Data privacy statement

This data privacy statement explains what information we may collect about you, if you browse our website, or if you would like to learn more about our services, or other similar matters, and in connection you provide us with your contact details.

This data privacy statement is prepared by Shop Consulting Oy (Ltd.) with business ID 2832796-6 (“Shop“) regarding collection of data related to website www.shopconsulting.fi (and any of its sub-sites), blogs, events arranged by Shop Consulting Oy (Ltd.), and to other marketing purposes.

The purpose of this statement is to provide information to i) website visitors and ii) subscribers of newsletters, blogs and other materials, about what information may be collected and how the information is used. By using our website and/or if you submit your personal data to Shop, your personal data may be processed as explained in this data privacy statement. This data privacy statement also explains your rights concerning the personal data that we process in connection with the above mentioned activities.

By using our website, you may be asked to provide us with your e-mail address if you are interested in our service, so that we may be in contact with you. By contacting you, we may provide you with more information about our services, answer any questions that you may have or in general provide you with relevant updates concerning our service and other details about current updates.

If you would just like to receive relevant updates, you may subscribe for our newsletter and blog updates.

After you have provided us with your contact details, you may at any time change your mind and use the unsubscribe button at the bottom of each email that you receive from us. After this, you will not receive any more relevant updates from Shop.

Shop will only use your contact details in accordance with this data privacy statement, which may be found in full below. We will not use your e-mail address for direct marketing purposes without your explicit consent, or sell your contact details to any third parties.

1. Name of the register

2. Controller

3. Contact person for registry matters

4. Purpose and legal basis of processing data

When using the site, some personal data that can be connected to an individual person may be collected and processed. The legal basis for processing personal data is Shop’s legitimate interest and/or consent provided by an individual, when providing his/her personal data in connection with a subscription of blog posts, newsletters or other materials at our website or by other identifiable means. Data subject has the right to withdraw his or her consent at any time in an easy way, for example by using the unsubscribe link at the bottom of each email that is sent to data subjects and following the simple instructions at the unsubscription page.

Processing of personal data will be limited to what is justifiable to provide our website users with improved experience when browsing at our website, and to what is deemed necessary for Shop in carrying out its business and improving its services, provided that these interests are not outweighed by the data subjects rights and interests.

If a data subject has provided personal data with his/her consent, they are referred to in this statement as a “Participant”. Participant means a person, who fills in forms of Shop or otherwise registers to any of the seminars or events. With Participant is also meant any other person, who submits his/hers information for contact purposes to Shop for example through Shop’s website, online chat, by e-mail or any other way.

Personal data of the contact register may be processed for following purposes:

• managing and developing customer relationships with Shop and its partners,
• sending newsletters and blog notifications,
• registration to the events of Shop and provide information regarding the events,
• direct marketing, if the Participant has given consent;
• operational management, administration, analysis, categorization and development of the • participant data,
• improve and develop Shop’s services and products,
• statistical analyses,
• development and reporting related to the business operations, and
• fulfil the obligations based on law and orders of the authorities.

5. Regular sources of personal data

Shop collects personal data primarily from the Participants, from Shop’s customer database and through cookies.

Personal information may be collected from customer and subcontracting agreements, or otherwise directly from the Participant. The source of information may be a request for quotation made by the customer or subcontractor on behalf of himself, his company or his employer, or other contact where the data subject has provided the information. Information obtained from potential partners may also include personal information. In addition, personal information may also be collected from the Customer Information of Finland and other similar public and private registers.

6. Content of personal data in the register

If the Participant decides to provide Shop his/her personal information, Shop collects the information the Participant provides by filling in forms or contacting us. This includes information needed to fulfil the necessary actions regarding newsletter subscriptions, content downloads, registration to events and webinars, informing participants and marketing objectives.

To improve services Shop may ask Participant to provide us with additional information about Participant such as professional interests, experiences with Shop as well as more detailed contact preferences. When you provide Shop with any personal information you consent to us collecting and using that information according to this policy.

The Register may contain the following personal data:

• Basic information (name, title, position, profession, country), • Contact information (phone, e-mail address),
• Business category of the company
• Business size and turnover or category
• Contact details of a business
• Other business classification information

7. Use of cookies and related technology

With the cookies Shop can collect information about Participant’s usage of internet and online service in general. With this information we can improve our website and the services to meet the needs of Participant such as offer services targeted more accurately to Participant’s liking, e.g. by saving your favorites and by identifying you every time you return to our site. Cookies may be disabled from Participant’s browser. Please note that by disabling cookies can prevent you from using some content/services in our website.

Shop may use other technologies or third party analytical software to collect and use certain non-personal data that does not enable Shop to identify the person. Shop may use such non-personal data for purposes of analysing usage of the websites and services, and managing, providing and further developing the websites and services.

Non-personal data may include general, aggregated or demographic information. It will not be linked to any personal information, through cookies or other means, without person’s consent. This type of anonymous, aggregated profiling and session data may include information that the person has provided to Shop through the use of the websites, services or products, or taking a part in surveys, polls, etc. However, it will not be tied to any personal information, without the person’s consent.

Following cookies are in use to gather information on its visitors:

• Google – statistics and targeted advertisement and its tracking
• Cloudflare – identity trusted web traffic
• MailChimp – identify humans from bots in contact forms
• HubSpot – customer activity tracking

8. Transfers and handing over of information

 The data that Shop collects from Participant may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EU and the EEA who work for us or for one of our suppliers or subcontractors (e.g. if our service provider, supplier or subcontractor is located outside EU or EEA). The information may also be disclosed to a third party during a negotiation of any merger or acquisition and the receiving party has undertaken to follow non-disclosure liabilities with respect to the disclosed information. Only necessary personal data is shared with these third parties.

Shop will only disclose personal data based on a contract to third parties operating outside EU/EAA, which have taken steps to ensure that adequate data protection arrangements are in place in accordance with the data protection regulation. These may include, but are not limited to, standard contractual clauses provided by the European Commission, Privacy Shield compliance and certificate or Data Protection Agreements.

Personal Data may be disclosed to authorities in cases required by the mandatory local legislation or court order. Data may also be disclosed if the disclosure is permitted by applicable law, regulation or agreement or consented by the Participant.

9. Retention of personal data

Personal data will be stored only as long as and only to the extent that is necessary in relation to the initial and compatible purposes of processing. When such requirements no longer exist, personal data will be deleted. The requirements is deemed to exist during the period that the Participant receives emails or other materials from Shop based on consent.

If the data subject has unsubscribed from receiving any communication from Shop and there is no other legal basis for processing, personal data will be stored for a limited amount of time, should the Participant wish to re-subscribe to receive information from Shop. Shop will keep up to date internal policies regarding the erasure of such personal data from the Register.

In any event the personal data is stored in accordance with possible applicable lawful storing period. Shop evaluates the need to store personal data regularly. In addition, Shop performs all possible reasonable measures to ensure that any inaccurate, incorrect or outdated personal data will be deleted or corrected without delay.

10. Data protection principles

The information security of personal data and processing and confidentiality, integrity and usability are ensured with appropriate technical and administrative measures in accordance with Shop’s information security principles.

Vast majority of Shop’s personal data is in electronic form. The servers used by Shop are protected by appropriate firewalls and technical security. Communications to the customer registry are encrypted. In case there are physical documents containing personal data, such documentation is stored in a locked state and is only accessible to authorized persons.

All databases and information systems are accessible only with individual and personal login information (username and password) granted by Shop. The rights to access the database are restricted, so that the information can only be viewed and processed by persons who are legally admitted and required to do so. Only employees or Shop or potential subcontractors who need to access and process customer or subcontractor information have access rights.

The employees of Shop have bound themselves to comply with professional secrecy and concealment regarding the information they receive during the processing of personal information. Persons handling the data in the register are subject to a statutory obligation of professional secrecy and/or have signed a confidentiality undertaking. Privacy and security guidelines have been communicated to employees and Shop shall strictly enforce privacy safeguards within the company.

11. Rights of the data subject

Information and access to personal data
Data subject has right to receive information; what data is being collected, the purposes of the processing for which the personal data are intended as well as the legal basis for the processing and the recipients or categories of recipients of the personal data, if any.

Right of access by the data subject
Data subject has the right to obtain from Shop confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data. If a request is made by the data subject, Shop will provide a copy of the personal data undergoing processing. Obtaining the copy of personal data shall not adversely affect the rights and freedoms of others.

Right to rectification
Data subject shall have the right to obtain from Shop, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. In case there are changes in personal data recorded in the Register, the data subject must notify such changes to Shop. In addition, Shop is responsible for ratifying data it recognizes erroneous itself without delay.

Data used for direct marketing
Data subject has the right to object processing, to the extent that it is related to direct marketing, whether with regard to initial or further processing, at any time and free of charge. Shop shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Shop will inform data subject about those recipients if data subject requests it.

Right to erasure
Data subject has the right to request erasure of personal data in the Register, if the legal basis for processing of personal data has ceased. Despite the request for erasure, the data may not be erased if Shop is obliged to process personal data for the establishment, exercise or defense of legal claims.

Right to data portability
Data subjects have the right to receive personal data concerning him or her, which he or she has provided to Shop, in a structured, commonly used and machine-readable format and it is deemed technically appropriate and not disproportionate for Shop, the right to transmit the data to another controller.

Contact details for requests
All requests concerning the exercise of data subjects’ rights may be submitted primarily to the following address privacy [at] shopconsulting.fi. Request for access to personal data (Article 15), request for rectification (Article 16), and request for restriction of processing (Article 18) may, in addition, be delivered to Data Privacy Officer.

You may also lodge a complaint to the supervisory authority, if you consider that the processing of personal data violates the relevant data protection legislation in force. The national supervisory authority in Finland is Data Protection Ombudsman (tietosuoja@om.fi).

12. Changes to data privacy statement

Shop has the right to change or update this data privacy statement at any time.