COOKIES
This website uses cookies to ensure the security, efficiency, and usability of the service.
We use Google Analytics to collect anonymous statistics on website visitor traffic volumes and behavior. We use this information to improve the user experience of our products and website.
Privacy Policy for Customer, Stakeholder, and Marketing Register
1 DATA CONTROLLER
Stera Group Oy
Business ID: 2145072-1
Tierankatu 5
20520 Turku
2 CONTACT INFORMATION FOR REGISTER-RELATED MATTERS
Tuija Tomberg
Phone: +358400919870
Email: tuija.tomberg@stera.com
3 PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL DATA
Stera Group processes the personal data of customers and stakeholders to fulfill its contractual obligations with them. The purpose of processing based on contract performance includes, among other things:
- Offering, delivering, producing, and designing Stera Group’s services and products;
- Managing and maintaining the customer relationship between Stera Group and the customer, including handling orders and invoicing; and
- Providing customer service and related communications.
Personal data processing may also be based on the same article for implementing pre-contractual measures aimed at entering into a contract.
Processing personal data for the following purposes essential to Stera Group’s business operations is justified based on the substantive connection between the data subject and Stera and is therefore in Stera Group’s legitimate interest:
- Developing Stera Group’s business operations, services, and products;
- Business reporting and related needs;
- Developing and monitoring customer service and related communications and marketing;
- Marketing by telephone or mail, or targeted based on job functions; and
- Preventing and investigating misuse, presenting or defending legal claims.
Stera Group is obligated to retain certain personal data of customers or stakeholders to comply with accounting or other mandatory legislation. In such cases, data retention is based on compliance with legal obligations.
Personal data may be processed for the following purposes based on the data subject’s consent:
- Delivering newsletters; and
- Cookies that track website visitor activity.
4 DATA SOURCES AND CATEGORIES OF PERSONAL DATA PROCESSED
Stera Group processes in this register information about its current and former customers, stakeholders and their representatives, as well as other individuals who have contacted Stera Group, for example through the website or by telephone. The register contains the following types of personal data:
- Name and contact information such as email address and phone number, as well as information about the represented company
- Information related to the customer relationship or other substantive connection and contractual relationship, such as order and payment information, information related to the delivery of products and services, and customer history
- Any direct marketing permissions and prohibitions, as well as information about other communications between the parties, including contact requests submitted through the website
- IP address, device identifier, and cookies of website visitors
- Targeting information generated based on data from the Trade Register, Population Information System, and other registers
Information is primarily obtained from the data subject in connection with events related to their customer relationship, use of services, communications, and other interactions.
Personal data may be collected and updated from publicly available sources, such as company websites, the Trade Register, the Population Information System, credit information registers, or other similar registers. Information provided by other Stera Group partners, such as insurance companies, may also be added to the register. Information about website visitors is collected using cookies and other similar technologies.
5 RETENTION PERIOD FOR PERSONAL DATA
Information collected in the register is retained only for as long and to the extent necessary in relation to the original purposes described in Section 3 for which the personal data was collected. Personal data stored in the register is deleted when there is no longer a legal basis for its processing.
6 DISCLOSURE OF PERSONAL DATA
Information may be disclosed to third parties only within the limits required and permitted by applicable legislation or with the separate consent of the data subject.
Customer data is not, as a rule, transferred outside the European Union or the European Economic Area. As an exception, information contained in SteraLux’s installer mapping service application may be processed in the United States by Stera Group’s service provider. The parties have committed to complying with the European Commission’s standard contractual clauses and ensuring the secure transfer of data and maintaining its reliability.
7 PROTECTION OF PERSONAL DATA
Only those Stera Group employees, professionals bound by confidentiality agreements, or partners’ personnel who have the right to process personal data in the course of their work are authorized to access systems or digital materials containing personal data. All persons using register information are bound by confidentiality obligations. Any manual materials are stored in locked premises accessible only to specifically authorized persons. Movement in work premises is monitored with access cards.
Information is collected in databases that are protected by firewalls, passwords, and other technical means, including controlled granting and monitoring of access rights, use of encryption technologies, instruction of personnel involved in personal data processing, and careful selection of subcontractors.
8 DATA SUBJECT RIGHTS
8.1 Right of Access and Right to Rectification
You have the right to obtain a copy of your personal data stored in Stera’s registers. If your data is incomplete or incorrect, we must correct it without delay.
8.2 Right to Erasure and the “Right to Be Forgotten”
In certain situations, the data subject has the right to request that Stera delete their data. This right is also known as the right to be forgotten. You have the right to have your data deleted if processing was based on consent, data has been processed unlawfully, or the data is no longer needed for the purposes for which it was collected.
This right does not apply if data processing is necessary for Stera to fulfill a legal obligation, perform a task in the public interest, exercise official authority, or establish, present, or defend legal claims.
8.3 Right to Restriction of Processing
In certain situations, you have the right to restrict the active processing of your data. You may request restriction of processing, for example, when you are awaiting a response from Stera to your request for rectification or erasure of your data.
8.4 Right to Object to Processing
You have the right to object to the processing of your personal data if the processing is based on tasks in the public interest, exercise of official authority, or legitimate interests, and you have a reason related to your particular personal situation to object to the processing.
You also always have the right to object to the use of your data for direct marketing.
8.5 Right to Data Portability
You have the right to receive the personal data you have provided to Stera in a machine-readable format and to transfer it to another organization, if the processing is based on consent or contract and the processing is carried out automatically.
8.6 Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a supervisory authority if you believe that your personal data is being processed in violation of data protection legislation or that Stera is otherwise acting contrary to its data protection obligations. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman.
9 EXERCISING YOUR RIGHTS
If you wish to exercise any of your data protection rights, you may contact us using the contact information provided in Section 2. In your message, please indicate at least which right you wish to exercise and which personal data your request concerns. Please note that in order for you to exercise all your rights, we must be able to identify you and verify your identity in a reliable manner. In such cases, responses will be delivered by registered mail, and the postal service will verify the recipient’s identity.
Exercising data protection rights is generally free of charge. However, if the data subject’s requests are manifestly unfounded or excessive, or if a person makes them repeatedly, Stera Group may either refuse to fulfill the request or charge an administrative fee of 30 euros.
10 CHANGES TO THIS POLICY
Stera Group reserves the right to modify this privacy policy. The updated version of the privacy policy will always be published on Stera’s website, and if the changes are significant, Stera will also notify data subjects of the changes in other ways, for example by sending an email or posting a notice on its website.
