This is a statement on the processing of personal data in accordance with the EU General Data Protection Regulation (679/2016).

Controller

Östman Group Oy Ab Business ID: 2789342-7

address: Törmäniityntie 15 C 36 , 02710 ESPOO

p. 0503440512

email: info@ostmangroup.fi

Contacts on data protection issues

Kevin Östman p. 0503440512

email: kevin.ostman@ostmangroup.fi

In all matters relating to the processing of personal data and in situations where the data subject wishes to exercise his or her rights, he or she is invited to contact the contact person mentioned above.

Grounds for and purposes of processing personal data

The legal basis for the processing of personal data is:

• Consent of the data subject to the processing of personal data
• Legitimate interest of the controller based on the customer relationship between the data subject and the controller

The purposes of processing personal data include invoicing and the dispatch of ordered products.

Personal data processed

The controller only collects personal data from data subjects that are relevant and necessary for the purposes of use described in this Privacy Policy.

The following information about data subjects is processed:

• First name and surname
• Address
• Phone number
• E-mail address

Data retention period

The controller processes personal data for 6 months. At the end of this period, the controller will delete or anonymise the data within 6 months in accordance with its deletion processes.

The controller may be obliged to process some personal data in the register for longer than stated above in order to comply with legal or regulatory requirements.

Rights of the data subject

Right of access to personal data

The data subject has the right to obtain confirmation as to whether personal data concerning him or her are being processed and, if so, to obtain a copy of his or her personal data.

Right to rectification

The data subject has the right to request that inaccurate or incorrect personal data concerning him or her be corrected. The data subject also has the right to have incomplete personal data completed by providing the necessary additional information.

Right to erasure

The data subject has the right to request the erasure of personal data concerning him or her if.

1. the personal data are no longer needed for the purposes for which they were collected;

• the data subject withdraws the consent on which the processing of personal data was based and there is no other lawful basis for the processing; or
• personal data have been unlawfully processed.

Right to restriction of processing

The data subject has the right to restrict the processing of personal data concerning him or her if.

1. the data subject contests the accuracy of his or her personal data;

• the processing is unlawful and the data subject objects to the erasure of his or her personal data and requests instead the restriction of their use; or
• the controller no longer needs the personal data for the purposes for which they were originally processed, but the data subject needs them for the establishment, exercise or defence of legal claims.

Right to object

The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her.

The controller shall no longer process the personal data of the data subject, unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, including.

profiling when it is related to such direct marketing.

Right to withdraw consent

The data subject has the right to withdraw his or her consent to processing at any time, without prejudice to the lawfulness of the processing carried out on the basis of that consent.

The right to transfer data from one system to another

The data subject has the right to receive personal data concerning him or her and provided by him or her in a structured, commonly used and machine-readable format and the right to transmit such data to another controller.

Right to lodge a complaint with a supervisory authority

The national supervisory authority for personal data matters is the Office of the Data Protection Ombudsman, attached to the Ministry of Justice. You have the right to refer your case to the supervisory authority if you believe that the processing of personal data concerning you infringes the relevant legislation.