Cityvarasto PLC’s aim is to offer its customers the best small storage service. It is of utmost importance to Cityvarasto PLC to gain the trust of customers and protect data. This privacy policy helps understand, what personal data and other information we collect, and how we process such data.

Cityvarasto PLC is committed to observe the Finnish Data Protection Act (5.12.2018/1050) and the EU’s General Data Protection Regulation (GDPR) and other applicable legislation, which is related to the users’ privacy, as well as to process personal data in accordance with good data management and data processing practices. The user must read this privacy policy prior to using Cityvarasto PLC's small storage services, and by using Cityvarasto PLC's small storage services, the user agrees to the use of his/her personal data and cookies in accordance with this privacy policy. If the user does not agree to this privacy policy or the user terms concerning Cityvarasto PLC’s valid contractual terms, the user shall not have the right to use Cityvarasto PLC's small storage services.

“Personal data” refers to information, which allows an individual person to be identified. In addition to personal data, we also collect non-personal data, which refers to data concerning the use of Cityvarasto PLC’s website and which cannot be used to identify an individual person. 

This privacy policy tells users:

• What are the grounds for collecting and processing personal data?
• What information do we collect about the users of our small storage services
• How do we use the information we collect
• What rights does the user in regard to the data we collect

Name of person register

Cityvarasto PLC's customer register

What personal data do we collect and from which sources and what are the grounds for collection

Cityvarasto PLC collects customers’ (data subject) personal data for customer relationship management, e.g. for person identification, invoicing, information and communications, as well as for sales and marketing, if the data subject has provided separate authorisation for this. We also process information concerning users on an automated basis.

The collection and storage of personal data is based on the customer relationship between Cityvarasto PLC and the data subject. Cityvarasto only collects and stores personal data that is relevant for the management of customer relationships. Cityvarasto shall keep the person register up to date on the basis of data subjects’ notices.

The processing of personal data has been outsourced for the following parts:

1. Invoices’ payment collection
2. Warehouses’ access control
3. Accounting
4. Payment transaction service
5. Phone operator services

We collect information, such as the following, from several sources:

We collect information, which the user provides e.g. in connection with registering to our online service, contacting our customer service, participating in a competition or survey in our online services, subscribing to our newsletter, or when a user completes an order in our online store.

Such information includes:

• First and last name / Company’s name (for the individualisation of a person)
• Home / billing address (for billing)
• Payment details for online shop rentals shall remain in Svea Payments Oy register(for example, for repeated charges)
• Social security number/business ID (for person identification)Social security numbers are collected in accordance with Section 13 of the Finnish Data Protection Act.
• Email address (for billing, for information purposes)
• Phone number(s) (for communications)
• Account number (for the refund of deposits, for e-billing)
• Possible guardian of interests (for communications, billing, information)
• Contact to social office (for billing)
• Estimate of items’ value to be stored in the warehouse (for insurance purposes)
• General information about the customer and discussions, emails with him/her (only information relevant to customer relationship management shall be recorded)
• Marketing questions * How did you find us? * Reason for needing storage space * Why did you choose Cityvarasto?
• Reason for contract termination
• How satisfied were you with our services?
• Would you be prepared to recommend us?
• Authorisations, consents and refusals (incl. third-party services).

Cityvarasto PLC also has video surveillance in place at the warehouses, to ensure that the customers’ property would be as well-protected as possible and to ensure safety at the warehouses. The purpose of video surveillance is to prevent crime and solve any crimes that may take place. Recordings are stored in locked facilities, which are only accessible to Cityvarasto's staff.

Calls to customer service can be recorded and e-mail, text or chat messages can be saved. The recordings are used to develop customer service activities, train customer service personnel and manage the registrar's customer relations concerning the service in question.

We automatically collect information on the use of online services (Google, Hotjar), on the use of online services and the technical specifications of devices. Such information includes:

• IP address (and country)
• operations and their durations
• details of used device, operating system type and software versions 
• browser type and language settings
• website that directed to online services, and the website to be directed to from the online services, server and domain 

We continuously develop our online service and we use third-party analysis tools and measuring systems in connection with our online service, in order to collect and utilise non-personal data. These include, for example, Google Analytics, Google Adwords and Hotjar.

If necessary, we can collect and/or update data concerning users from third-party sources, such as information that originates from authorities’ public registers or private register services.

Data disclosure to third parties

Personal data can be disclosed to third parties for justified uses in accordance with the provisions set out in the Personal Data Act. Data can be disclosed for the purpose of updating and for other similar reports for our partners, for marketing purposes and to parties participating in the implementation of the online service, such as to email service providers, credit institutions, data analysis and company data provider services. Collected data can also be disclosed to parties participating in the analysis of data and online marketing.

We can also use user data as required by competent authorities and other parties, in accordance with currently valid legislation, or in order to manage and ensure compliance with the Rental Agreement’s terms, as well as to ensure the safety of self storage services.

In connection with a possible business acquisition, fusion, outsourcing or business sales, as well as in regard to a Group relation or other financial association, the data can be disclosed to these parties. We may also disclose the data subject’s data to other third parties, if the user has provided consent, for example, by linking our website to third-party services, such as social media services and otherwise.

If personal data is transferred outside the European Union or outside the European Economic Area, Cityvarasto shall carry out the relevant security measures on behalf of the customer to ensure and safeguard the rights and freedoms of the data subjects in accordance with the applicable requirements of the Data Protection Act.

Our online services may also include so-called community add-ons, such as a Facebook, Twitter or Instagram Like and/or Share button.

Protection of personal data

We protect our personal data register appropriately. The register is maintained on a server that is appropriately secured. These protection features include password protection, which only enables access to saved data by Cityvarasto PLC’s employees and service providers who are in a contractual relationship with Cityvarasto PLC.Video recordings are stored in locked facilities, which are only accessible to Cityvarasto's staff. Manual material (rental agreements) are stored in locked facilities. In regard to external service providers, we ensure agreement arrangements in such a way that personal data is processed in accordance with the Data Protection Act or otherwise appropriately.

Rights of the data subject

Right to obtain data
Everyone has the right to know what data about him/her has been stored in Cityvarasto PLC’s personal data register. If a data subject requests for clarification about his/her personal data, Cityvarasto shall, within 1 month, provide information about the procedures that have been taken as a result of the request. The same duration of one month shall apply, if the request is declined. In this case, the data subject is provided information about the valid legal protection methods, such as the right to lodge a complaint to supervisory authorities.

Right to access data
Right to a free copy of information. If the request is presented in electronic format, Cityvarasto PLC shall provide the data in a generally used electronic format.

Right to rectify information
The data subject has the right to request for his/her personal data to be rectified in case of any incorrect information. A response to the request shall be provided within one month from presenting the request.

Right to be forgotten
The data subject has the right “to be forgotten”, i.e. his/her personal data can be destroyed, if the data is no longer needed for the processing purposes, the data subject withdraws his/her consent to processing, objects the processing of personal data or there are no legal grounds for processing.

Right to limit processing
The data subject has the right to refuse, for example, direct marketing even if he/she has previously consented to it.If a user decides to not receive direct marketing messages, we can continue to send the user customer communications, such as emails concerning the user account, small storage service offerings or Cityvarasto PLC’s business operations.

Right to transfer information
The data subject has the right to request for his/her data to be transferred to another register.

Right to refuse processing
The data subject has the right to refuse direct marketing 

Rights concerning automated decision-making and profiling
The data subject has the right to refuse profiling. Profiling is used in marketing, and the data of individuals remains anonymous

Right to lodge a complaint with a data protection supervisor
The data subject has the right to lodge a complaint with a data protection supervisor, if he/she considers that his/her personal data has been processed in violation of the Data Protection Act. Contact instructions can be found at the data protection supervisor’s office atwww.tietosuoja.fi

Data retention

Customers’ personal data shall be retained for at least six years following the end of a customer relationship or an individual business transaction.Data shall be retained for the purpose of accounting, communications and other compelling legislation in accordance with the relevant legislation.

Changes to the privacy policy

Cityvarasto PLC may occasionally make changes to this privacy policy. We encourage you to regularly review the privacy policy in order to recognise any changes.

Data controller

The data controller is Cityvarasto PLC (Business ID: 1561027-4) and the user can contact the data controller at any time with the following contact details:

Cityvarasto Oyj Läkkisepänkuja 7, 00620 Helsinki puh. 029 1234 700
info@cityvarasto.fi www.cityvarasto.fi

Person handling register-related issues or contact person

Ville Stenroos Tiedustelut: ville.stenroos@cityvarasto.fi

A request to review registry data can be sent to the following address:

Cityvarasto Oyj Läkkisepänkuja 7, 00620 Helsinki