Privacy Policy – Privacy Policy
This is the privacy policy of CF Events Oy in accordance with the Data Protection Act and the EU General Data Protection Regulation (GDPR). This document was prepared on 9 July 2019.
1. Controller
CF Events Oy
1502158-4
Hämeentie 157, 5th floor
00560 Helsinki
contactforum@cfevents.fi
www.contactforum.fi
2. Contact person responsible for the register
Christoffer Högström
+358 45 635 3562
christoffer.hogstrom@cfevents.fi
3. Name of the register
The company's customer and marketing register.
4. Legal basis and purpose of processing personal data
According to the EU General Data Protection Regulation, the legal grounds for processing personal data are the person’s consent (documented, voluntary, specific, informed and unambiguous), the contract in which the data subject is a party, and the legitimate interest of the controller (customer relationship).
The purpose of the processing of personal data is to contact customers and maintain customer relationships, as well as to market services and events.
5. Data content of the register
The data to be stored in the register include: the person's name, position, company/organization, contact information (phone number, email address, address), URLs of websites, IP address of the online connection, credentials/profiles in social media services, information about ordered services and their changes, billing information, and other information related to the customer relationship and the services ordered. The data will be stored for five (5) years.
6. Regular data sources
The data to be recorded in the register is obtained from the customer, for example, through messages sent via www forms, emails, telephone calls, social media services, contracts, customer meetings, and other situations where the customer provides their data.
7. Use of cookies
We use cookies on our website that allow the administrator to identify visitors who often visit the site and to compile aggregated information about visitors.
If a user visiting our website does not want us to obtain the aforementioned information through cookies, browser programs enable the deactivation of the function.
8. Regular disclosure of data and transfer of data outside the EU or the EEA
Information is not routinely disclosed to other parties. Information may be published to the extent agreed upon with the customer.
9. Principles of record protection
When processing the register, due diligence is applied and the data handled through the information systems is properly protected. When the register data is stored on Internet servers, the physical and digital data security of the hardware is adequately ensured. The controller ensures that the stored data, as well as the access rights to the servers and other data critical to the security of personal data, are handled confidentially and only by employees whose job description requires it.
10. Right of inspection and right to demand rectification of information
Every person registered in the register has the right to check the information stored in the register and request the correction of any incorrect information or the completion of any incomplete information. If a person wishes to check the information stored about them or request an amendment, the request must be sent in writing to the registrar. The registrar may, if necessary, request that the applicant provide proof of identity. The registrar will respond to the customer within the timeframe set by the EU Data Protection Regulation (usually within one month).
11. Other rights related to the processing of personal data
The person registered in the register has the right to request the deletion of personal data concerning them from the register (”the right to be forgotten”). Likewise, registered persons have other rights. Rights under the EU General Data Protection Regulation such as limiting the processing of personal data in certain situations. Requests must be sent in writing to the controller. The controller may, if necessary, require the applicant to provide proof of identity. The controller will respond to the customer within the timeframe set by the EU Data Protection Regulation (usually within one month).