Privacy policy

Register and privacy policy

Suomen Biovoima Oy undertakes to comply with the data protection and personal data legislation in force in Finland, including the EU General Data Protection(GDPR) and other laws and regulations applicable to its operations that govern the processing of personal data, and to process personal data in accordance with good data management and data processing practices. The personnel of Suomen Biovoima Oy are obliged to keep all personal data strictly confidential.

Date of creation

1.1.2025

Data controller

Suomen Biovoima Oy (Business ID: 2665724-6)
Kivääritehtaankatu 6 E, 40100 Jyväskylä, Finland
info@biovoima.fi

Contact person for matters concerning the register

Mikko Ronkainen
mikko.ronkainen@biovoima.fi

+358 50 3249 285

Name of the register

Finnish Biovoima Oy customer and marketing register

Data content of the register

The controller wants to serve its customers and marketing activities in the best possible way and offer registered users content that is of interest to them. The following data may be stored in the register and processed using it. Not all of the information listed below is necessarily available for every user.

• Name of the registered person, name of the customer company, contact person's phone number, email address, postal address, and information about the services used by the customer company
• Changes to the above information

In addition, the register may contain other notes related to the data subject and their possible customer relationship, as well as other information necessary for the proper management of the customer relationship. This may include, for example, information about the data subject's newsletter subscriptions, past or future event participation, contact requests, or information about the services ordered by the data subject, their delivery, and invoicing. The register may also contain information derived from the use of services, such as segmentation into a specific user group based on service use or user interests.

Purpose and legal basis for processing personal data

Personal data is used by Suomen Biovoima Oy.

• Targeting customer communications and marketing measures
• Producing, providing, personalizing, and developing services
• For communicating and marketing services and events
• For managing, maintaining, and developing both existing and potential customer relationships
• Planning and development of the controller's business operations
• For market research and other statistical purposes

Personal data is processed based on the consent given by the data subject, the legitimate interests of the controller, or for the preparation or performance of a contract to which the data subject is a party.

The storage of personal data is partially outsourced to external service providers. The controller guarantees that such outsourcing is carried out in accordance with applicable data protection and personal data legislation and that external service providers do not use the data in this personal data register for their own purposes.

Sources of information

The personal data in this register is obtained from

• directly from the registrant themselves,
• Information stored about visits to the registered biovoima.com website.

Retention period for personal data

The data collected in the register will only be stored for as long and to the extent necessary and permitted by law in relation to the original or compatible purposes for which the personal data was collected. Personal data may be used after the end of the customer relationship if required by applicable law.

In addition, the Controller shall take all reasonable steps to ensure that personal data that is inaccurate, incorrect, or outdated in relation to the purposes of processing is corrected or deleted without delay.

Principles of register protection

The confidentiality of the personal data of customers and website users is important to the Data Controller. The Controller has implemented appropriate technical and organizational measures to protect personal data from accidental or unlawful loss, disclosure, misuse, alteration, destruction, or unauthorized access.

The use of the register is guided by the controller's organization, and access to the personal register is restricted by user rights so that only employees who are authorized to do so due to their job duties and who need the information in their work can access and use the data stored in the system.

The information systems used for processing personal data are adequately protected by technical means, and access to them is protected by appropriate methods, including personal user IDs and passwords. The data in the registers is backed up securely. Materials containing personal data are disposed of in a secure manner.

Disclosure of information

Personal data will not be disclosed outside the controller or service providers storing the data in such a way that the data would be identifiable as relating to an individual user, except in the following exceptional circumstances: when required by law or official order, by court order, or if otherwise necessary to prevent or investigate suspected violations of the law, the terms of use of online services, or good practice, or to protect the rights of the controller or third parties.

Transfer of personal data outside the European Union/European Economic Area

The controller may transfer personal data outside the EU and EEA for technical reasons when using external service providers for data storage on the basis of a cooperation agreement between the parties. These transfers are carried out securely in accordance with data protection legislation and within the limits set by it.

Rights of the data subject

The data subject has the right to inspect the information concerning him or her in the register and to request that any incorrect, incomplete, or outdated information be corrected. Requests for inspection and correction must be addressed to the contact person for the personal register, whose contact details can be found at the beginning of this document, either by visiting them in person or by sending a signed letter or a similarly certified document to verify the right of the person making the request. Requests for inspection will be responded to within one month of the request being made.

The data subject has the right at any time to withdraw their previously given consent to the processing of data or to lodge a complaint with the supervisory authority regarding matters related to the processing of their personal data. The data subject also has the right to request the deletion of their personal data from the register, provided that it is no longer needed for the purposes for which it was collected or otherwise processed, or that there are no legal obligations on the controller to process or store them. The data subject also has the right to request the restriction of the processing of their personal data or to object to the processing of personal data concerning them, for example, for direct marketing and related profiling.