Privacy Policy

This Privacy Policy (hereinafter referred to as the “Policy”) explains how Andas Oy collects and processes customers’ personal data. Personal data is processed in accordance with applicable legislation and the data protection principles set out in the EU General Data Protection Regulation (GDPR).

Data Controller

The data controller under applicable data protection law is Andas Oy (hereinafter referred to as “Andas”, “we”, “us”, or “our”). Andas is responsible for ensuring that your personal data is processed in accordance with this Policy and applicable data protection laws.

Contact details of the data controller

Company name: Andas Oy
Business ID: 2565715-5
Address: Kylpyläntie 4 A, FI-02700 Kauniainen
Email address: info@andas.fi

Data Protection Officer

Address: Kylpyläntie 4 A, FI-02700 Kauniainen
Email address: info@andas.fi

1. Collection of personal data

Your personal data may be collected in various ways depending on the situation. We collect and process personal data that:

• you provide to us when contacting us or doing business with us, for example during a customer relationship, when subscribing to our newsletter, or when requesting a quote or additional information

• is generated when you visit our website or make purchases in our online store

• is collected through the use or maintenance of our systems

• is received from our partners

• is obtained through automatic updates

We may collect and process the following categories of personal data:

• basic information such as name and contact details (email address, address, and phone number)

• information related to the customer relationship, payment information, invoicing information, and marketing permissions or restrictions

• customer communications and related correspondence, including records related to the exercise of data subject rights

• information collected when using our website, for example through cookies or similar technologies (device identifier and type, operating system, and application settings)

• log data

2. Purpose and legal basis for processing personal data

We collect and process only personal data that is necessary for conducting our business, managing customer relationships, and other appropriate purposes.

We process your personal data for the following purposes:

Customer relationship management

We process personal data to maintain the customer relationship between you (or the company you represent) and us.

In this case, the processing of personal data is based on a contract.

Marketing

We may contact you to inform you about new products or to market and sell our other services or products to you. We may also process your personal data for marketing research and customer surveys.

In these cases, the processing of personal data is based on legitimate interest or consent.

Invoicing

We process personal data for invoicing purposes and to receive invoices.

In these cases, the legal basis for processing personal data is legal obligation, contract, and legitimate interest.

Service development, security, and internal reporting

We may also process personal data to ensure the security of our customer relationships and website, improve quality, and develop our services. Personal data may also be used to compile internal reports for management to support the proper management of our business.

In these cases, the processing of personal data is based on legitimate interest.

Compliance with legal obligations

We process personal data to comply with legal obligations, such as accounting requirements or responding to lawful requests from authorities.

In these cases, the processing is based on a legal obligation.

Other purposes based on your consent

We may process personal data for other purposes if you have given your consent to such processing. In such cases, the processing is based on consent.

For processing activities based on legitimate interest, we have carried out a balancing test to ensure that the processing is justified.

3. Transfers and disclosures of personal data

We may transfer or disclose personal data to third parties:

• to the extent permitted or required by law, such as in response to a request from a competent authority or in connection with legal proceedings

• when our partners or subcontractors process personal data on our behalf

• if we are involved in a merger, corporate restructuring, or sale of a business or part of a business

• when we consider disclosure necessary to protect our rights, ensure the safety of you or others, investigate misuse, or respond to requests from authorities

• with your consent to parties covered by that consent

Data processing agreements (DPA) have been concluded with personal data processors, or the processing of personal data has been defined in the relevant service agreement. We instruct data processors and ensure that personal data is processed appropriately and securely.

4. Transfers of personal data outside the EU or EEA

If the processing of personal data requires transfers outside the European Union (EU) or European Economic Area (EEA), we will ensure appropriate safeguards.

Personal data may be transferred outside the EU or EEA when our partners or their subcontractors are located outside these areas.

Squarespace’s data transfer mechanisms apply where relevant.

5. Retention of personal data

Personal data is stored only for as long as necessary to fulfill the purposes defined in this Policy.

Personal data is primarily stored for the duration of the customer relationship. Personal data may also be stored after the end of the customer relationship to the extent permitted or required by applicable law.

For example, after a customer relationship has ended, we may retain personal data necessary to respond to claims or legal actions. We may also retain personal data to ensure compliance with direct marketing opt-out requests.

Personal data will be deleted when its retention is no longer necessary for legal obligations or for the rights or obligations of either party.

6. Your rights as a data subject

You have the following rights under the EU General Data Protection Regulation (GDPR):

• the right to be informed about the processing of your personal data

• the right of access

• the right to rectification

• the right to erasure (“right to be forgotten”)

• the right to restrict processing

• the right to object to processing

• the right to data portability

• the right not to be subject to automated decision-making

The exercise of these rights may depend on the legal basis under which personal data is processed. Personal data that is necessary for the purposes defined in this Policy or that must be retained by law cannot be deleted.

When processing personal data based on consent, you have the right to withdraw your consent at any time. After withdrawal, we will no longer process your personal data unless another legal basis for processing exists.

You may exercise your rights by contacting us at:

info@andas.fi

If you believe that the processing of your personal data is not lawful, you have the right to lodge a complaint with a supervisory authority. Contact details of the Finnish Data Protection Ombudsman can be found on the authority’s website.

7. Cookies

We also use cookies and similar technologies on our website eevajaakonsalo.fi. Cookies are small text files placed on your device to collect and store useful information in order to improve the functionality and usability of our website.

Cookies may also be used for statistical purposes, such as compiling statistics on website usage in order to understand how users interact with the website and to improve the user experience.

You may block cookies, restrict their use, or delete cookies through your browser settings. However, because cookies enable certain functions of our website, restricting their use may affect the usability of the website.

8. Data security

We implement appropriate measures (including physical, technical, and administrative safeguards) to protect personal data from loss, destruction, misuse, and unauthorized access or disclosure. Personal data is accessible only to individuals who require it to perform their work duties.

9. Changes to this Policy

We reserve the right to modify this Policy. Any changes will be announced on our website, where the latest version of the Policy will always be available.

10. Contact

If you have any questions regarding this Policy or would like more information about the processing of your personal data, please contact us at: info@andas.fi.