Privacy Statement of Sugar Helsinki

General

This Privacy Statement describes how Sugar Helsinki Oy (hereinafter “Sugar Helsinki”) processes the personal data of natural persons who use its services in its own operations. This privacy statement applies to all Sugar Helsinki’s business processes and sites, domains, mobile solutions, cloud services and other services offered by it.

Sugar Helsinki’s websites and other services may also from time to time contain links to social networks of third parties. These third-party social networks and the processing of personal data through them are subject to the respective third-party’s own privacy statements.

This privacy statement describes the processing of personal data by Sugar Helsinki when Sugar Helsinki acts as the data controller. We always process your personal data only to the extent necessary, for example, to deliver our services and always in accordance with applicable legislation.

By providing us with your personal data, you indicate that you have read and are aware of the procedures and conditions regarding the processing of personal data according to this privacy statement. If you do not accept the processing principles described in this privacy statement, do not provide us with your personal data.

Registrar

Unless otherwise stated separately, with regard to personal data processed in accordance with this data protection statement, the following acts as the controller:

Sugar Helsinki Oy
Business ID: 2018481-2
Address: Vilhonkatu 4 B 13-14, 00100 Helsinki
Phone: +358 10 231 9006
Email: gdpr(a)sugarhelsinki.com

If you are not sure who is the controller of your personal data, you can contact Sugar Helsinki using the contact information provided in this privacy statement to ask about it.

The person responsible for processing personal data

Saana Sillanpää
Head of lifestyle PR

Sugar Helsinki Oy
Vilhonkatu 4 B 13-14
00100 Helsinki
Phone: +358 10 231 9006
Email: gdpr(a)sugarhelsinki.com

Personal data processing purposes and legal basis

Sugar Helsinki processes personal data for the purposes listed below.

Customer relations

Sugar Helsinki processes the personal data it collects primarily to deliver and produce the Sugar Helsinki services that the person has ordered or that the person has registered to use. Personal data is processed for the management and analysis of the relationship with the customer and other factual connections, for the provision of services, for business development and planning, as well as for opinion and market research and customer communication, which can also be carried out electronically and in a targeted manner.

Marketing

Sugar Helsinki may also process the personal data it collects from people for marketing purposes, if the person has given their consent or in certain cases has not specifically prohibited this. Individuals have the right at any time to withdraw their consent to the use of their data for marketing purposes either by contacting the contact information provided in this privacy statement or by using the opt-out option provided in marketing communications (such as the cancel order link).

Sugar Helsinki does not sell or hand over the personal data it processes to third parties for their own marketing purposes, unless the person has separately given their consent to this. The marketing measures performed by Sugar Helsinki as a processor on behalf of other data controllers are described below.

Legal basis for processing

Sugar Helsinki processes your personal data based on a different legal basis, depending on whether Sugar Helsinki acts as a data controller or a processor with regard to the personal data you process. When Sugar Helsing is operating, the processing of your personal data by the data controller itself is based on either a) the implementation of the contract entered into with the registered Sugar Helsingin regarding the order of Sugar Helsingin’s services, b) the implementation of the legitimate interests related to the registered customer relationship of Sugar Helsingin, or c) the consent given by the registered user. When Sugar Helsingin acts as a processor for its customer company acting as a data controller, Sugar Helsingin’s processing of your personal data is based on an agreement between Sugar Helsingin and the data controller for ordering services.

Providing personal information to Sugar Helsing is not, as a rule, a condition for the delivery of the contract or services. If this is the case, however, and Sugar Helsinki cannot e.g. implement the services you have ordered without your personal data, the provision of this data is separately marked as mandatory. Failure to provide such mandatory information may prevent Sugar Helsinki from delivering the services you have ordered or significantly limit their delivery.

Personal data to be processed

Sugar Helsinki can process, among other things, the following personal data for customer care and marketing purposes:

  • First and last name
  • contact information (postal address, telephone number, e-mail address)
  • the start and end date and manner of the customership and/or substantive relationship
  • direct marketing permits and prohibitions
  • Business ID (companies)
  • For registered customers, the register also contains a username and password.
  • information regarding the use of electronic services and content (e.g. subscription to newsletters)
  • information related to marketing and sales promotion, such as marketing measures aimed at the data subject and participation in them

In addition, Sugar Helsinki may, in connection with managing customer relations, process the following information about those who purchased the product and/or service in addition to the information listed above:

  • customer number
  • Business ID
  • billing information
  • contact persons (name, phone, email)
  • information related to handling and maintaining contact and classification of the customer and other relevant matters (e.g. purchase and cancellation information of products and services, delivery information, feedback, complaints and recordings of customer service events, such as phone calls, emails and support messages)

Regular sources of information

Personal data concerning the registrant is primarily collected directly from the registrant himself, e.g. when the registrant himself discloses his personal data, e.g. when subscribing to a newsletter, through various Sugar Helsingin services used by registrants, and in connection with various marketing measures such as marketing lotteries and competitions and events.

Personal data can also be collected and updated from the registers of partners as well as from companies offering services related to personal data, to which the data subject has given his consent to the transfer of his personal data. Such third parties from which Sugar Helsinki may collect data of registered users can be, for example, various companies that provide credit information or address information.

Regular transfers of information

Sugar Helsinki discloses personal data only in those cases and to the extent necessary for the proper delivery of services. Sugar Helsinki always follows appropriate security measures to ensure the protection of personal data in connection with transfers.

From time to time, Sugar Helsinki may have to hand over the personal data it processes to competent authorities or other similar entities in a manner required by the requirements of such competent authorities or other entities, based on valid legislation.

If we sell, buy, merge or otherwise reorganize our business, users’ personal data may be disclosed to buyers or potential buyers and their advisors.

Information can be disclosed to partners selected by Sugar Helsingin and to service providers who process information on behalf of the controller based on a cooperation agreement between the parties. In such situations, Sugar Helsinki always ensures that the partners and service providers involved in the processing of personal data are contractually bound to observe confidentiality and data protection, and that personal data is processed only for the purposes described in this privacy statement of Sugar Helsinki.

In addition, Sugar Helsinki may disclose information within the companies belonging to the Zeeland Family Oyj group. Some of the companies belonging to the Zeeland Family Oyj group are also located outside of Finland, which is why data may be transferred or processed outside of Finland as well. However, the companies belonging to the Zeeland Family Oyj group are not located outside the EU or EEA.

Data transfer outside the EU or EEA

As a rule, we do not transfer data outside the EU or EEA. However, in some situations (e.g. situations where our service providers or servers are located outside the EEA) we may have to transfer the personal data we collect to countries outside the EEA, where the level of data protection has not necessarily been determined to be sufficient by the European Commission (e.g. the USA).

If we transfer data outside the EU or EEA to such countries with an insufficient level of data protection, we ensure an adequate level of personal data protection, for example by agreeing on matters related to the confidentiality and processing of personal data as required by legislation, for example using model contract clauses approved by the European Commission or using other similar protection mechanisms. The European Commission’s model contract clauses are available on the European Commission’s website, and you can request a copy of other transfer criteria by contacting Sugar Helsinki.

Protection of personal data

We use necessary and appropriate technical and organizational data security measures to protect personal data against unauthorized access, disclosure, disposal or other unauthorized processing. Such means include, for example, the use of firewalls, secure equipment rooms, appropriate access control, managed granting of user rights and monitoring of their use, use of encryption technologies, instructions to personnel involved in the processing of personal data, and careful selection of subcontractors.

Personal data retention period

Sugar Helsinki stores your personal data only as long as it is needed for their stated purposes of use or to fulfill legal obligations. When the personal data we collect is no longer needed, we destroy or delete it securely.

The rights of the registered person and their implementation

Data protection legislation guarantees registrants several rights regarding their personal data, which Sugar Helsinki is also committed to implement. The user of Sugar Helsinki’s services has, among other things, the right to check the personal data stored about him and to request a copy of the personal data collected about him. When Sugar Helsingin’s processing of the user’s personal data is based on the user’s consent, the user has the right to withdraw the consent he gave to the processing at any time.

At the user’s request, we will correct, delete or supplement personal data that is incorrect, unnecessary, incomplete or outdated in terms of the purpose of the processing. The user also has the right to request the deletion of his personal data (the so-called right to be forgotten), if the processing was based on the user’s consent and the user withdraws his consent, the user’s personal data has been processed unlawfully, or the user objects to the processing of his personal data and there is no justified reason for the processing.

In addition, the user has the right in certain situations to request the restriction of the processing, to object to the processing, and to request the transfer of data from the system to another or another data controller. The user may have such a right, for example, in situations where there is no longer a legal basis for the processing, but instead of deleting the data, the user only wants to limit the processing or when the processing is based on consent and the processing has been automatic.

The user has the right to file a complaint with the competent supervisory authority regarding the processing of the user’s personal data by Sugar Helsinki, if the user feels that Sugar Helsinki has not processed the user’s data in the manner required by the applicable data protection legislation, or if requests related to the user’s rights guaranteed by law have not been properly implemented. You can find the contact information of the competent data protection authorities of all EEA countries here.

If you want to exercise any of the rights guaranteed to you by the applicable law described above, you can do so by contacting Sugar Helsinki (or, depending on the case, a company belonging to the Sugar Helsinki group acting as the data controller) using the contact information provided in this privacy statement. In some cases, Sugar Helsinki may need to ask you for additional information to make sure that you are who you say you are. If Sugar Helsinki only acts as a processor of another controller with regard to your personal data, Sugar Helsinki instructs you to contact the controller in question regarding your requests. For some services, Sugar Helsinki also offers you the opportunity to view, change and delete your own data by logging into the Sugar Helsinki user portal. When you have the opportunity to do so, Sugar Helsinki primarily recommends e.g. updating your information through the relevant user portal.

Automatic data collection

Sugar Helsinki uses commonly used digital marketing methods and tools when collecting information about your movement on our website. This information is collected to improve the usability and content of our sites, to target advertising and marketing, and to find out the visitor’s interests. Data is mainly collected using cookies (see below), and they cannot be linked to a person.

Cookies used by Sugar Helsinki

We use cookies on our website to better understand what kind of content our website visitors are interested in. A cookie is a small text file that the browser saves on the user’s terminal device. Cookies contain an anonymous, unique identifier that allows us to identify and count the different browsers that visit our site. Cookies do not move online by themselves, but are placed on the user’s terminal device only with the site called by the user. Only the server that sent the cookie can later read and use the cookie. Cookies or other technologies do not damage the user’s terminal device or files, and cookies cannot be used to run programs or spread malware.

With the help of JavaScript and server logs, we can collect information about how and when our services are used: for example, from which page the user has switched to the service, when and which of our www pages the user has browsed, which browser the user uses, what is the user’s screen resolution, the device’s operating system and its version, and IP address.

The purpose of using cookies and other similar technologies is to analyze and further develop our services to better serve users. Among other things, the technologies make it possible for the user not to have to re-enter usernames, passwords and personalization choices every time.

We use cookies and other similar technologies for statistical monitoring of the number of visitors to our services and to measure the effectiveness of advertising. For example, we can collect information about marketing emails and newsletters to find out whether the messages have been opened and whether actions have been taken based on them. In order to improve the usability of our websites, we can conduct short-term studies, where we can also store information about the user’s mouse movements and clicks on a certain page.

We use both session-specific cookies, which are only saved for the duration of your one-time visit, and permanent cookies, which are saved for longer periods of time over several browsing sessions. Some of these cookies are cookies of the operator who manages the site when you visit it (such as Sugar Helsinki) and some are cookies of third parties that provide services on the site (such as analytics companies). You can get more information about the cookies used on the Sugar Helsinki website through the cookie settings of your browser.

You can block or disable cookies or otherwise manage cookies from the settings of your browser. However, it is good to note that blocking the use of cookies may affect some of the website’s functionalities, and after blocking you may no longer be able to benefit from all the features of our website.

Changing the privacy statement

Sugar Helsinki is constantly developing its business and therefore reserves the right to change this privacy statement by announcing it in the services. Changes can also be based on changes in legislation. If we make changes to the privacy statement, we will publish the changed statement and the date of the change on this website. Because of this, we recommend that our Users regularly check the up-to-date privacy statement on our site.

If we make significant changes to our notification, in which case our privacy policy changes substantially, we can also notify you in another way, for example by sending an email message, publishing a notification on our group’s website and/or social media page before the changes take effect.

This Privacy Statement was last updated on April 7, 2022.

Contact

If you have any comments or questions about our privacy policy, or if you are concerned about privacy protection or data use, or suspect that your privacy has been violated, send a message to gdpr(a)sugarhelsinki.com. You can also write to Sugar Helsinki Oy, data protection, Vilhonkatu 4 B 13-14, 00100 Helsinki.

We will process your request confidentially and our representative will contact the address you provided if necessary. We try to process comments in a timely manner and in the manner they require.