DATA PROCESSING POLICY

*Data Processing Policy, according EU general data protection regulation (EU 2016/679)

1. Controller
POLAR SPRING OY
Kyynätjärventie 174
17150 URAJÄRVI
Business ID 1803614-0

2. Contact person in matters regarding the register
Minna Tarvainen / minna.tarvainen (at) polarspring.com

3. Name and description of the register
Customer register

4. Purpose for processing personal data and justification for processing personal data
The purpose for processing personal data is to offer Polar Spring Oy’s services to its customers. The personal data is processed within the limits of EU general data protection regulations and local legislation regarding Polar Spring Oy (including targeted service, communication, marketing, inquiry, statistic and other corresponding measures, and necessary verification and data security measures) and additionally managing possible legal obligations. Polar Spring Oy may additionally utilize the personal data for targeting sales and marketing efforts in an individual manner and other digital marketing. Processing the personal data is justified primarily based on the explicit consent of processing by the data subject. In other cases processing is justified as the data subject has voluntarily submitted the personal data to Polar Spring Oy in order to get access to the services of the website.

5. Content of the register
The register contains only personal data that the users of the service have entered themselves, or that have been created on the users’ request or consent. As a registered user to the service, the following personal data is commonly processed:
• Display name of the service
• E-mail address
• Full name
• Telephone number
• Address
The system adds user identity codes and information regarding the consent for processing given by the user. All processed personal data, the purposes of processing, storage location, storage duration, forwarding of data, access rights to the data and approvals for processing can be requested from Polar Spring Oy’s contact person identified above in section 2.

6. Regular data disclosure
Data may be disclosed to Polar Spring Oy’s service providers for storage, processing and maintenance of the personal data, for charging of fees, or delivering services ordered by the customers. Information can also be disclosed to authorities for fulfilling legal obligations or on authoritative request. Additionally, external technical experts under maintenance and non-disclosure agreement may get access to personal data in the service when improving or repairing the system. A copy of the service including its personal data may be created for development and maintenance purposes due to quality assurance reasons.

7. Transfer of personal data outside of EU or EEA
Personal data will not be transferred outside EU/EEA.

8. Principles of data security
Personal data is primarily not stored in paper format. Rather in digital format either on Polar Spring Oy’s own computers or on computers of Polar Spring Oy’s outsourced data processors. The register is processed confidentially. Access to the register is restricted to persons bound by non-disclosure agreement and who need to access the personal data due to and according to their duties as employees of Polar Spring Oy. The register is protected with appropriate IT security technology including firewalls and other technical and organizational protective measures. But it should be noted that no service in the internet is completely secure.

9. The rights of the data subject
Polar Spring Oy guarantees all given legal rights to the data subjects. Among these rights are especially the right to access, correct, transfer, and restrict processing of the personal data, and the right to be forgot. The right to get the personal data deleted is limited. Polar Spring Oy can refuse to delete the data, if processing of it is necessary for example for legal obligations, for contractual reasons, for possible communication of data security matters, or investigation of something related, or for other legally justifiable reasons. Polar Spring Oy will not actively process the personal data, if the data subject prohibits it. If the data subject wishes to use his/her legal rights, the data subject needs to confirm his/her identity and present the request in writing. The contact information can be found in sections 1. and 2. of this document. The data subject shall be aware that restriction of processing of his/her personal data may limit the services offered partly or completely.

10. Storage time of the personal data
Polar Spring Oy keeps the personal data of the data subjects for the duration of their customer relationship. The personal data of a service user will be deleted when the user has not logged onto the service for a continuous period of three years. In case the personal data is needed for fulfilling legal obligations (for ex. book keeping obligations) it is stored for 10 years, or the period set by law in that particular context. Polar Spring Oy may also anonymize the personal data instead of completely deleting it. This means that all references to the data subject will be deleted, but any user generated content or other non-identifiable data may be kept without time limitations.

11. Updates
Polar Spring Oy inspects and evaluates the use of its customers’ personal data regularly as a part of the company’s business development and possible changes in legislation. Polar Spring Oy has a unilateral right to update this data processing policy by informing of it in advance by appropriate means, or by informing of it when the user logs into the service. Polar Spring Oy may in this case request renewed acceptance of the terms of service.

12. Cookies
Polar Spring Oy’s web service uses cookies for anonymous tracking of its users in order to serve them better. A cookie is a little piece of data that the web browser saves on the device that you are using for web browsing. These cookies contain no personal information, merely an identifier allowing the service to find history data of your web browser in its own data storage. If you have chosen the option for your browser not to accept cookies, you will not benefit from the added service quality enabled by your known interaction history in the service. Also, clearing your browsing history will delete all cookies. More info about cookies can be found in http://www.allaboutcookies.org/.

13. Trackers
Polar Spring Oy’s web service uses web traffic trackers for counting the amount of users that visited its web site and similar statistics. These trackers are usually cookie based (more info in the Cookies section) and thereby do not contain any personal info. Polar Spring Oy wishes to make you aware of its use of trackers as many of the companies offering the tracking services are located outside of the EU, and complete descriptions of their functionalities are not available. Polar Spring Oy thereby uses the tracking services based on the documentation by the tracking companies stating that these function according to GDPR and other legislation regarding personal data.
Trackers utilized in Polar Spring Oy’s service:
• Google Analytics