In English

Privacy Policy Statement concerning the processing of the clients’, potential clients’, and stakeholders’ personal data

På svenska

Suomeksi

In force as of 25 May 2018

Contents

1 Controller

Publishing company Otava (Business ID 1564596-0) and the companies, which belong to the same group at any given time [hereinafter both together “Otava”]

Address: Uudenmaankatu 10, FI-00120 Helsinki
Telephone: +358 (0)9 15 661
email: tietosuoja@otava.fi

2 Definitions

A data subject is a person whose personal data Otava processes in its personal registers in the role described in this Privacy Policy Statement.

Personal data means information connected with the data subject, such as the name, email, telephone number and contact history.

A customer refers here to the consumers and the representatives of the companies and other entities (hereinafter both together “company”) with whom Otava has a customer relationship.

The potential customers mean such consumers and representatives of companies with whom Otava strives to create a customer relationship.

The stakeholders mean such contact persons of companies and other entities with whom Otava has a cooperation relationship (e.g. representatives of companies and other entities that produce services for Otava), or has another connection (e.g. representatives of the media as parties to information activities, and the society’s decision-makers in connection with the society’s public relations).

3 For what purposes and on what grounds do we process your personal data?

Otava processes the data subjects’ personal data for the following purposes (one or several purposes at a time):

• Management and analysis of customer and stakeholder relationships

Otava can utilise your personal data in order to manage, analyse and improve a customer or stakeholder relationship that was created together with you or with a company or other entity represented by you.

• Delivery of products and services

Otava can use your personal data in order to offer products or services in case you, or the company or other entity represented by you, has, for example, bought a product from us, used our digital services, subscribed to our newsletter, or taken part in our training or other events. The personal data is used in order to implement the rights and obligations based on an agreement or other commitment between Otava and the customer.

• Customer communications

Otava can use your personal data in its customer communications, for example in order to send you notifications connected with products and services or to inform about changes made into services, and in order to ask for feedback about products and services.

• Marketing

Otava can contact you in order to tell about new products, services or benefits. Otava can use the personal data in order to tailor its line of products and in order to offer relevant content. This means, for example, that we give recommendations, or show tailored content and tailored advertisements in our own and third party’s services, such as in digital products and on websites.

• Development of products and services

Otava can use your personal data in order to develop its products and services, such as the content and selection of products and services based on what age the customers are and what they are interested in.

The legal basis for processing personal data are the following subparagraphs of Article 6 of the EU’s General Data Protection Regulation:

a) you have given your consent for processing your personal data for one or several special purposes;

b) the processing is necessary in order to implement such an agreement of which you are a party, or in order to implement, upon your request, the activities preceding the conclusion of the agreement;

c) the processing is necessary in order to comply with a statutory obligation of Otava; and

f) the processing is necessary in order to fulfil the legitimate interests of Otava or a third party, except in case your personal data rights or basic rights and freedoms override such interests.

Otava processes your data in order to implement an agreement with you, or with the company represented by you (e.g. implementing an online sale or digital service). After the agreement relationship has ended, the processing of your information may be continued based on a statutory obligation or a legitimate interest connected with the commercial activities pursued by Otava.

Otava has legitimate interests connected with its business activities, such as the right to use marketing and sales measures in order to promote the selling of its products and services, and based on a legitimate interest Otava may pursue direct marketing and sales utilising the contact information you have provided, including the processing of personal data for profiling purposes.

Other Otava’s legitimate interests, based on which your personal data may be processed, are, among others, consulting and other customer services to non-customers, business development, and finding out eventual misuse.

In case the processing of data is not based on agreement-related reasons, or on a legitimate interest, then Otava may ask for your permission for another type of personal data processing.

In addition, Otava may process your personal data if it is required by law, such as in the case of the preserving obligation included in the Accounting Act.

4 What type of data can we process?

The personal data gathered by Otava can include, among other things, the following types of information and the changes made into it (all types of information are not gathered about all the data subjects, i.e. the amount of data is based on the needs connected with each data subject):

4.1 Basic information of all the data subjects

• First and last name

• Contact information (postal address, email address, telephone numbers)

• Sex

• Date of birth

• Service language

• Title and/or work description for former and present tasks connected with Otava’s activities

• Direct marketing options

• Information about the use of Otava’s digital services and the digital content created for the user

• The information sent by Otava to the user’s digital devices (such as computers and mobile devices) concerning cookies and similar technologies

• The communications and related activities targeted at the data subject

• Recordings of customer service phone calls and emails and network chats

• The areas of interest reported by the data subject

4.2 Information about the data subjects who have bought or now use, or have provided feedback about and/or made a complaint about Otava’s products or services

• The data subject’s photo and/or video

• The name of Otava’s corporate customer, or the company or other entity connected with Otava’s customer relationship in which the data subject works at the moment, or has worked previously.

• The start and end date of a customer or comparable relationship, and how it happened

• The campaigns and offers directed at the customer, and how they were used

• The interests and other information reported by the customer

• The contents of feedback and complaints and the relevant exchange of letters and follow-up actions

4.3 Information about the data subjects who took part in Otava’s events

• Information about the diet (specific information that the users themselves have produced voluntarily)

• Date of birth in connection with such events that require it, for example as required by a shipping company

• Essential information about the organization and taking part in an event

• The names of travel companions and their dates of birth, for example as required by a shipping company

4.4 Identification information of the customers of Otava’s online services

• The data subject’s logging identifiers

• Activities and dealings in the online service after logging in

4.5 Information about the data subjects who are Otava’s stakeholders

• Information about the identity number, salaries, fees, expenses paid and other eventual payments

• Profession

• Information of being included in the VAT register and withholding tax register

5 From what sources do we gather your personal data?

We only gather your personal data when it is necessary, and as a rule it is gathered from you.

Most of the information is received from you at the beginning of a customer and stakeholder relationship, and during it, and from the programs with which you use our products and services.

Otava receives personal data and their updates also from the authorities and companies which offer credit information and personal data acquisition and updating services, and from public directories and other public information sources, such as corporations’ WWW -pages and social media channels. Otava also receives personal data of companies’ and other entities’ representatives from their colleagues, or the company’s or other entity’s main contact person can submit to Otava the personal data of also other persons that are connected with the use of Otava’s products and services. Otava only processes your credit information in the situations that are explicitly allowed by the law.

6 Do we use your personal data for profiling?

We do not perform any profiling as defined in the General Data Protection Regulation. However, we may otherwise analyse the personal data in our registers and combine it with information received from third parties, and try to predict, for instance, what kind of content you might be interested in, and to target content based on the predictions.

7 To whom may we distribute your personal data?

Protecting and restricting the processing of your personal data is important for Otava.

Otava and the companies belonging to the same group at any given time (all of which are Finnish companies) constitute a joint data controller and the personal data may be processed within the group across companies.

Otava does not provide, sell or otherwise disclose your personal data to third parties outside the Otava Group, if not otherwise stated below.

Otava shares your personal data on behalf of Otava with third parties that perform services. Such services may include, for example, customer service, software services, the technical management and analysing of personal data, research activities, marketing and different campaigns.

Otava may share your personal data in order to collect payments for products and services and it can, for example, transfer or sell unpaid invoices to third parties which provide collection services.

Protecting your personal data is important for Otava, and that is why it does not allow the said parties to use the data for any other purpose than the said services, and it requires from the parties the protection of the user’s personal data in accordance with this Privacy Policy Statement and applicable laws.

Otava shares your personal data with such partners with whom Otava together manages and carries out projects.
Otava shares your personal data with closely scrutinized third parties for common or independent direct marketing purposes. The data may be shared for the said purposes only in case the planned purpose of the third party does not conflict with the uses by Otava defined in this Privacy Policy Statement.

Otava may share the personal data of those participating in Otava’s events with other participants of the event in question.

Otava may share your personal data in connection with a company acquisition or other company arrangement, or in case a service is transferred to another service provider. Otava may share your personal data based on a court’s or comparable body’s order.

8 Do we pass on your personal data outside the EU?

As a rule, we only process personal data within the EU area. In case we transfer personal data outside the EU, as described below, then the legislation requires that Otava plans and carries out the transfer and the choice of the partner and technical software carefully and protecting the personal data.

While offering services, Otava may use resources and servers that are situated in various places around the world. Otava may thus transfer your personal data outside the country where the services are used, and possibly even to countries outside the EU area where the legislation concerning personal data is different. In such cases, Otava shall make sure that there is a legal basis for the transfer of data and that the user’s personal data is protected by using (if necessary) standard agreements approved by the relevant authorities, and by requiring that technical and other data protection measures are followed.

9 For how long do we process your personal data?

Otava shall process your personal data in this register for as long as Otava has a valid reason to process the data as described in section 2 of this Privacy Policy Statement, and for a reasonable period after that.

Customer register: the personal data of the representatives of corporate customers (such as teachers, company’s representatives) are processed at the most for 6 years after the person’s role changes and they no longer pursue their occupation connected with Otava’s business activities, or act as a representative of a corporate customer of Otava.

Digital learning materials: at the most 5 years after the day the license was taken into use (e.g. a 4-year license and after that a preserving period of 1 year).

The logging information of the customers and users of Otava’s online services: at the most 6 years after the customer relationship ended.

Materials that come under copyright rules: the information necessary in order to pay copyright compensations is preserved at the most for 70 years after the author’s death, or after the copyright has become otherwise void.

10 How can you exercise your rights connected to your personal data?

As a data subject, you have various ways to have an influence on how your personal data is processed. As a rule, we put your request into effect within a month. We ask you to contact the addresses given in section 1 of this Privacy Policy Statement for matters connected with exercising your rights. Your rights are:

a) Right to have access to the personal data gathered about you. In practice, this is done so that after your proper and identified request we send you a report of the personal data that was gathered about you into the personal register.

b) Right to request rectification of the personal data gathered about you. In case you find mistakes or irregularities in your information, you can submit to us a request for rectification.

c) Right to ask that the information gathered about you is erased. It is our duty to erase from our personal register the personal data that you have requested in case one of the following preconditions is met, and we do not have the obligation based on other legislation or the authorities’ regulations to preserve the data:

1. The personal data is no longer needed for the reasons for what they were processed;

2. You withdraw your consent, and there is no other legal basis for the processing;

3. You object to the processing based on your special circumstances and there is no justified reason for the processing, or you object to your personal data being processed for direct marketing purposes;

4. Your personal data was processed unlawfully;

5. Your personal data must be erased based on the laws of the European Union, or in order to comply with a statutory obligation based on the laws of Finland; or

6. Your personal data was gathered in connection with offering the services of the information society, such as in connection with a subscription of Otava’s digital information services.

d) Right to ask that the processing of the information gathered about you is restricted. You can request that Otava restricts the processing of your personal data, in case:

1. You deny the correctness of your personal data kept by Otava;

2. The processing is unlawful and you demand that its use is restricted instead of erasing it;

3. Otava no longer needs the personal data in question for the processing purposes, but you need it for the establishment, exercise or defence of a legal claim;

4. You have objected the processing of the personal data while it is being verified whether Otava’s legitimate grounds replace your grounds.

e) Right to object the processing of your personal data. In case Otava processes your personal data based on a justified interest, then you have the right, based on your specific circumstances, to object the processing of your personal data. All those who are registered in the registers covered by this Privacy Policy Statement have the right to object the processing of their personal data for direct marketing purposes.

f) Right to move from one system to another the data you have submitted. In case the automatic processing of your personal data is based on a consent or agreement, then you have the right to receive the personal data you have submitted to Otava in an organised, commonly used and machine-readable form, together with the right to transfer the said data to another data controller.

g) Right to withdraw your consent. In case all or a part of your personal data is processed in this register based on a consent you have provided, then you have the right to withdraw the consent you gave.

h) Right to make a complaint to a supervisory authority. In case an eventual dispute concerning the processing of your personal data cannot be amicably solved between you and Otava, then you have the right to take the matter to be solved by the data protection authority.

11 Do you have to provide your personal data to us?

In order for Otava to fulfil its contractual obligations connected with a product or service you have bought or ordered, Otava must have access to and process your personal data. Without the necessary personal data, we cannot offer you those of our products and services in connection with which it is necessary to process personal data.

12 What country’s legislation is applied to the processing of your personal data?

We are a Finnish group operating in Finland. This personal register and the personal data contained in it are processed according to the laws of Finland and the EU laws that are directly applied in Finland, such as the EU General Data Protection Regulation.

13 How do we update this Privacy Policy Statement?

We constantly develop our business activities and this might also cause changes to the processing of personal data. If necessary, we shall update the Privacy Policy Statement to comply with the changed procedures. Such changes may also be based on amended legislation. We recommend that you get to know the contents of the Privacy Policy Statement on a regular basis.