Privacy policy
This privacy policy has been updated the latest on 2.5.2024.
1 CONTROLLER
Anstar Oy (“Anstar”)
Business ID: 0434083-8
Address: Erstantie 2, 15540 Villähde
2 CONTACT PERSON FOR THE REGISTER
Tero Viljakainen
Mob: +358 44 761 3510
Email: tero.viljakainen@anstar.fi
3 PURPOSE OF THE POLICY
3.1 This policy applies to the processing of personal data of the representatives and employees of Anstar’s customers and prospective customers and potential co-operation partners, when Anstar processes their personal data as a controller for the purposes mentioned in this privacy policy. This privacy policy also applies to the processing of personal data of visitors on Anstar’s website. All of the persons mentioned above are referred to as “persons” in this privacy policy.
3.2 In order to comply with law, Anstar and its co-operation partner or customer may have entered into a data processing agreement concerning the co-operation partner’s or customer’s personal data, under which Anstar is a processor of such data. If Anstar is a processor and not a controller, the person in question must contact his or her employer regarding his or her personal data.
4 PURPOSE OF FOR PROCESSING PERSONAL DATA AND LEGAL GOUNDS FOR PROCESSING
4.1 Purpose of processing personal data and grounds for processing personal data are the following:
a) Review of contact requests and answering to them. “Anstar’s legitimate interests” are the basis for processing personal data for such purposes. For instance, if a person sends a message to Anstar through Anstar’s webpages, Anstar needs and processes the contact information informed by the person in order to respond to such message.
b) Presenting the content of Anstar’s webpages in a way that is suitable for a person’s device, improving customer communications and identifying potential customers, monitoring and developing the use of Anstar’s website (e.g. analysing and storing visitor statistics) and improving the user experience and functionality. The legal basis for processing personal data for these purposes is “Anstar’s legitimate interests”. If however consent is required by law, then ”consent” is naturally the legal basis for processing of personal data.
c) To take steps prior to entering into a contract. Use of Anstar’s contractual rights. ”Anstar’s legitimate interests” are the legal basis for the processing of personal data for these purposes.
d) The marketing and sales of Anstar’s products and services, the use of Anstar’s design program, delivery of newsletters and bulletins, following the efficiency of sales and marketing campaings. If a consent is required under law, then ”consent” is the legal basis for processing personal data for these purposes. If consent is not required under law, then ”Anstar’s legitimate interests” are the legal basis for processing of personal data for these purposes. A person has the right to prohibit the processing of their personal data for direct marketing purposes at any time.
e) Developing Anstar’s products, services and business. “Anstar’s legitimate interests” are the legal basis for processing of personal data for this purpose.
f) Taking care of data security. “Anstar’s legal obligation” is the legal basis for the processing of personal data for this purpose.
g) Preventing fraud. ”Anstar’s legitimate interests” or ”Anstar’s legal obligation” is the basis for processing of personal data for this purpose.
h) Managing the customer relationship. ”Anstar’s legitimate interests” are the legal basis for processing personal data for this purpose.
4.2 Legal basis for processing Personal Data:
a) “Consent”. Consent to the processing is the legal basis for the processing of the personal data to the extent mentioned above in Section 4.1. If a person withdraws a consent given to the processing of the personal data when the legal basis of processing is “consent”, the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
b) “Compliance with legal obligation” is the legal basis for the processing of the personal data to the extent mentioned above in Section 4.1.
c) ”Legitimate interests” are the legal basis for the processing of the personal data to the extent mentioned above in Section 4.1. Anstar has evaluated that the persons’ interests or fundamental rights and freedoms do not override Anstar’s legitimate interests.
d) Anstar’s legitimate interests are based on a relevant and appropriate relationship with the person and/or the person’s organization, such as a customer or coperation relationship with Anstar. It is also customary that companies market their services and products to other companies. The interests and fundamental rights and freedoms of the persons are respected and no special categories of personal data are processed (such as information on person’s political opinions). The persons can also expect the processing.
5 CATEGORIES OF PERSONAL DATA
5.1 “Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
5.2 The data listed in section 5.3 are processed. Whether or not the data actually constitutes personal data depends on whether the data can be considered as personal data according to the definition above. For example, if the data identifies only an organization (such as a company), the data is not personal data.
5.3 The register includes the following data:
a) name;
b) title;
c) information on the person’s role in the organisation;
d) address;
e) employer or other organisation;
f) language;
g) email address;
h) phone number;
i) other contact information;
j) interests and preferences (including possible marketing preferences);
k) information on marketing permissions and prohibitions;
l) feedback and responses to surveys; and
m) information related to the usage of Anstar’s webpages (IP address, operating system settings, information about how the page is used, usage data, information collected by cookies, web navigation data, browser information).
In particular, please note that if you have enabled cookies, your IP address may be linked to the data you enter on our website in order to improve customer communication.
6 SOURCES OF PERSONAL DATA
6.1 The primary source of personal data is the person in question or the person’s organisation. Anstar also collects data from messages sent by the person on a web form, by email, by telephone and with cookies and from contracts and customer meetings and other situations in which personal data is disclosed.
7 RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
7.1 Personal data may be processed by Anstar’s processors, who process personal data on behalf of Anstar in order to provide services for Anstar.
7.2 Concerning cookies, Anstar recommends that persons familiarize themselves with the information available on Anstar’s webpages concerning the cookies. It is also good if persons familiarize themselves with the notified cookie providers and their privacy policies in order to understand whether these parties process the data collected by cookies for their own purposes, i.e. whether they are controllers and where the data is processed.
8 TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES
8.1 Anstar does not transfer the personal data of EEA residents to countries outside the European Economic Area (EEA) or the European Union (EU) (“Third Country”) without a legal right to do so (such as an adequacy decision of the European Commission).
8.2 Anstar’s processors of personal data and other possible controllers may transfer personal data to third countries. In such a case, the legal basis for the transfer of data is binding corporate rules, standard contractual clauses for transfers of personal data to third countries approved by the European Commission (“Standard Contractual Clauses”), an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework), alternative mechanisms for lawfully disclosing personal data in accordance with EU data protection law, or other legal grounds.
9 COOKIES
9.1 Cookies are small text files that a browser stores on a person’s device when they visit a website. For example, they allow websites to remember information and settings entered by a person, such as login information and language preferences, to facilitate the user experience.
9.2 The user can refuse non-essential cookies. Please note that refusing cookies may, however, affect the functionality of the website.
10 STORAGE TIME FOR PERSONAL DATA
10.1 The personal data will be processed by Anstar as long as necessary to fulfil the purposes defined in Section 4 above, in accordance with the legislation in force from time to time. For instance, the personal data of the representatives of past contracting parties will be processed until the co-operation relationship has ended and thereafter until the debt relationship and liabilities directly relating to the personal data have expired and claims can no longer be made against Anstar. Pursuant to Finnish legislation, the main rule for expiry of debt is three (3) years.
10.2 The personal data will be processed for longer than the above-mentioned time periods, if the personal data in question is necessary for the establishment, exercise or defence of legal claims.
11 METHODS HOW THE REGISTER IS PROTECTED
11.1 The personal data processed by Anstar is secured by using the following methods and principles:
a) locks in Anstar’s premises;
b) firewall, Anstar’s communication networks’ anti-malware and spam filtering systems;
c) high-quality passwords;
d) personal user rights that can be traced in the systems;
e) limited amount of superusers;
f) professional knowledge of Anstar’s personnel;
g) training of Anstar’s personnel.
12 RIGHT OF ACCESS
12.1 The person has the right to obtain from Anstar confirmation as to whether or not personal data concerning him or her is being processed by Anstar.
12.2 If such personal data is being processed by Anstar, Anstar will provide the person with a copy of the personal data and the legally required information.
12.3 If the person ask for further copies, Anstar may charge a reasonable fee taking into account the administrative costs.
13 RIGHT TO DATA PORTABILITY
13.1 A person has a right, at the person’s request, if Anstar processes the personal data based on the person’s consent or based on a contract with the person and the processing is carried out by automated means:
a) to receive the personal data which he or she has provided to Anstar, in a structured, commonly used and machine-readable format; and
b) if technically feasible, transmit the personal data to another controller.
14 RECTIFICATION AND RIGHT TO LODGE COMPLAINT WITH SUPERVISORY AUTHORITY
14.1 A person has the right to request that Anstar without undue delay corrects, erases or supplements the personal data in case of erroneous, inaccurate or incomplete personal data taking into account the purpose of the processing, including by way of supplementing a corrective statement.
14.2 If Anstar does not comply with the person’s request, Anstar shall inform the person without delay and at the latest within one (1) month from the receipt of the request of the reasons for not accepting the request and of the possibility of lodging a complaint with a supervisory authority and using other legal remedies.
14.3 The person has the right to lodge a complaint to the supervisory authority. The contact details of the Finnish supervisory authority are:
https://tietosuoja.fi/tietosuojavaltuutetun-toimisto
15 RIGHT TO OBJECT PROCESSING
15.1 The person has the right to object, on grounds relating to his/her particular situation, to the processing of the personal data if the processing is based on any of the following: (i) the processing has been deemed to be necessary for the purposes of the legitimate interests of Anstar or (ii) the processing has been deemed to be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The person however does not have the right to object, if Anstar demonstrates compelling legitimate grounds for the processing which override the person’s interests or fundamental rights and freedoms or if the processing is necessary for the establishment, exercise or defence of legal claims.
16 RIGHT TO RESTRICTION OF PROCESSING
16.1 ‘Restriction of processing’ means marking the stored personal data so that their processing will be limited.
16.2 If the person requests, Anstar restricts the processing of the personal data in the following situations:
a) the accuracy of the personal data is contested by the person, in which case Anstar restricts the processing for a period enabling Anstar to verify the accuracy of the personal data;
b) the processing is unlawful and the person opposes the erasure of the personal data and requests the restriction of the use instead;
c) Anstar no longer needs the personal data for the purposes of the processing, but the person needs the data for the establishment, exercise or defence of legal claims;
d) the person has objected to the processing, but verification whether the legitimate grounds of Anstar override those of the person is still ongoing.
16.3 In the situations listed above, Anstar processes the personal data only in the following situations:
a) with the person’s consent or for the establishment, exercise or defence of legal claims;
b) for the protection of the rights of another natural or legal person;
c) for reasons of important public interest of the Union or of a Member State; or
d) to store the personal data.
17 RIGHT TO BE FORGOTTEN
17.1 Anstar deletes the person’s personal data at the person’s request, if one of the following grounds applies:
(a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
(b) the person withdraws the consent on which the processing is based and where there is no other legal ground for the processing;
(c) the person objects to the processing in accordance with Section 15;
(d) the personal data has been processed unlawfully; or
(e) the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which Anstar is subject.
17.2 However, Anstar does not have to erase the personal data if Anstar still needs to process the personal data:
(a) for exercising the right of freedom of expression and information;
(b) for compliance with a legal obligation which requires processing by Union or Member State law to which Anstar is subject or if the processing is for the performance of a task carried out in the public interest or in the exercise of official authority vested in Anstar;
(c) for reasons of public interest in the area of public health in accordance with legal requirements;
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with legal requirements; or
(e) for the establishment, exercise or defence of legal claims.
18 AUTOMATED DECISION-MAKING AND PROFILING
18.1 The person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
18.2 Anstar does not use such automated decision-making.
