Privacy Policy
Register Description

In accordance with Section 10 of the Finnish Personal Data Act, the data controller is responsible for the following obligations:
Register Description

Personal Data Act (523/99) Section 10
Date of Preparation 19.9.2023

1. Data Controller

   Naakia, Business ID 3216554-7, Markuskuja 7, 90800 Oulu

2. Person Responsible for Register Affairs and/or Contact Person

   Riikka Koo (Kauppila) & Tero Huovinen

3. Register Name

   Naakia Online Store User Register

4. Purpose of Processing Personal Data (Purpose of Register Use)

   The personal data collected in the Naakia Online Store User Register is used for managing customer relationships, handling inquiries, marketing purposes, and other purposes related to online services.

5. Contents of the Register

   The register collects basic information about the registered individuals, including:

   • Name
   • Address
   • Phone number
   • Email.

6. Regular Sources of Information

   The data controller registers the information provided by the user of the Naakia Online Store when using the website.

7. Regular Disclosures of Data and Transfers of Data outside the European Union or the European Economic Area

   No regular disclosures of data to third parties. No transfers of data outside the EU or EEA.

8. Principles of Register Protection

   The data in the Naakia Online Store User Register is stored in the data controller's system, which is protected by operating system security software. Access to the system requires entering a username and password. The system is also protected by firewalls and other technical means. The data contained in the register can be accessed and used only by certain pre-defined employees of the data controller. The data contained in the register is located in locked and guarded premises.

9. Right to Prohibit Processing

   The data subject has the right to prohibit the data controller from processing their own personal data for direct marketing, distance selling, and other direct marketing, as well as market and opinion research, and for personal registers and genealogical research. The prohibition must be made in writing and addressed to the person responsible for register matters.

10. Right of Inspection

    The data subject has the right to inspect the personal data concerning them stored in the register and to obtain copies of them. The inspection request must be made in writing and addressed to the person responsible for register matters.

11. Correction of Information

    The data controller corrects, deletes, or completes personal data in the register that are erroneous, unnecessary, deficient, or outdated in terms of the purpose of processing, either on their own initiative or at the request of the data subject. The data subject must contact the person responsible for register matters to correct the information.

On the website of the online store [...], Y-tunnus [...], located in [...], the data controller [...] processes the personal data provided by the customer that fulfill and confirm the terms of use, electronic orders, and the processing of deliveries and necessary information transmission within the period required by law.

General Provisions

1. The data controller for the processing of personal data in accordance with the GDPR is Naakia, Business ID 3216554-7, located in Oulu.

2. The contact details of the data controller are: email: asiakaspalvelu@naakia.com, phone: 0405723453 / 0405484165.

3. Personal data includes all information related to an identified or identifiable natural person.

Source of Personal Data

1. The data controller processes personal data received with the customer's consent, which are collected through a contract for acquiring and fulfilling an electronic order from the online store.

2. The data controller processes only the customer's identifying information and contact information, which are necessary for the fulfillment of the purchase agreement.

3. The data controller processes personal data for shipping and accounting purposes and for transmitting the necessary information between the parties to the agreement within the time required by the law. Personal data is not disclosed or transferred to other countries.

Purpose of Data Processing

The data controller processes the customer's personal data for the following purposes:

1. Registration of the website according to Chapter 4, Section 2 of the GDPR;

2. Electronic order created by the customer (name, address, email, phone number);

3. To fulfill the rights and obligations of the customer and the data controller arising from the contractual relationship;

4. Personal data is necessary to fulfill the purchase agreement. The agreement cannot be made without personal data.

Retention Period of Personal Data

1. The data controller will store personal data for as long as is necessary to fulfill the rights and obligations arising from the contractual relationship between the data controller and the customer and for a period of three years after the termination of the contractual relationship.

2. The data controller is obliged to delete all personal data after the time required for storing personal data.

Recipients and Processors of Personal Data

The third parties processing the customer's personal data on behalf of the data controller are subcontractors of the data controller. The services of these subcontractors are necessary to implement the contract for acquiring and processing electronic orders in the contract between the data controller and the customer.

Subcontractors of the data controller include:

• Webnode AG (online store system);
• Freight company;
• Google Analytics (website analytics);

Customer's Rights

In accordance with the regulation, the customer has the right to:

1. Access personal data;

2. Correct personal data;

3. Delete personal data;

4. Object to the processing of personal data;

5. Data portability;

6. Withdraw consent to the processing of personal data in writing or by email to asiakaspalvelu@naakia.com;

7. Lodge a complaint with the supervisory authority in case of suspected violation of the Regulation.

Security of Personal Data

1. The data controller undertakes to implement all the technical and organizational precautions necessary to protect personal data.

2. The data controller has taken