controller uses appropriate technical and organisational safeguards to ensure this, including the use of firewalls, encryption technologies and secure server facilities, appropriate access control, careful management of user credentials for information systems, and the instruction of personnel involved in the processing of personal data.
All employees who process personal data are bound by a duty of confidentiality in matters relating to the processing of data subjects’ personal data, based on the Employment Contracts Act (55/2001) and supplementary non-disclosure agreements.
Data retention period
Personal data is retained for as long as is necessary for managing the customer relationship, for marketing, or for the other purposes of the register. Personal data in the marketing register is retained for no longer than one year after the most recent contact, unless a statutory obligation requires a longer retention period. At the end of this period, the controller erases or anonymises the data in accordance with its erasure procedures.
The controller may be under an obligation to process some of the personal data in the register for longer than stated above in order to comply with legislation or the requirements of public authorities.
Rights of the data subject
Right of access
The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and, where that is the case, the right to obtain a copy of their personal data.
Right to rectification
The data subject has the right to request that inaccurate or incorrect personal data concerning them be rectified. The data subject also has the right to have incomplete personal data completed by providing the necessary supplementary information.
Right to erasure
The data subject has the right to request the erasure of personal data concerning them where:
a. the personal data is no longer needed for the purposes for which it was collected;
b. the data subject withdraws the consent on which the processing was based, and there is no other legal basis for the processing; or
c. the personal data has been processed unlawfully.
Right to restriction of processing
The data subject has the right to restrict the processing of personal data concerning them where:
a. the data subject contests the accuracy of their personal data;
b. the processing is unlawful, and the data subject opposes the erasure of their personal data and requests the restriction of its use instead; or
c. the controller no longer needs the personal data for the original purposes of the processing, but the data subject needs it for the establishment, exercise or defence of legal claims.
Right to object
The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them.
The controller may then no longer process the data subject’s personal data, unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent
The data subject has the right to withdraw their consent to processing at any time, without affecting the lawfulness of processing carried out on the basis of that consent before its withdrawal.
Right to data portability
The data subject has the right to receive the personal data concerning them which they have provided to the controller in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller.
Right to lodge a complaint with a supervisory authority
The national supervisory authority in matters concerning personal data is the Office of the Data Protection Ombudsman, which operates in connection with the Ministry of Justice. You have the right to refer your case to the supervisory authority if you consider that the processing of personal data concerning you infringes the applicable data protection legislation.
Changes to these privacy practices
The controller continuously develops its operations and may therefore need to amend and update its privacy practices as necessary. Changes may also be based on amendments to data protection legislation.
If the changes involve new purposes for the processing of personal data or otherwise change materially, the controller will give notice of them in advance and, where necessary, request consent.
Website-specific provisions
Comments
When visitors leave comments on the site, we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection. An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available at https://automattic.com/privacy/.
Media
If you upload images to this website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.
Cookies
If you leave a comment on our site, you may opt in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
If you edit or publish an article, an additional cookie will be saved in your browser. This cookie contains the ID of the article you just edited. It expires after one day.
Embedded content from other websites
Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor had visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking cookies, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Who we share your data with
If you request a password reset, your IP address will be included in the reset email.
How long we retain your data
If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
What rights you have over your data
If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal or security purposes.
Where your data is sent
Visitor comments may be checked through an automated spam detection service.
