1. DATA CONTROLLER<\/p>\n
The data controller is Suomen Yrityskaupat Oy (business ID 1056245-3).<\/p>\n
The contact person of the privacy policy is:<\/p>\n
Juha-Petteri Rantanen, CEO<\/p>\n
Suomen Yrityskaupat Oy
\nAddress: Kauppiaskatu 9 B a
\nPhone: 010 2864 002
\nEmail: info@yrityskaupat.net<\/p>\n
2. NAME OF THE REGISTER<\/p>\n
The register\u2019s name is the Suomen Yrityskaupat online service register.<\/p>\n
3. PURPOSE OF PROCESSING PERSONAL DATA<\/p>\n
The data controller processes personal data for purposes related to maintenance, management and developing the data controller\u2019s online service, which includes processing data for statistic purposes and management of customer, partner and stakeholder relationships related to the online service.<\/p>\n
For the aforementioned purposes the data controller processes personal data to produce a service for their customers, partners and stakeholders and in communication related to this.<\/p>\n
In addition, the data controller processes personal data for other communication purposes with customers, such as information and reporting purposes, a part of which is to process personal data for purposes related to direct marketing and electronic direct marketing.<\/p>\n
A registered person has the right to prohibit direct marketing aimed at them.<\/p>\n
4. LEGAL BASIS FOR PROCESSING PERSONAL DATA<\/p>\n
The following list, which complies with the Personal Data Act, defines the legal basis for the processing of personal data:<\/p>\n
the unambiguous consent of the data subject,
\nthe data subject has given an assignment for the same, or this is necessary in\u00a0 order to perform a contract to which the data subject is a party or in order to take steps at the\u00a0 request of the data subject before entering into a contract,
\nthere is a relevant connection between the data subject and the operations of the\u00a0 controller, based on the data subject being a client or member of, or in the service of, the\u00a0 controller or on a comparable relationship between the two (connection requirement),
\nthe unambiguous consent of the data subject to process their national identification number.<\/p>\n
The following list, which complies with the General Data Protection Regulation of the EU, defines the legal basis for the processing of personal data:<\/p>\n
the data subject has given consent to the processing of his or her personal data for one or more specific purposes,
\nprocessing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,
\nprocessing is necessary for compliance with a legal obligation to which the controller is subject,
\nprocessing relates to personal data, including data belonging to a specific personal data group, which are manifestly made public by the data subject,<\/p>\n
The aforementioned legitimate interest of the data controller is based on the relevant and appropriate relationship between the data subject and the data controller, which is a consequence of the data subject or their organization being a client or partner of the data controller, and the processing is done for purposes the data subject could reasonably expect to involve the collection of personal data and in the context of an appropriate relationship.<\/p>\n
5. DATA CONTENT OF THE REGISTER (PROCESSED CATEGORIES OF PERSONAL DATA)<\/p>\n
The register contains personal data of the following persons (data subjects):<\/p>\n
Seller (private person) or representative, contact person or employee of a seller organization using the service,
\nBuyer (private person) or representative, contact person or employee of a buyer organization using the service,
\nRepresentative, contact person or employee of a brokering organization using the service,
\nRepresentative, contact person or employee of a bank\/financier organization using the service.<\/p>\n
The register contains the following personal data of all data subjects:<\/p>\n
the basic information and contact information of the data subject: first name, last name, address, phone number, email address,
\ninformation related to the data subject\u2019s work and position: the business\u2019 name and the data subject\u2019s function,
\nthe log files of the information system created as a result of using the service,
\npossible direct marketing consent or prohibition given by the data subject.<\/p>\n
The register contains the data subject\u2019s username and password for those data subjects granted access to Suomen Yrityskaupat\u2019s data room.<\/p>\n
In addition, the register contains photographs of representatives, contact persons and employees of the brokering organization using the service.<\/p>\n
In addition, the register contains the national identification number of those data subjects, who are part of a brokering assignment and have signed a non-disclosure agreement in the service.<\/p>\n
The register also contains information about which target businesses data subjects from buyer organizations have requested additional information about in the service.<\/p>\n
The register also contains notes on the brokering process made by data subjects from the brokering organization.<\/p>\n
Giving the personal data described above to the data controller is prerequisite for providing the data controller\u2019s service, and if the data controller does not receive the personal data in question, the data controller cannot provide the service for the data subject and fulfill their obligations related to it.<\/p>\n
6. STANDARD SOURCES OF INFORMATION<\/p>\n
The data subject discloses their own basic information, contact information and national identification number. The data controller gives data subjects granted access to Suomen Yrityskaupat\u2019s data room, their username for the data room. The data subjects selects a password that is connected to the username in question, and which is saved to the data room. Logfiles of the data subjects use of the service are saved to the information system. Information about which target businesses data subjects from buyer organizations have requested additional information about in the service are saved to the service when the data subject uses the service. Direct marketing consent and prohibition of the data subject is saved to the service when the data subject uses the service and states their consent or prohibition.<\/p>\n
7. RETENTION PERIOD OF PERSONAL DATA<\/p>\n
The data collected in the register is only stored as long and to the extent it is necessary in relation to the original or compatible purposes, for which the personal data has been collected.<\/p>\n
The personal data collected in the register is stored in accordance with the following retention periods:<\/p>\n
The data subject\u2019s basic information, contact information and information related to their organization and position, the data subject\u2019s search history regarding the service\u2019s businesses for sale, the data subject\u2019s consent or prohibition regarding direct marketing and the notes on the brokering process made by a data subject from the brokering organization are stored for the period required in accounting legislation (a maximum of 10 years) and in addition for a period necessary for the data controller\u2019s statistic purposes and for the purpose of developing the data controller\u2019s operation and for storing information in order to contact clients. Data is stored for the period mentioned above, except if storing the data for a longer period is justifiably in the best interest of the data subject.
\nThe national identification number of the data subject is stored for the period necessary to complete the business transfer.
\nThe data subject\u2019s username, password and logfiles related to the use of the service and other technical information collected and processed to produce the service are removed from the service immediately after storing them becomes unnecessary for producing the service.<\/p>\n
The necessity of storing personal data is evaluated every five years and all data concerning the data subject is nevertheless removed from the register 10 years after the data subject\u2019s customer relationship or partnership with the data controller ends and the obligations of the customer relationship or partnership have been completed.<\/p>\n
8. THE RECIPIENTS OF PERSONAL DATA (CATEGORIES OF RECIPIENTS) AND STANDARD DISCLOSURE OF INFORMATION<\/p>\n
The data subject\u2019s name, national identification number, phone and telefax number and email address are disclosed, with the data subject\u2019s unambiguous consent for the purpose of producing the data controller\u2019s service, to the following recipients:<\/p>\n
The disclosure of a seller\u2019s (private person) or seller organization\u2019s data subject\u2019s personal data to potential buyers after the signing of a non-disclosure agreement,
\nThe disclosure of a buyer\u2019s (private person) or buyer organization\u2019s data subject\u2019s personal data to seller organizations after the signing of a non-disclosure agreement,
\nThe disclosure of a seller\u2019s (private person), buyer\u2019s (private person) or a seller or buyer organization\u2019s data subjects\u2019 personal data (including national identification number) to a business broker after the signing of a non-disclosure agreement,
\nThe disclosure of a seller\u2019s (private person), buyer\u2019s (private person) or a seller or buyer organization\u2019s data subjects\u2019 personal data (including national identification number) to a bank\/financier registered in the service.<\/p>\n
After the aforementioned data has been disclosed to a recipient, i.e. another data controller, the other data controller processes the personal data and might e.g. disclose the data to third parties.<\/p>\n
The data controller uses contractors, i.e. personal data processors, to process personal data on behalf of the data controller.<\/p>\n
9. THE TRANSFER OF DATA OUTSIDE THE EU OR THE ETA<\/p>\n
Data in the register is not transferred outside the EU or the ETA.<\/p>\n
10. PRINCIPLES OF REGISTER PROTECTION<\/p>\n
Material containing personal data is stored in locked spaces, which can only be accessed by designated and due their position authorized persons.<\/p>\n
The database containing personal data is on a server stored in a locked space, which can only be accessed by designated and due their position authorized persons. The server is protected by an adequate firewall and technical protection. The firewall prevents access to unnecessary resources in terms of the service. The access to services used for maintenance is restricted to a specific web address.<\/p>\n
The databases and systems can only be accessed with separately issued personal usernames and passwords. The data controller has limited the access rights to the information systems and other platforms where information is stored, so that the data can only be viewed and processed by necessary persons in terms of legal processing. In addition, the use of databases and systems is registered to the data controller\u2019s IT system\u2019s log information.<\/p>\n
The data controller\u2019s employees and other persons are bound to secrecy and to keeping information they\u2019ve received during the processing of personal data secret.<\/p>\n
11. RIGHTS OF THE DATA SUBJECT<\/p>\n
The data subject can contact the data controller and request to access their own personal data, request the correction or removal of this data and the limitation of the processing. In addition, the data subject object to the processing and request the data be moved from one system to another. The data controller processes the data subject\u2019s request and responds to it within the time frame required in the data protection legislation.<\/p>\n
In addition, the data subject has the right to retract their consent if the processing of personal data is based on consent. However, the retraction does not affect the legality of the processing preceding the retraction.<\/p>\n
The data subject also has the right to make a complaint to a supervisory authority.<\/p>\n
The requests of the data subject are directed to the data controller\u2019s contact person stated in point 2.<\/p>\n","protected":false},"excerpt":{"rendered":"
1. DATA CONTROLLER The data controller is Suomen Yrityskaupat Oy (business ID 1056245-3). The contact person of the privacy policy…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":4268,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"acf":[],"yoast_head":"\n