Privacy policy – storage units

Cityvarasto Oyj:n asiakasrekisteri

Cityvarasto Plc collects personal data from customers (data subjects) for the purposes of managing the customer relationship, including identification, invoicing, communications and contact, as well as for sales and marketing purposes where the data subject has separately given their consent. We also process data about users automatically.

The collection and storage of personal data is based on the customer relationship between Cityvarasto Plc and the data subject. We only collect and store personal data that is necessary for managing the customer relationship, and keep the register up to date based on notifications from data subjects.

The processing of personal data has been outsourced in the following areas:

• Outsourced telephone answering service

• Debt collection

• Access control for storage units

• Accounting

• Payment processing service

• Telephone subscriptions

We collect the following types of data from users from a variety of sources:

We collect data that you provide when, for example, registering for our web service, contacting our customer service, taking part in a competition or survey on our web service, subscribing to our newsletter, or placing an order in our online store.

This data includes:

• First and last name / company name (for identification purposes)

• Home / billing address (for invoicing purposes)

• For online store rentals, payment card details are stored in the Svea Payments Oy register (e.g. for recurring charges)

• Personal identity code / business ID (for identification purposes) – collected and stored in accordance with Section 13 of the Personal Data Act

• Email address (for invoicing and communications)

• Phone number(s) (for contact purposes)

• Bank account number (for security deposit refunds and e-invoicing)

• Possible guardian (for contact, invoicing and communications purposes)

• Social services contact (for invoicing purposes)

• Estimated value of goods stored in the unit (for insurance purposes)

• General information about the customer and communications with them (only information necessary for managing the customer relationship is recorded)

• Marketing survey questions: How did you find us? Reason for needing storage space. Why did you choose Cityvarasto?

• Reason for termination

• How satisfied were you with our services?

• Would you recommend us?

• Permissions, consents and prohibitions (including those relating to third-party services)

We also operate video surveillance cameras at our storage locations to protect our customers' property and maintain security. The purpose of the surveillance is to prevent crime and assist in the investigation of any incidents that may occur. Recordings are stored in locked facilities accessible only to Cityvarasto staff.

Calls to our customer service may be recorded, and other email, text or chat messages may be stored. Recordings are used to develop our customer service, train staff and manage customer relationships relating to the service.

We automatically collect data about the use of our web services (Google Analytics, Hotjar) and the technical characteristics of devices. This data includes:

• IP address (and country of location)

• Actions taken and their timestamps

• Device information, operating system type and software versions

• Browser type and language settings

• Website that referred you to our service and the website you navigate to afterwards, server and domain name

We continuously develop our web service and use third-party analytics tools and measurement systems in connection with our web service to collect and make use of non-personal data. These include Google Analytics, Google Ads and Hotjar.

Where necessary, we may also collect and/or update data about you from third-party sources, such as public registers maintained by authorities or private register services.

Personal data may be shared with third parties for justified purposes in accordance with personal data legislation. Data may be shared with our partners for data updates or similar purposes, for marketing purposes, and with parties involved in the delivery of our web service, such as email service providers, credit card companies, data analysis services and company information providers. Collected data may also be shared with parties involved in data analysis and online advertising.

We may also share your data where required by competent authorities or other parties under applicable legislation, or for the purposes of monitoring and ensuring compliance with rental agreement terms and maintaining the security of our storage services.

Data may be shared in connection with a potential business acquisition, merger, outsourcing or business transfer, as well as with parties involved in a group relationship or other financial association. We may also share your data with other third parties where you have given your consent, for example by linking our website to third-party services such as social media platforms.

If personal data is transferred outside the European Union or the European Economic Area, Cityvarasto will implement appropriate safeguards on your behalf to ensure and protect the rights and freedoms of data subjects in accordance with applicable data protection legislation.

Our web services may also contain social media plugins, such as Facebook, Twitter or Instagram Like and/or Share buttons.

We protect our personal data register appropriately. The register is maintained on a properly secured server. Security measures include password protection, which limits access to stored data to Cityvarasto Plc employees and service providers in a contractual relationship with Cityvarasto Plc. Video recordings are stored in locked facilities accessible only to Cityvarasto staff. Manual materials (rental agreements) are stored in locked facilities. For third-party service providers, we ensure through contractual arrangements that personal data is processed in accordance with the Personal Data Act and otherwise appropriately.

The site is protected by Google reCAPTCHA, and Google's privacy policy and terms of service apply.

Right to information

Everyone has the right to know what data has been stored about them in the Cityvarasto Plc personal data register. If you request information relating to your personal data, we will respond within one month with details of the steps taken in response to your request. If the request is declined, the same one-month deadline applies. In that case, you will be informed of the remedies available to you, including the right to lodge a complaint with the supervisory authority.

Right of access

You have the right to receive a free copy of your data. If the request is made electronically, we will provide the information in a commonly used electronic format.

Right to rectification

You have the right to request the correction of any inaccurate personal data. We will respond to your request within one month.

Right to erasure

You have the right to be forgotten – that is, to have your personal data deleted if it is no longer needed for the purpose for which it was collected, you withdraw your consent to processing, you object to the processing of your personal data and there is no lawful basis for processing.

Right to restriction of processing

You have the right to withdraw consent to direct marketing even if you have previously given it. If you choose not to receive direct marketing messages, we may still send you service communications, such as emails relating to your account, the provision of storage services or Cityvarasto Plc's business.

Right to data portability

You have the right to request that your data be transferred to another register.

Right to object

You have the right to object to direct marketing.

Rights relating to automated decision-making and profiling

You have the right to object to profiling. Profiling is used for marketing purposes and individual data is kept anonymous.

Right to lodge a complaint with the Data Protection Ombudsman

You have the right to lodge a complaint with the Data Protection Ombudsman if you believe that your personal data has been processed in violation of the GDPR. Contact details can be found at the Office of the Data Protection Ombudsman at www.tietosuoja.fi.

Customer personal data is retained for at least six years after the end of the customer relationship or the completion of an individual transaction. Data is retained in accordance with applicable accounting, communications or other mandatory legislation.

Cityvarasto Plc may update this privacy policy from time to time. We encourage you to check back regularly to stay informed of any changes.

The data controller is Cityvarasto Plc (Business ID: 1561027-4). You can contact us at any time using the following details:

Cityvarasto Plc Vetokuja 4, 01610 Vantaa Tel. +358 29 1234 700 info@cityvarasto.fi www.cityvarasto.fi

Ville Stenroos Enquiries: ville.stenroos@cityvarasto.fi

Cityvarasto Plc Vetokuja 4, 01610 Vantaa