Privacy policy / Business Centers

Cityvarasto Oyj's customer register

What personal data we collect, from which sources, and the grounds for collection

Cityvarasto Oyj collects customers' (data subjects') personal data for the management of the customer relationship, including for identifying the person, invoicing, communications and keeping in contact, and in addition for sales and marketing where the data subject has separately given consent to this. We also process data concerning users automatically.

The collection and storage of personal data is based on the customer relationship between Cityvarasto Oyj and the data subject. Cityvarasto Oyj collects and stores only the personal data necessary for managing the customer relationship. Cityvarasto Oyj keeps the personal data file up to date on the basis of notifications from data subjects.

The processing of personal data has been outsourced in the following respects:

• Outsourced telephone service

• Debt collection

• Access control for the premises

• Accounting

• Payment intermediary service

• Telephone subscriptions

We collect the following kinds of data about users from several different sources:

We collect data that the user provides, for example, when registering for our online service, contacting our customer service, taking part in a competition or survey in our online services, subscribing to a newsletter, or when the user places an order in our online shop.

Such data includes:

• Company name / name(s) of the contact person(s) (to identify the person)

• Home/billing address (for invoicing)

• For online shop rentals, payment card details remain in the register of Svea Payments Oy (for example, for recurring charges)

• Business ID and possibly personal identity code (to identify the person). The personal identity code is collected and stored in accordance with Section 29 of the Data Protection Act.

• Email address (for invoicing and communications)

• Phone number(s) (for keeping in contact)

• Bank account number (for refunding the rental deposit and for e-invoicing)

• General information about the customer and the conversations and emails exchanged with them (only information necessary for managing the customer relationship is recorded)

Marketing information questions:

• How did you find us?

• The reason for needing space

• Why did you choose the service?

• The reason for termination

• How satisfied were you with our services?

• Would you be willing to recommend us?

• Permissions, consents and objections (including those relating to third-party services).

Cityvarasto Oyj also records video camera footage in common areas (outdoor areas, lobbies, entrances, etc.) so that customers' property is protected as well as possible and safety in the premises is maintained. The purpose of camera surveillance is to prevent crime and to investigate any crimes that may have already occurred. The recordings are kept in locked premises accessible only to Cityvarasto Oyj's staff.

Calls made to customer service may be recorded, and other email, text or chat messages may be stored. The recordings are used to develop customer service operations, train customer service staff, and manage the controller's customer relationships concerning the service in question.

We automatically collect data about the use of our online services (Google Analytics, Hotjar), including data on the use of the online services and on the technical characteristics of devices. Such data includes:

• IP address (and country of location)

• Actions and their timestamps

• Information on the device used, the type of operating system and software versions

• Browser type and language settings

• The site that directed the user to the online services and the site the user moves to from the online service, the server and the domain

We continuously develop our online service and, in connection with it, use analytics tools and measurement systems provided by third parties in order to collect and make use of non-personal data as well. These include, for example, Google Analytics, Google AdWords and Hotjar.

Where necessary, we may also collect and/or update data concerning the user from sources provided by third parties, such as data from public authority registers or private register services.

Disclosure of data to third parties

Personal data may be disclosed to a third party for justified purposes in accordance with data protection legislation. Data may be disclosed for updating data or for other similar purposes to our partners, for marketing purposes, and to parties involved in delivering the online service, such as email service providers, credit card companies, and data analytics and company information service providers. Collected data may also be disclosed to parties involved in data analysis and online advertising.

We may also disclose the user's data as required by requests from competent authorities or other parties, in a manner based on the legislation in force at the time, or in order to monitor and ensure compliance with the rental agreement terms and to guarantee the security of the premises services.

Data may be disclosed to the parties involved in connection with a possible company acquisition, merger, outsourcing or business transaction, and in connection with a group relationship or other economic association. We may also disclose the data subject's data to other third parties where the user has given consent to this, for example by connecting the website to third-party services such as social media services, or otherwise.

If personal data is transferred outside the European Union or the European Economic Area, Cityvarasto Oyj implements appropriate safeguards on the customer's behalf to ensure and secure the rights and freedoms of data subjects in accordance with the requirements of the applicable data protection legislation.

Our online services may also contain what are known as social plugins, such as the Like and/or Share button of Facebook, Twitter or Instagram.

Protection of personal data

We protect our personal data file appropriately. The register is maintained on appropriately secured servers. These protections include, among other things, password protection that allows access to the stored data only to employees of the group's parent company, Cityvarasto Oyj, and to service providers in a contractual relationship with Cityvarasto Oyj. Video recordings are kept in locked premises accessible only to Cityvarasto's staff. Manual material (rental agreements) is kept in locked premises. With regard to external service providers, we ensure through contractual arrangements that personal data is processed in accordance with data protection legislation and otherwise appropriately.

The data subject's rights

Right to be informed

Everyone has the right to know what data has been stored about them in Cityvarasto Oyj's personal data file. If the data subject requests that some matter relating to their own personal data be investigated, Cityvarasto Oyj must, within one month at the latest, provide information on the measures taken as a result of the request. If the request is refused, the same one-month time limit applies. In that case, the data subject is informed of the available legal remedies, such as the right to lodge a complaint with the supervisory authority.

Right of access to data

The right to receive a copy of the data free of charge. If the request is submitted electronically, Cityvarasto Oyj provides the data in a commonly used electronic format.

Right to rectification

The data subject has the right to request the correction of their personal data where data is inaccurate. A response to the request is given within one month of the request being submitted.

Right to be forgotten

The data subject has the right to "be forgotten", meaning their personal data can be erased if the data is no longer needed for the purpose of processing, the data subject withdraws their consent to processing, or objects to the processing of personal data and there is no lawful basis for the processing.

Right to restrict processing

The data subject has the right to prohibit, for example, direct marketing, even if they have previously given consent to it. If the user decides not to receive direct marketing messages, we may still send the user customer communications, such as emails concerning their user account, the provision of premises services or the group's business.

Right to data portability

The data subject has the right to request the transfer of their data to another register.

Right to object to processing

The data subject has the right to prohibit direct marketing.

Rights relating to automated decision-making and profiling

The data subject has the right to prohibit profiling. Profiling is used in marketing and an individual's data is stored anonymously.

Right to lodge a complaint with the Data Protection Ombudsman

The data subject has the right to lodge a complaint with the Data Protection Ombudsman if they feel that their personal data has been processed contrary to the data protection regulation. Instructions for getting in touch can be found on the website of the Office of the Data Protection Ombudsman at www.tietosuoja.fi.

Data retention

Customers' personal data is retained for at least six years after the end of the customer relationship or the completion of an individual transaction. Data is retained in accordance with accounting, communications or other mandatory legislation as required by the relevant law.

Changes to this privacy policy

Cityvarasto Oyj may amend this privacy policy from time to time. We therefore encourage you to review the privacy policy regularly in order to notice any changes.

Controller

The controller is Cityvarasto Oyj (Business ID: 1561027-4), and the user may get in touch at any time using the following contact details:

Cityvarasto Oyj, Vetokuja 4, 01610 Vantaa, tel. 029 1234 700, info@cityvarasto.fi, www.cityvarasto.fi

Person handling register matters / contact person

Ville Stenroos
Enquiries: ville.stenroos@cityvarasto.fi

Requests to check register data can be sent to:

Cityvarasto Oyj,Vetokuja 4, 01610 Vantaa.