DATA CONTROLLER
Innojok Oy
Business ID: 0810888-4
VAT ID: 0946281-8
Address: Sirrikuja 3L, 00940 Helsinki
Tel. +358 9 4272 0637
Email: info@innolux.fi
Legal basis and purpose of processing personal data
The legal basis for processing personal data is the controller’s legitimate interest, based on the customer relationship between the data subject and the controller. Collected personal data is used to identify the user on the website, including for online store customer accounts. In addition, the service may send notices to customers.
Data collected
From registered customers and those placing orders, we collect the following data:
First and last name
Email address
Address
Phone number
Order and delivery history, customer communication, and website behavior
Additional information provided by the customer
Marketing consents and prohibitions
For business customers: equivalent data and business ID
We also collect technical data from website visitors, which may be considered personal data, such as IP address, operating system, and device type.
Cookies
A cookie is a small text file stored on a computer. On the website, cookies are used in a way that does not violate the user’s privacy. We use cookies primarily to improve website usability and functionality, and to evaluate how the site content is used.
Cookies can collect information such as which page you came from, which pages you have browsed and when, which browser you use, your screen resolution and operating system, as well as your IP address, meaning the internet address from which your data is sent and received.
Cookie data is used to monitor visitor numbers on the site by Innolux and its partners, and to analyze and improve the site to better serve users. In addition, Innolux’s partners may use cookies for targeted advertising by collecting information about visits to this and other websites. This data is used to create interest-based targeted advertising. In cookie-based ad targeting, users are not individually identified, and the data is not combined with personal information obtained from other sources.
We use third-party analytics and marketing systems on our website, such as Google Analytics, Facebook Pixel, and Klaviyo. These systems collect anonymous data using cookies to evaluate and improve website usage. This includes information such as how the user arrived at the site and how they interact with it. The service providers process and store this data on their servers.
Standard sources of data and legal basis for processing personal data
The personal data entered into the register is regularly obtained directly from the registered user, and we process personal data for the performance of a contract or order. Data collection takes place when registering on the website or online store.
In addition, we collect information about purchased products, written comments, and user behavior in the service. Technical analytics data is automatically recorded during website visits.
If you have subscribed to our newsletter or otherwise given consent to receive direct marketing, we may process your personal data to send marketing materials. You always have the right to prohibit electronic direct marketing, or you may withdraw your consent to the processing of personal data.
Disclosure of personal data
Personal data is generally not disclosed, and we process personal data within the EU. If personal data were transferred outside the EU, we ensure that the data transfer agreements include standard contractual clauses for international transfers and comply with EU legislation requirements.
However, data may be disclosed, for example, to authorities based on a legal obligation, as well as to authorized service providers such as delivery companies.
Protection of personal data
The website server is SSL-secured, and personal data is stored in an encrypted database. Personal data is only processed by persons for whom it is justified based on their job duties.
Data retention period
Data is stored for as long as the user account or customer relationship is registered. If the user deletes their account or submits a deletion request, the collected data is anonymized so that all identifying information, such as names, addresses, and phone numbers, is removed.
As a general principle, we retain personal data only for as long as required by law or as necessary to fulfill the purposes of processing personal data.
Profiling
Information about previously purchased products or user behavior on the website/service may be used as a basis when offering additional services to the user or when targeting marketing.
Rights of the data subject
Right of access to personal data
The data subject has the right to receive confirmation as to whether personal data concerning them is being processed, and if so, the right to obtain a copy of their personal data.
Right to rectification of data
The data subject has the right to request that inaccurate or incorrect personal data concerning them be corrected.
The data subject also has the right to have incomplete personal data completed by providing the necessary additional information.
Right to erasure of data
The data subject has the right to request the deletion of personal data concerning them in the following cases:
The personal data is no longer needed for the purposes for which it was collected
The personal data has been processed unlawfully
Right to restriction of processing
The data subject has the right to restrict the processing of their personal data in the following cases:
The data subject contests the accuracy of their personal data
The processing is unlawful, and the data subject opposes the deletion of the personal data, and requests restriction of its use instead
The controller no longer needs the personal data for the original purposes of processing, but the data subject needs it for the establishment, exercise, or defence of legal claims.
Right to object
The data subject has the right, on grounds relating to their particular personal situation, to object at any time to the processing of personal data concerning them.
The controller may no longer process the personal data unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or if the processing is necessary for the establishment, exercise, or defence of legal claims.
Where personal data is processed for direct marketing purposes, the data subject has the right at any time to object to the processing of personal data concerning them for such marketing, including profiling related to such direct marketing.
Right not to be subject to automated decision-making
The data subject has the right not to be subject to a decision based solely on automated processing, such as profiling, which produces legal effects concerning them or similarly significantly affects them.
The above does not apply if the decision is necessary for entering into or performing a contract between the data subject and the controller, or if it is based on the data subject’s explicit consent.
Right to data portability
The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller.
Right to lodge a complaint with a supervisory authority
The national supervisory authority for personal data matters is the Data Protection Ombudsman operating in connection with the Ministry of Justice. The user of the service has the right to refer their matter to the supervisory authority if they consider that the processing of personal data concerning them violates applicable legislation.
Contact details
For all questions related to the processing of personal data and the exercise of your rights, the data subject should contact us by email at info@innolux.fi or by post at Innojok Oy / Sirrikuja 3L, 00940 Helsinki
Updated 12 May 2020
