DATA PROTECTION STATEMENT FOR
CUSTOMER REGISTER

NAME OF REGISTER

Customer Register

PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL DATA

Personal data is collected for a specific, legal purpose in order to fulfil contractual obligations to our customers and legal requirements as well as our legitimate commercial interests as the data control-ler (e.g. direct marketing). The register includes data from sources related to our customers and stakeholders.

All personal data is collected according to this data protection statement and will under no circum-stances be used, altered or transferred in a manner not specified here.

CONTENTS OF REGISTER

The register contains personal data from Atsuuri Oy’s customers. This includes names, addresses, phone numbers, e-mail addresses, identity numbers, nationalities, reasons for travel and other in-formation pertinent to managing customer relations.

REGULAR DATA SOURCES

Personal data is collected into the register from the data subjects themselves as well as from tour operators and booking services.

REGULAR SHARING OF DATA

Customer data can be provided to the authorities if required by the law and in order to meet legal requirements related to bookkeeping. Data may also be transferred to Atsuuri Oy’s marketing regis-ter. In individual cases, Atsuuri Oy may relinquish customer data to a specific party after a lawful request or if a verified authority has made a lawful demand for Atsuuri Oy to release a specified piece of data from Atsuuri Oy’s database.
9 TRANSFER OF DATA TO THIRD NATIONS OR INTERNATIONAL ORGANISA-TIONS

The customer data is stored and processed on servers located in the United States. The service pro-viders have committed to adhering to the GDPR. No data will be transferred to third nations or in-ternational organisations otherwise.

RIGHT OF ACCESS

Data subjects have a right to discover what data related to them is stored in the register. Following a sufficiently accurate and specific request, data subjects also have a right to access stored data relat-ed to them. Requests for access should be addressed in writing to the register’s contact person. In-clude a copy of valid photo identification.

RIGHT TO RECTIFICATION AND ERASURE OF DATA

Should a data subject discover an error in their stored personal data, the data controller must rectify the register. The data controller is also obligated to proactively inspect and update the data in their register. Data subjects may also demand the data controller to erase their personal data from the register. The data protection officer is in charge of such operations.

OTHER RIGHTS RELATED TO PROCESSING OF PERSONAL DATA

Data subjects have a right to demand limited processing of their personal data. Data subjects also have a right to receive any personal data they have provided to the data controller in a structured, commonly used and machine-readable form. They may also provide this data to other data control-lers. Additionally, data subjects may object to our data processing, automated decision-making and profiling.

ERASURE OF DATA AND PERIOD OF RETENTION

Atsuuri Oy will erase customer data from the register once there is no longer a commercial reason to retain the information. Personal data will be processed during the customer relationship and for a necessary time afterwards to fulfil warranty and liability requirements.

Personal data is erased by overwriting once there is no basis for processing or storing the data. However, customer data will not be deleted if retaining the data is required by the law, if a verified authority has initiated a process leading to the release of said data or if a relevant party has submit-ted a plea to the Finnish justice system to safeguard the data.

APPROVAL OF DATA PROTECTION STATEMENT