Privacy Policy

In this privacy statement regarding the processing and protection of personal data by the companies belonging to SHInvest Oy (hereinafter “SHInvest”), we explain how we are committed to respecting and protecting our customers’ privacy. We understand that privacy is important to our customers.

In this Privacy Statement, we:

- Explain how we collect, use and protect your personal data;
- Describe how we protect and respect your privacy; and
- Help you understand how your personal data is collected and used, and what rights you have.

YOU CONFIRM THAT YOU ARE AWARE THAT SHINVEST MAY, FROM TIME TO TIME, AT ITS SOLE DISCRETION AND WITHOUT PRIOR NOTICE, CHANGE, AMEND, SUPPLEMENT, SHORTEN OR OTHERWISE UPDATE THIS PRIVACY STATEMENT.

We process your personal data in accordance with Finnish law and the instructions and regulations issued by the authorities.

This Privacy Statement applies when you use our products and services or visit our websites. It does not apply to services or websites provided by other companies, even if you access them through SHInvest’s network or services.

Definitions

The following terms are used in this Privacy Statement as defined below:

**Customer** means a person registered on the websites or a subscriber, purchaser or user of our Services and products.

**Personal data** means information that can be directly or indirectly linked to you as an individual. The types of personal data we process are described below in this Privacy Statement.

**Services** means all products and services offered by SHInvest.

**Traffic data** means data processed to transmit messages or information. Data generated when using the Services may include, for example, the start and end times of communications; information about the parties to a communication and the terminal device; the duration and routing of a message; the location or geolocation of a terminal device; or other similar information processed over a network to transfer, share or transmit information.

How do we collect your personal data?

The personal data we collect depends on the Services you use, subscribe to or purchase, and on the information you provide to us in connection with these activities or when otherwise logging in to a Service we offer. You are not required to provide personal data to SHInvest, but if you choose not to do so, we may be unable to provide our services to you.

We collect personal data that:

- You provide when dealing with us, for example when you buy or rent our Services, log in to our Services, order brochures, enter competitions, subscribe to our newsletter or otherwise contact us.
- Is generated when you use a Service, to the extent permitted by law—for example, when you use our websites or other Services, make a phone call or send an email.
- We obtain from other sources, such as other service providers or publicly available registers, for example the Population Information System, postal registers or customer marketing registers.

What personal data do we collect about you?

We collect the following types of personal data:

Basic information, such as your name and contact details, family relationships, and information about your spouse and their contact details.
Demographic information, such as your date of birth, occupation and mother tongue.
Your type of residence and characteristics of your housing.
Customer relationship information, such as details of Services, products and orders; billing, credit and payment information; marketing consents and refusals; customer enquiries; and related records, such as contacts with sales, customer service and/or production.
Information generated through the use of communications and other Services, such as traffic data relating to calls and emails, information about the parties to a communication, the time of the communication, location data and information about the terminal device.
Other information describing your use of a Service, such as information collected through cookies and similar technologies when browsing the internet or using mobile websites and applications.
Information related to customer and user identification and registration, such as usernames and passwords required to manage mobile certificates.
Other information collected with your consent and specified in more detail when that consent is requested.

How do we use your personal data?

SHInvest collects, processes and uses personal data necessary to conduct our business, provide customer service and carry out appropriate commercial activities.

The processing of personal data is most often based on a contract with us or on SHInvest’s legitimate interest in providing and enabling the use of the Services. We may also process personal data on other grounds, such as your consent or a legal obligation.

SHInvest processes your personal data for the following purposes:

- Providing the Services: We process personal data to offer and provide the Services. This requires us to process personal data to identify customers or users; process and deliver orders; issue invoices; monitor credit; collect payments; provide customer service; and handle complaints. We also process personal data for customer communications, such as sending notices relating to the Services and contacting customers about matters concerning our Services.

- Sales and marketing: We process and use personal data for marketing and to create marketing target groups, to the extent permitted by applicable law. We may process personal data to personalize and target content—for example, by making recommendations and displaying targeted content in our Services or channels (web and social media). To the extent permitted by law, we may use personal data to market our own products and services and those of our partners, including for direct marketing, market research and customer satisfaction surveys.

- Development and analysis: We internally process personal data to develop and manage our business, Services and related processes. We also process personal data to better understand our customers’ needs. We may compile statistics to develop the Services or for other analytical purposes. We may group customers based on billing, usage levels, the duration of the customer relationship and external classifications. For example, we may examine how different user groups use our Services, or how a person’s place of residence and age affect their use of the Services.

- Service security and preventing misuse: We may process personal and traffic data to ensure the security of all our Services and communications networks. Where necessary, we may also process personal data to detect or prevent misuse of or fraud involving the Services.

- Compliance with legal obligations: We process personal data to meet our legal obligations, for example for accounting and regulatory purposes.

- Other purposes for which you have given consent: We may process your personal data for any purposes to which you have consented.

In all of the situations described above, we process personal and traffic data only to the extent required for the relevant purpose and always take our customers’ privacy into account.

SHInvest processes your personal data only for the specified purposes. We may combine data collected in connection with different Services insofar as it was collected for the same purpose. We never process personal data in a manner incompatible with the specified purpose.

How do we protect your personal data?

We take care of the security of data, information systems and personnel, as well as our offices and technical facilities. We continually work to protect our customers’ personal data and rights.

When securing data, we take into account the risks to privacy and business associated with processing personal data, available technical capabilities and various threats, in accordance with applicable laws, regulations and contractual obligations.

Information security and the protection of customer data are of the utmost importance to us. We strive to implement appropriate procedures to protect personal data and to prevent and detect unauthorized access to it.

To whom do we disclose your personal data?

We may disclose your personal data to:

Companies belonging to the same corporate group as SHInvest, to the extent permitted by applicable law. Our group companies may use your personal data for the purposes specified in this statement, including to market their products or services to you.
Subcontractors acting on behalf of SHInvest and processing personal data under instructions from us. These third parties may not use personal data for any purpose other than providing the services agreed with us. When using subcontractors, we take appropriate steps to ensure that processing complies with this Privacy Statement.
Partners that process personal data on our behalf. These partners may be located outside Finland, the European Union or the European Economic Area. In such cases, we ensure, as required by law, that your personal data remains protected.
Other service providers that provide, or have undertaken to provide, services to you—for example, billing services.
Other third parties, with your consent, which may have been obtained in connection with a particular service.
We may also disclose your data:
In connection with legal proceedings, or in response to a request from an authority, where permitted or required by applicable law or by court order in connection with legal or administrative proceedings. Pursuant to a court order, personal data may be disclosed, for example, to a copyright holder or its representative.
To a competent authority, such as the police or emergency services, to the extent required by law and in accordance with a procedure established in advance.
In situations required or permitted by law, such as providing the subscriber with an itemized statement of a bill.
In connection with business arrangements, such as mergers and various business sales or transfers.

We may also process statistical information that cannot be linked to you as an individual. This information may be disclosed to third parties for purposes other than those described in this Privacy Statement.

How long do we retain your personal data?

We retain personal data for as long as necessary to fulfil the purposes specified in this Privacy Statement, unless otherwise required by law.

We do not retain outdated or unnecessary data. We strive to ensure that personal data and other customer information is up to date and accurate.

How do we use cookies?

Our websites may use cookies. Cookies help us identify the most popular sections of our websites, which pages users visit and how long they spend on them. The information collected is used, for example, to provide, develop and analyse the Services and to target marketing in services or networks provided by SHInvest or its partners.

You can prevent cookies from being stored by changing your browser settings. In some cases, this may slow down your browsing of our websites or prevent access to certain pages altogether.

We typically use information collected through cookies for the following purposes:

Functional cookies and providing the Services: Cookies are important for the operation of our websites and electronic Services and enable a smooth user experience.
Service development: By monitoring the use of cookies, we can improve how our websites and electronic Services work. For example, we can learn which sections of our websites are most popular, where users go, which website they came from and how long they stay on our websites.
Analysis: We use cookies to statistically monitor visitor numbers on our websites and electronic Services and to measure advertising effectiveness. For example, we may collect information about marketing emails and newsletters to determine whether they have been opened and whether recipients have taken action, such as visiting our website.
Targeted marketing: Cookies also enable us to collect information to provide advertising or content targeted to a particular browser by creating different target groups.

To the extent permitted by law, we may combine information obtained through cookies about a user with information obtained in other contexts, such as information about the Services they use.

SHInvest’s websites may contain links to and connections with third-party websites, products and services, as well as third-party social plugins such as Facebook’s Like button. The privacy statements of the relevant third parties apply to these third-party services and applications offered on SHInvest’s websites. We recommend that you review the privacy practices of the relevant third parties.

What rights and choices do you have?

You have the right to:

Request the correction or deletion of inaccurate, unnecessary, incomplete or outdated personal data.
Object to the processing of your personal data if the legitimate business purposes described in this Privacy Statement and compliance with the law do not appear to require that processing.
Check whether we process personal data about you and, in accordance with applicable law, find out what data we process. A request to access your data must be submitted in a personally signed or similarly authenticated document, or in person to SHInvest.
Prohibit the publication and disclosure of your personal and contact details to contact information services.
Prohibit the use of your personal data for direct marketing and for market and opinion research.
Withdraw your consent. In that case, we may be unable to provide our Services to you.
File a complaint if you believe that SHInvest has acted in breach of this Privacy Statement or applicable law.

ENQUIRIES AND ACCESS REQUESTS RELATING TO THE PROCESSING OF PERSONAL DATA

The data controller for personal data is SHInvest Oy.