Privacy notice for consumer customers

In this privacy notice, we describe how Oddlygood Global Oy (hereinafter ”OGG” or ”we”) processes consumer customers’ personal data in our online services, for purposes concerning direct marketing and consumer surveys, for organization of events and campaigns, in our customer service (including the processing of feedback and complaints), and in other customer interfaces. We may update this privacy notice from time to time, when legislation changes, for example.

1. Data controller

Oddlygood Global Oy (Business ID: 0112421-6)
Meijeritie 6
FI-00370 Helsinki

2. Contact information

If you wish to exercise your rights under this privacy notice or if you have questions about the processing of your personal data, please contact us 1) by email at privacy.office@valio.fi, 2) by calling +358 10 381 2185, or 3) by sending mail to Oddlygood Global Oy, Meijeritie 6, FI-00370 Helsinki.

3. For what purposes and on what basis do we process your personal data?

We process consumers’ personal data for the following purposes:

Purpose	Processing activities	Personal data processed
Marketing of Oddlygood’s products and services	Sending newsletters and other marketing materials, targeting marketing activities	First name and last name, email address, phone number, home address Information about the newsletter the customer has subscribed to or other material and whether they have declined or allowed the sending of direct marketing communications; Data obtained through cookies

Legal basis: Legitimate interest, consent (electronic direct marketing)

Retention period: We will store the personal data processed for marketing purposes until the customer withdraws the marketing consent or subscription. If the consumer prohibits the processing of their personal data for direct marketing purposes, we will store the information about the objection to direct marketing messages. Regarding retention periods for cookies, please see Cookie notice.

Do we use automated decision-making (incl. profiling)? No

The recipients of the data: Personal data is received by subcontractors commissioned by us (such as marketing agencies), who carry out above mentioned processing activities under our instructions and on our behalf. You can request up to date information from the contact person set forth in section 2. Regarding cookies, please see Cookie notice.

Transfers of personal data to third countries and its basis: Data is transferred, see section 5.

Purpose	Processing activities	Personal data processed
To organize events and campaigns and to process the feedback relating to these, also publishing name of the winner	Sending campaign and event invitations, collecting attendance information, organizing and storing, for the purposes of organizing the campaign (such as selecting a winner and publishing the name of the winner)	First name and last name, email address, phone number, home address For events, campaigns and studies: dietary requirements and any food allergies; photograph, video or audio recording of you; and any other information you provide in connection with an event, campaign or survey; Data obtained through cookies

Legal basis: Legitimate interest, contractual necessity, consent (electronic direct marketing of events and campaigns)

Source of data: We collect personal data directly from the customer by telephone, letter, email, electronic feedback form or personally on site. We also collect personal data from the customer when they use our online services, including through cookie technologies. With regard to events and campaigns, we can also collect the customer’s personal data from a person close to the customer or another person who signs them up for the event or campaign.

Retention period: Until the end of the campaign, or until the consent is withdrawn. The retention period of cookies can be found in the Cookie notice

Do we use automated decision making (incl. profiling)? No

The recipients of the data: Personal data is received by subcontractors commissioned by us (such as marketing agencies), who carry out above mentioned processing activities under our instructions and on our behalf, you can request up to date information from the contact person set forth in section 2. Regarding cookies, see Cookie notice

Transfers of personal data to third countries and its basis: Data is transferred, see section 5.

Purpose	Processing activities	Personal data processed
Conducting marketing or other surveys, to understand our customers better	Utilizing information for contacting individuals, organizing surveys and survey situations, collection and analyzing of answers, analyzing background information, compilation of information	First and last name, e-mail address, phone number, home address For events, campaigns and surveys: your diet and possible food allergies; photo, a video or voice record of you; other personal information that you submit for an event, campaign or survey

Legal basis: Consent, Legitimate interest

Source of data: We collect personal data directly from the customer by telephone, letter, email, electronic feedback form or personally on site. We also collect personal data from the customer when they use our online services, including through cookie technologies. In regard to surveys you attend, we collect your personal information from our subcontractors that process the data for consumer and other surveys.

Retention period: If a customer has registered for an event or a campaign organized by us, we process their personal information for the duration of the event or campaign, after which we will delete the personal data no later than six (6) months from the end of the event or campaign. If a customer has registered for a consumer survey organized by us, we process their personal information for the duration of the survey and for one (1) year after the survey, after which we will delete the personal data.

Do we use automated decision making (incl. profiling)? No

The recipients of the data: Personal data is processed (e.g., collected, analyzed and stored) by subcontractors commissioned by us who carry out marketing and other surveys on our behalf and under our instructions. You may request up-to-date information from the contact person set forth in section 2. Regarding cookies, please see Cookie notice

Transfers of personal data to third countries and its basis: Data is transferred, see section 5.

Purpose	Processing activities	Personal data processed
Processing feedback	Processing and responding to feedback concerning our products and services, paying possible compensations and resolving disputes.	First and last name, e-mail address, phone number, home address Any free-form customer feedback you send, such as a complaint or product enquiry, a recording of a communication and any other information you provide recorded in the customer feedback system; In the event of a complaint, we may also process your bank details and your medical information (e.g. a medical certificate).

Legal basis: Legitimate interest, Consent (Bank details and medical information)

Source of data: We collect personal data directly from the customer by telephone, letter, email, electronic feedback form or in person on site.

Retention period: We process personal data for two years from the date of receipt excluding account information and telephone records, which are processed for six (6) months from the date of receipt. If we pay compensation to a customer, we will keep bank details and any medical certificate for six (6) years after payment of the compensation.

Do we use automated decision making (incl. profiling)? No

The recipients of the data: Service providers for the feedback system. You may request up-to-date information from the contact person set forth in section 2

Transfers of personal data to third countries and its basis: Data is not transferred

Purpose	Processing activities	Personal data processed
Providing, personalizing, designing and developing our online services	Identification of the user on the basis of cookies for marketing purposes, analysis of error situations, identification of the user for the collection and analysis of website usage data and use of the collected data for the design and implementation of development measures.	IP-address, cookie information and log information accrued from the use of the online services

Legal basis: Legitimate interest

Source of data: We collect personal data through the device used by the customer when using our website

Retention period: For cookie retention period, please see Cookie notice

Do we use automated decision making (incl. profiling)? No

The recipients of the data: Please see Cookie notice

Transfers of personal data to third countries and its basis: Please see Cookie notice

In addition, we may use the information for statistical purposes and for OGG’s product development and business purposes (including the use of data for analytical purposes), to better understand our customers and to improve our operations to meet our customers’ needs. For these purposes, we anonymize your personal data so that individual customers are no longer identifiable from the data.
You have the right, at any time, to object to the processing of your personal data for direct marketing and to withdraw your consent for direct marketing in accordance with section 10 of this privacy notice.

4. Who processes the personal data and to whom do we disclose the data?

Our customers’ personal data is only processed by employees who need such data to perform their duties. In addition, your personal data is processed by subcontractors working for us and on our behalf, such as IT service providers, service providers carrying out marketing and analytics measures and partners participating in the organization of campaigns. Subcontractors process personal data for OGG and on OGG’s behalf.

We do not regularly transfer personal data to other data controllers. On a case-by-case basis, we may disclose personal data to e.g., restaurants, hotels and similar partners organizing our events that process personal data for their own account. In addition, we disclose personal data, if necessary, to auditors to process personal data for their own account or on our behalf, depending on the case. On a case-by-case basis, we also disclose personal data to the authorities if there is a legal basis for doing so.

We use the following subcontractors for processing our consumer customers’ personal data:

Customer relationship management system provider
Processors mentioned in the Cookie notice
Media and analytics partners
The service provider of the system used to pay compensations, the service provider of the accounting system
Provider of the feedback system
You can always obtain up-to-date information on the subcontractors we use from the contact person set forth in section 2.

5. Do we transfer your personal data outside the EU or the EEA?

We have outsourced a part of our personal data processing to subcontractors located outside the EU/EEA. In such situations, we will ensure that your personal data is transferred lawfully in one of the following ways:
By verifying whether the European Commission has issued a decision on the adequacy of data protection in the country in question (e.g., Canada);
By ensuring appropriate safeguards as required by law, such as by signing the standard contractual clauses approved by the European Commission, by assessing the adequacy of the data protection measures regarding the transfer and by taking additional measures that may be necessary; or
By ensuring the lawfulness of the transfer in other ways, such as requesting your explicit consent for transferring your personal data. The data subject has the right to receive information on the used transfer mechanism from the contact person set forth in section 2.

6. How long do we store your personal data?

Legal requirements and rights: We will store personal data beyond the periods set out above to the extent required by mandatory legislation (e.g., accounting obligations), a legal claim concerning us or a statute of limitations or complaint period based on the law or an agreement. In such case, we will only store the data required by the legislation, statute of limitations or complaint period or the data required to process a legal claim and will remove other data.

7. How do we ensure the security of your personal data?

We have implemented appropriate technical and organizational safeguards to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access and other unlawful or unauthorized processing. We have limited the processing of personal data to those persons whose duties include the processing of such data. The data is collected in databases and processed only in systems protected by firewalls, passwords and other technical measures appropriate to the level of risk and purpose of use. In addition, all our subcontractors have committed themselves in writing to the same level of information security standards as we apply to our own processing of personal data.

8. What rights do you have?

In accordance with the applicable data protection legislation, you have, at any time, the right to:

Object to direct marketing and withdraw your consent for electronic direct marketing;
Get access to your personal data (right of inspection);
Insist any inaccurate or incorrect personal data to be rectified or supplemented;
Object to the processing of your personal data to the extent that OGG processes your personal data on the basis of a legitimate interest;
Insist your personal data to be erased;
Insist the processing of your personal data to be limited (e.g., while you are waiting for a response to a request concerning the rectification of your personal data); and
Receive in electronic form the personal data you have submitted to us and transfer the data to another controller, provided that the processing of the personal data in question is based on an agreement and that we process your personal data electronically.

With regard to electronic marketing messages such as newsletters, the easiest way to refuse to receive such messages is through the link provided at the end of the message. If you refuse to receive a newsletter or other electronic marketing messages, we will no longer send you such messages.

If you object to the processing of your personal data, specify in your request the purpose or purposes of processing that you oppose in the processing of your personal data. In addition, if you object to the processing of your personal data for purposes other than direct marketing, specify in your request the grounds on which you object to the processing of your personal data (e.g. you no longer wish to participate in the campaign that you signed up for). If you object the processing of your personal data in connection with a prize draw in which you have participated, we will no longer be able to take you into account in the prize draw.

We may ask you to verify your identity or further specify your request before implementing it. We may also refuse to implement your request on grounds set out in data protection legislation, in which case we will inform you of such grounds.

You must submit a request to exercise your rights to the contact person set forth in section 2.

9. Your right to file a complaint with the supervisory authorities

You have the right to file a complaint with the appropriate supervisory authorities if you believe that we have not processed your personal data in accordance with the applicable data protection legislation. You can file a complaint with the supervisory authorities in the EU member state where your permanent place of residence or employment is located or where the alleged personal data breach has occurred. In Finland the appropriate supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi), tel. +358 29 566 6700, e-mail tietosuoja@om.fi.

updated 25.8.2022