Controller’s record of collection and processing activities concerning personal data
This is the record of activities by AF Wilderness Oy regarding personal data as provided for the General Data Protection Regulation of the EU (GDPR) and the Data Protection Act based thereupon. Published 21.2.2020.
AF Wilderness Oy (Business ID: 2816223-9)
Ali-anttilantie 8 C 18
2. Contact person
AF Wilderness Oy
Tarhurintie 8 B 22
3. Name of the Register
Customer register for the online store Korpeen.fi.
4. Legal basis and purposes for processing
The legal basis for the collecting, storing and otherwise processing of personal data are the consent of the data subject, the request to enter into contract or the contract concerning the purchase of goods and/or services, compliance with a legal obligation of the controller or the protection of the vital interests of the data subject as provided for in the Article 6 of the GDPR.
The purpose of collecting, storing and otherwise processing personal data is to enable the sale of goods and/or services via the online store Korpeen.fi or by other means, contact with the customers, upkeep of customer relations and marketing where the data subject has not forbidden it. Personal data may also be collected, stored and otherwise processed in connection with the observance of any legal obligation the controller must comply with.
Personal data is collected, stored and otherwise processed only by the employees of AF Wilderness Oy to the extent the performance of their respective duties require. In addition, data may be transferred to the accountant of AF Wilderness Oy and processed to the extent required by their duties or to any public authority in a matter falling within their jurisdiction and processed to the extent the performance of their duties requires.
Data is not used in automated decision-making.
5. Data content of the register
The following data items may be collected into to the register:
- First and last name of the customer
- Street address
- Postal code
- Term of payment
- Marketing allowed/not allowed
- Phone number
- E-mail address
- Personal ID (where the order by a natural person is invoiced)
- Purchase history (incl. goods and/or services ordered, their price details, source site for the order, terms of service, payment details)
Additionally, the following data may be collected of legal persons:
- Company name
- Business ID
- E-invoice address
- E-invoice intermediary
In the Additional Information field, the customer may also freely provide any data that s/he deems necessary.
Data is stored as long as the customer relationship between the data subject and the controller exists and/or the data subject has agreed to.
Data may be stored longer to the extent that is necessary for the compliance with or proof of compliance with any obligation set on the controller in the national or EU legislation in force.
6. Regular sources of data
Data is collected on the electronic forms in Korpeen.fi online store and the Korpeen.fi contact form. Customers provide the data personally as they place an order in the Korpeen.fi online store or when contacting AF Wilderness Oy via the contact form. The employees of AF Wilderness Oy may also store data in the customer register for example where an order has been agreed upon using other means of communication than the Korpeen.fi online store.
7. Regular transfer of data and transferring data outside the EU or ETA area
Data is store in the Johku system hosting the Korpeen.fi online store. Data may be transferred to the bookkeeper or the authorities to the extent necessary for them to fulfil any obligation provided for in the legislation in force. Data may be published as far as the publication of certain data items has been separately and explicitly agreed with the data subject. Data is not transferred outside the EU or ETA area.
8. Data protection principles
The data is always processed with due care and the data collected via data collected electronically is secured with appropriate measures. Where the collected data is store on servers, the service provider is responsible for security of the hardware and the digital data protection.
The controller is responsible for ensuring that the stored data is processed confidentially and only by such employees for whom it is necessary for the purpose of carrying out their work duties.
Data stored electronically
The register resides in the Johku service and the data may be processed by Aptual Commerce Oy in addition to the controller. The full register data can only be accessed by the controller and the technical support staff of Aptual Commerce Oy.
Customers and data subjects are encouraged to check the data protection principles of the Johku online service that are found in Finnish at johku.fi/fi/tietosuoja.
Where any manual material is created of the registered data, the material is kept in a locked space and only the controller has access to it.
9. Right of access by the data subject
Each data subject will have access to any registered data concerning them and make a claim to get any possibly inaccurate personal data corrected or to get any possibly incomplete data completed. Where the data subject wishes to access their registered personal data or request their correction or getting them completed, is shall primarily be done via Oma Johku online service as follows:
The user of the Korpeen.fi online store receives a confirmation e-mail where the user is informed of the processing of personal information by Oma Johku online service. The e-mail contains a link to the Oma Johku online service. The data subject has access to their registered personal data and can request corrections via the Oma Johku service. The data subject may also download their personal information for transferring them to another system.
The Oma Johku online service can also be accessed in the address johku.com/customer.
The data subject has the option of terminating the Oma Johku contract and get their data erased from Oma Johku. Then all the automatic functionalities relating to the management of their personal data (i.e. access to the data) are also terminated. After the termination of the contract, the data subject has access to their data, may request a correction or completion of the data, demand their erasure, limit their use or get their personal data transferred to another system by submitting their request directly to AF Wilderness Oy in writing.
AF Wilderness Oy
Metsäkuja 2 T
Where necessary, AF Wilderness Oy may request the person submitting the request to verify their identity. AF Wilderness Oy responds to the request within the time-limit set in the GDPR (within one month in most cases).
The access, correction, completion and erasure are done free of charge in Oma Johku and when requested directly from the controller. Where a request is deemed unreasonable or unfounded, the controller may set a charge for complying with the request or deny the request.
10. Other rights relating to the processing of personal data
In addition to the rights mentioned above, all other rights provided for in the GDPR (e.g. the right to limit the processing of personal data in certain cases) are available to the data subject. The request is to be made as stated above in paragraph 10 concerning a written request submitted directly to the controller.
It is to be noted that personal data is collected in the AF Wilderness Oy customer register each time Korpeen products and/or services are purchased. AF Wilderness Oy is liable to store data obtained during the sale of their products and/or services in the manner provided for in the accounting and tax legislation of Finland.