Privacy Policy and Data Protection Description in Compliance with VisitKoli.fi, Finland's Personal Data Act (Sections 10 and 24) and the EU General Data Protection Regulation (GDPR)

Prepared on: April 18, 2018
Last updated on: January 1, 2025

1. Data Controller
Co. Weikan Oy and VisitKoli Oy
Address: Kortelahti 6, 83960 Koli, Finland

Additional contact information:
Email: info(a)visitkoli.fi

 2. Contact Person for Register Matters
Roope Tervo
Email: roope@visitkoli.fi

3. Name of the Register
Customer Register
Marketing Register
Web Service User Register
 
4. Legal Basis and Purpose of Processing Personal Data
The legal basis for processing personal data under the EU GDPR is the customer relationship.

The purposes of processing personal data include:

Communication with customers
Maintaining customer relationships
Marketing activities
Improving customer experiences
Creating anonymous statistics
 
5. Data Content of the Register

The register may contain the following data:

- Name of the individual
- Contact details (phone number, email address, address)
- Additional information provided during orders
-- IP address
-- Information about ordered services and changes to them
-- Billing details
-- Other data related to the customer relationship and ordered services

We use Matomo to collect the following information about visitors to analyze and improve website performance and user experience and monitor traffic trends and ensure the site meets user needs:

- Pages visited and the time spent on each page.
- The referring website (how you found our site).
- Your anonymized IP address.
- Browser type, operating system, and device type.
- Date and time of your visit.

Matomo is hosted on our own servers, and no data is shared with third parties. Matomo may use cookies to track your activity on our website. These cookies store non-identifiable information and are used solely for analytics purposes. Data is stored indefinitely unless a customer requests its deletion.  If you wish to access or request the deletion of your data, please contact us.

The service utilizes cookies for session management. These cookies are essential for using the service. Session-related cookies are temporary and are deleted when the browser tab is closed.

6. Regular Data Sources
Data recorded in the register is obtained from customers via:

- Online forms
- Email
- Phone
- Social media services
- Contracts
- Customer meetings
- Other situations where customers provide their data
- Vehicle registration numbers and associated images are obtained using cameras.

 7. Regular Data Disclosures and Transfers Outside the EU or EEA
Data is not regularly disclosed to other parties.

Data may be transferred outside the EU or EEA by the data controller.

8. Principles of Register Protection
Processing of the register follows due diligence, and data handled via information systems is appropriately protected. When register data is stored on internet servers, the physical and digital security of the equipment is ensured. The data controller ensures that stored data, server access rights, and other critical personal data are handled confidentially and only by employees whose duties include such processing.

9. Right to Access and Rectify Data
Every person in the register has the right to review their stored data and request the correction of any inaccuracies or incomplete information. Requests to access or correct data must be sent in writing to the data controller.

The data controller may ask the requester to verify their identity. The data controller will respond to the customer within the timeframe set by the EU GDPR (typically within one month).

10. Other Rights Related to Data Processing
Individuals in the register have the right to request the deletion of their data ("right to be forgotten"). Similarly, registered individuals have other rights under the EU GDPR, such as restricting data processing in specific situations.

Requests must be sent in writing to the data controller. The data controller may ask the requester to verify their identity. The data controller will respond to the customer within the timeframe set by the EU GDPR (typically within one month).