Customer Registry

Register and privacy policy in accordance with the EU Data Protection Regulation (EU 2016/679) and the Personal Data Act (523/1999).

1. Controller

2. Person Responsible for the Register

Saku Pihlajaniemi (saku@receipthero.io)

3. Name of the Register

Register of users of the ReceiptHero online service.

4. Purpose of Processing Personal Data

The personal data stored in the register is used for the management and maintenance of the customer relationship and the provision of the service. ReceiptHero Oy processes all its data in accordance with the Personal Data Act.

The processing of personal data is mainly based on the explicit consent of the data subject. In certain cases (e.g. authentication and security measures), it is also based, where applicable, on the existence of a contractual relationship and/or the legitimate interest of the controller.

ReceiptHero Oy and its partners may send direct marketing by electronic means to the data subject on the basis of the data subject's explicit consent. The data subject may object to the use of his/her data for marketing purposes and market research by informing the controller.

When collecting and processing personal data, ReceiptHero Oy complies with the ReceiptHero Privacy Policy.

5. Data Content of the Register

The register may contain the following data:

• Basic information about the individual user: name, address, contact details
• Basic business user information: company name, business ID, contact person and contact details
• Billing and collection details
• Customer and contractual relationship data, date of opening and termination of the contract, service vendor data and data related to the implementation of communications
• User IDs and other authentication data
• Authorisation and prohibition information, such as direct marketing authorisations and prohibitions
• Interests and other information provided by the data subject
• Event and user analysis data
• For paid services and services requiring a high level of security, personal identification number for reliable identification

6. Regular Data Sources

The data stored in the register is mainly obtained from the data subject himself, either at the time of registration or later when using the ReceiptHero service. Occasionally, data is also obtained from the Population Information System of the VRK, the Postal Address Information System and other similar public and private registers.

7. Regular Disclosures and Transfers of Data Outside the EU or the European Economic Area

Data may be disclosed to ReceiptHero Oy's service providers and partners for the purpose of storing and maintaining data or performing services ordered by the data subject, as well as for direct marketing purposes, opinion polls, market research or similar surveys. Data on business users' purchases and any summaries thereof will also be disclosed to the traders at whose premises those business customers have carried out their transactions. Data may also be disclosed to public authorities in order to fulfil legal obligations or at the request of a public authority. As a rule, data are not disclosed or transferred outside the EU or EEA.

8. Principles of Register Protection

The register is mainly not stored in hard copy, but the data contained in the register is stored in an electronic database in the data centre of ReceiptHero Oy or its service providers. Access to the register is restricted so that it is only used by persons whose work requires access to the register. The register is protected in an appropriate, secure manner against unauthorised access by firewalls and other technical protection measures (e.g. username and password).

9. Rights of the Data Subject

ReceiptHero Oy guarantees data subjects all their rights under the law. These include in particular the right of access, the right of inspection, the right to have their data rectified and transferred, the right to be forgotten, and the right to object.

The right of data subjects to have their data erased is not without exception. ReceiptHero Oy may not delete data if the processing is necessary, for example, to comply with a legal obligation, to verify a contractual obligation, to provide information about potential security risks, or for other similar legitimate grounds. However, ReceiptHero Oy will not actively process personal data if the data subject so requests.

If the data subject wishes to exercise the rights under the law, he or she must contact ReceiptHero Oy either in writing or visit the controller's premises in Tampere in person. For contact details, see above, point 1 (Controller). The data subject acknowledges that if his/her personal data is deleted, this will limit the provision of services or may prevent the provision of services altogether.

10. Data Retention Period

Personal data will be erased after the data subject has been inactive in the register for 5 years without interruption.

ReceiptHero Oy monitors the use of the data at least once a year to determine the need for deletion. Where personal data needs to be retained to fulfil legal obligations (e.g. accounting obligations), the retention period is 10 years or such other period as may be expressly provided by law. Alternatively, instead of deletion, ReceiptHero Oy may anonymise the personal data.

11. Changes

ReceiptHero Oy will regularly review and evaluate the use of personal data as part of the development of its business and possible changes in legislation. ReceiptHero Oy reserves the right to update this Privacy Policy by providing prior notice in an appropriate manner.