Data controller and company responsible for data processing

Mammun Hyväkakku Oy (Business ID: 2922007-4)
Koulutie 6 as. 4, 67700 Kokkola

For more information on data protection and the processing of personal data, please email: mammu@hyvakakku.fi

Purpose of the register

The personal data collected is used for:

• Maintaining the customer relationship
• Delivering, processing and archiving orders
• Developing Hyväkakku's operations and services
• Improving the customer experience
• Analytics and statistical purposes
• Producing more personalised, targeted content and marketing
• Preventing misuse
• Providing better customer service

Legal basis for collecting and processing data

Data is collected and processed on the basis of the customer relationship between the customer and Hyväkakku, a contract, use of the website, the customer's separate explicit consent or legal obligations.

Data content of the register

Information provided by users themselves or identifying the person

• Identification details, such as name
• Contact details, such as address, email address and phone number
• Payment details, including credit agreements and other billing information
• With the customer's consent, location data used to estimate delivery times

Data observed from the use of services and derived through analytics

• Purchase history, including ordered products and their prices
• Delivery details, such as the chosen delivery method and delivery address
• Product reviews
• Online shop usage and browsing data, and device identifiers
• Data and identifiers used for product recommendations and other targeted content

Data processing

Only Hyväkakku's own employees have access to customer data, and our staff are trained to use data securely and ethically. Each member of our staff can see customer data only to the extent necessary to perform their duties.

We use trusted contractual partners, which means data may be transferred to a third party. Our contracts with all partners take into account the requirements of the EU General Data Protection Regulation and other legislation.

Data retention period

Personal data is retained for as long as it is needed to fulfil the contract with the customer or to develop customer service.

Regular sources of data

Data for the register is collected from the person themselves. In addition, we may receive further information from our partners, for example the provider of our website analytics service.

Regular disclosure of data and transfer of data outside the EU or the European Economic Area

Data is not regularly disclosed outside the company. Some of the external service or software providers used by the company may store data outside the EU or the European Economic Area.

Protection of the register

Data is transferred over an SSL-secured connection.

Electronic data is stored on a reliable server protected by a firewall, usernames and passwords.

Automated decision-making

No automated individual decisions (Article 22 of the EU General Data Protection Regulation) are made.

Rights of the data subject

The data subject has the right to check what data concerning them has been stored in the personal data register. A written, signed request for access must be sent to the person responsible for register matters.

The right of access is free of charge when exercised no more than once a year.

The data subject has the right to request the rectification or erasure of incorrect or outdated data, or the transfer of data from one system to another. They also have the right to restrict or object to the processing of their data in accordance with Articles 18 and 21 of the EU General Data Protection Regulation.

The data subject has the right to withdraw consent previously given for data processing, or to lodge a complaint with the supervisory authority regarding matters related to the processing of their personal data.

The data subject also has the right to prohibit the use of their data for direct marketing purposes.