This privacy statement describes how Kvarn Capital Oy (”Kvarn”, ”we” or the ”controller”) processes personal data. This privacy statement applies to the processing of personal data related to the products and services Kvarn provides through its digital customer portal, as well as Kvarn’s risk management, customer relationship management, communications and contact with its customers and potential customers, registration for events, website and marketing, including electronic direct marketing, as well as personal data processed in recruitment. Where applicable, this privacy statement applies to the processing of personal data with companies belonging to the same group as Kvarn Capital Oy.
The companies belonging to the same group as Kvarn Capital Oy may act as joint controllers referred to in the data protection legislation when processing personal data for common purposes. As joint controllers, they together decide how and for what purposes personal data are processed. The group companies have agreed that Kvarn Capital Oy is responsible for carrying out all the duties of a joint controller imposed by the data protection legislation, and the data subjects may contact Kvarn Capital Oy in questions related to joint controllership.
We adhere to applicable data protection legislation in all processing of personal data. Data protection legislation refers to valid data protection legislation such as the EU General Data Protection Regulation (2016/679) and the Data Protection Act of Finland (1050/2018). Any data protection concepts that are not defined in this privacy statement are interpreted according to the data protection legislation.
“Personal data” refers to information concerning any natural persons (“data subjects”) that directly or indirectly enables a person to be identified as defined in more detail by the GDPR.
Our customer portal and web pages may also contain links to external websites and services operated by other organisations and not managed by us. This privacy statement does not apply to their use and we therefore recommend that you read their own privacy statements separately. We are not responsible for the data protection practices of other websites or external services.
Controller: Kvarn Capital Oy
Business ID: 3288803-2
Address: Eteläesplanadi 24, FI-00130 Helsinki, Finland
Email: support@kvarncapital.com
We only process personal data necessary for each of our specific purposes. The purposes and legal bases for processing personal data are:
When we process personal data based on a legitimate interest, we have evaluated the benefits and possible disadvantages of the processing for the data subject and estimated that the rights and benefits of the data subjects do not override our legitimate interest. On request, we can provide more information about the processing of personal data based on a legitimate interest.
In accordance with the legal requirements, the processing of personal data required for sending newsletters and other electronic direct marketing is based on the data subject’s consent.
Data groups and Examples of data content
We collect personal data directly from the data subject – for example, when the data subject interacts with us or purchases our products or services themselves or on behalf of their organisation, registers in the customer portal, visits our website or other electronic services, subscribes to our newsletter, submits us a contact request, orders or downloads material they have requested, registers for an event or otherwise contacts us. In recruitment, we mainly receive personal data from the applicant themselves.
We also receive personal data from other external sources such as private register services, public registers maintained by the authorities and credit registers.
We may also receive personal data from other companies belonging to the same group.
We retain the personal data as long as is necessary for the purposes defined in the privacy statement and always as long as required by law (e.g. responsibilities and obligations related to accounting and reporting), or if it is necessary for legal proceedings or settling a dispute. When the purpose has expired, the personal data are deleted or anonymised within a reasonable period.
As a rule, we retain the data for the period necessary for providing the agreed service or product. We retain the personal data for the duration of the customer relationship, and when this relationship has ended, we will delete the unnecessary data. However, we may retain some of the personal data for a longer period if this is necessary for us to pursue our legitimate interest related to managing or defending legal claims or to fulfil our statutory obligations.
As a rule, we retain the personal data of potential customers for two years from obtaining the data or from the previous contact. If the potential customer has given their consent to the processing of personal data, we will retain the data for five years from the previous contact unless the potential customer has withdrawn their consent.
In recruitment, we retain the personal data for at most two years from making the recruitment decision. When this time has elapsed, we will delete the data from our information systems.
We retain the personal data related to newsletter subscriptions until the individual cancels their subscription. The individual with the newsletter subscription has the opportunity to cancel their subscription in connection with each received newsletter.
In the case of statutory obligations, we retain the personal data as long as is necessary to fulfil the statutory obligation in question. For example, the Accounting Act obliges us to retain the data related to the accompanying files of accounting records for six years after the end of the financial year. According to the Law on the Prevention and Fight against Money Laundering and Terrorist Financing, we must retain each customer’s identifying information for five years from the end of the transaction in the case of both regular and casual customers.
Statistics that do not contain information that could be associated with a natural person are retained indefinitely.
On request, we can provide additional information about the retention practices for personal data.
Personal data may be disclosed or otherwise processed with companies belonging to the same group as the controller as required by the data protection legislation for the purposes described in this privacy statement.
We may also use various service providers and other third parties to process personal data, such as providers of technical or server hosting solutions or accounting and financial administration services. Group companies may also process personal data on behalf of another group company.
When processing personal data with other parties, we use contracts required by the data protection legislation.
Personal data may be disclosed to third parties in situations required by law or the authorities or to address misuse and ensure security. In addition, we may have to disclose personal data in connection with legal proceedings.
If the controller or a company belonging to the same group is a party to a merger, asset deal or another M&A transaction, personal data may be disclosed to the parties of the transaction or parties assisting in it.
On request, we can provide additional information about the parties that process and receive personal data.
When transferring personal data outside the European Union or the European Economic Area, we ensure a sufficient level of security for the personal data by, for example, agreeing on any matters related to processing the personal data as required by the data protection legislation, such as by using the standard contractual clauses adopted by the European Commission, including any relevant additional protective measures if they are deemed necessary.
On request, we can provide additional information about the transfers of personal data and the protective measures applied.
Information security and the protection of personal data are a key priority for us. We use appropriate technical and organisational protective measures to safeguard personal data. Access to personal data is restricted to authorised parties. Parties processing personal data have an obligation of confidentiality concerning matters related to the processing of personal data.
We collect, process and analyse data about the use of our web pages. We use cookies to provide our customers with services and products, offer them a secure web environment, prevent misuse, conduct marketing measures, enable a better customer experience, follow website analytics and offer the most useful content possible. Our visitor can use the settings in our website’s cookie banner to select whether they accept the use of cookies. If the visitor does not allow the use of cookies, some features of the website and services may be unavailable.
The processing of personal data may contain automated decision making. Decision making is automated when a decision is made solely automatically without any individuals engaging in it, and when this decision has legal effect or significantly affects the data subject in a similar manner.
If the product or service purchased by the data subject contains such decision making, it is explained in connection with the purchase. If the decision-making process is completely automated, the controller ensures that the data subject may submit the matter for manual review and decision making.
The processing of personal data may also contain profiling. Profiling refers to automated processing of personal data in which the data are used to predict certain personal characteristics. For example, we conduct profiling when we calculate necessary customer and risk classifications or need it for sales, marketing or communications.
In certain situations, the data subject has the right to object to using their personal data for automated decision making and profiling based on a specific personal situation at any time.
Data subjects have certain rights to their own personal data, which are defined by the data protection legislation. The application of these rights in each situation depends on the purpose and situation of using the personal data.
Please contact us if you have any questions about the processing of your personal data.
You may send us a request concerning the rights of the data subject by letter or email using the contact details provided in this privacy statement.
We may confirm the identity of the party making the request before processing it. We will reply to your request within a reasonable period, usually within a month of receiving the request and confirming the identity. If we must refuse the request, we will notify you of this separately.
The data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that their personal data have been processed in violation of the data protection legislation.
The contact details of the Finnish Data Protection Ombudsman are available here.
We may have to change this privacy statement from time to time. The changes may also be due to amendments to the data protection legislation. We therefore recommend that the privacy statement be reviewed regularly to be aware of any changes. The most recent version is available on our website.
This privacy statement was updated on 14.10.2024.
