Controller’s record of collection and processing activities concerning personal data

This is the record of activities by AF Wilderness Oy regarding personal data as provided for the General Data Protection Regulation of the EU (GDPR) and the Data Protection Act based thereupon. Published 21.2.2020.

1. Controller

AF Wilderness Oy (Business ID: 2816223-9)
Ali-anttilantie 8 C 18
05840 Hyvinkää

2. Contact person

Jalo-Aatos Alastalo
AF Wilderness Oy
Tarhurintie 8 B 22
01350 Vantaa

3. Name of the Register

Customer register for the online store

4. Legal basis and purposes for processing

The legal basis for the collecting, storing and otherwise processing of personal data are the consent of the data subject, the request to enter into contract or the contract concerning the purchase of goods and/or services, compliance with a legal obligation of the controller or the protection of the vital interests of the data subject as provided for in the Article 6 of the GDPR.

The purpose of collecting, storing and otherwise processing personal data is to enable the sale of goods and/or services via the online store or by other means, contact with the customers, upkeep of customer relations and marketing where the data subject has not forbidden it. Personal data may also be collected, stored and otherwise processed in connection with the observance of any legal obligation the controller must comply with. 

Personal data is collected, stored and otherwise processed only by the employees of AF Wilderness Oy to the extent the performance of their respective duties require. In addition, data may be transferred to the accountant of AF Wilderness Oy and processed to the extent required by their duties or to any public authority in a matter falling within their jurisdiction and processed to the extent the performance of their duties requires.

Data is not used in automated decision-making.

5. Data content of the register

The following data items may be collected into to the register:

  • First and last name of the customer
  • Street address
  • Postal code
  • City
  • Country
  • Term of payment
  • Marketing allowed/not allowed
  • Phone number
  • E-mail address
  • Personal ID (where the order by a natural person is invoiced)
  • Purchase history (incl. goods and/or services ordered, their price details, source site for the order, terms of service, payment details)

Additionally, the following data may be collected of legal persons:

  • Company name
  • Business ID
  • E-invoice address
  • E-invoice intermediary

In the Additional Information field, the customer may also freely provide any data that s/he deems necessary.

Data is stored as long as the customer relationship between the data subject and the controller exists and/or the data subject has agreed to.

Data may be stored longer to the extent that is necessary for the compliance with or proof of compliance with any obligation set on the controller in the national or EU legislation in force.

6. Regular sources of data

Data is collected on the electronic forms in online store and the contact form. Customers provide the data personally as they place an order in the online store or when contacting AF Wilderness Oy via the contact form. The employees of AF Wilderness Oy may also store data in the customer register for example where an order has been agreed upon using other means of communication than the online store.

7. Regular transfer of data and transferring data outside the EU or ETA area

Data is store in the Johku system hosting the online store. Data may be transferred to the bookkeeper or the authorities to the extent necessary for them to fulfil any obligation provided for in the legislation in force. Data may be published as far as the publication of certain data items has been separately and explicitly agreed with the data subject. Data is not transferred outside the EU or ETA area.

8. Data protection principles

The data is always processed with due care and the data collected via data collected electronically is secured with appropriate measures.  Where the collected data is store on servers, the service provider is responsible for security of the hardware and the digital data protection.

The controller is responsible for ensuring that the stored data is processed confidentially and only by such employees for whom it is necessary for the purpose of carrying out their work duties.

Data stored electronically

The register resides in the Johku service and the data may be processed by Aptual Commerce Oy in addition to the controller. The full register data can only be accessed by the controller and the technical support staff of Aptual Commerce Oy.

Customers and data subjects are encouraged to check the data protection principles of the Johku online service that are found in Finnish at

Manual materials

Where any manual material is created of the registered data, the material is kept in a locked space and only the controller has access to it.

9. Right of access by the data subject

Each data subject will have access to any registered data concerning them and make a claim to get any possibly inaccurate personal data corrected or to get any possibly incomplete data completed. Where the data subject wishes to access their registered personal data or request their correction or getting them completed, is shall primarily be done via Oma Johku online service as follows:

The user of the online store receives a confirmation e-mail where the user is informed of the processing of personal information by Oma Johku online service. The e-mail contains a link to the Oma Johku online service. The data subject has access to their registered personal data and can request corrections via the Oma Johku service. The data subject may also download their personal information for transferring them to another system.

The Oma Johku online service can also be accessed in the address

The data subject has the option of terminating the Oma Johku contract and get their data erased from Oma Johku. Then all the automatic functionalities relating to the management of their personal data (i.e. access to the data) are also terminated. After the termination of the contract, the data subject has access to their data, may request a correction or completion of the data, demand their erasure, limit their use or get their  personal data transferred to another system by submitting their request directly to AF Wilderness Oy in writing.

Contact information
Jalo-Aatos Alastalo
AF Wilderness Oy
Metsäkuja 2 T
05460 Hyvinkää

Where necessary, AF Wilderness Oy may request the person submitting the request to verify their identity. AF Wilderness Oy responds to the request within the time-limit set in the GDPR (within one month in most cases).

The access, correction, completion and erasure are done free of charge in Oma Johku and when requested directly from the controller. Where a request is deemed unreasonable or unfounded, the controller may set a charge for complying with the request or deny the request.

10. Other rights relating to the processing of personal data

In addition to the rights mentioned above, all other rights provided for in the GDPR (e.g. the right to limit the processing of personal data in certain cases) are available to the data subject. The request is to be made as stated above in paragraph 10 concerning a written request submitted directly to the controller.

It is to be noted that personal data is collected in the AF Wilderness Oy customer register each time Korpeen products and/or services are purchased. AF Wilderness Oy is liable to store data obtained during the sale of their products and/or services in the manner provided for in the accounting and tax legislation of Finland.