This Privacy Policy is prepared in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and explains the processing of personal data.
1. Data Controller
Narvi Oy (Business ID: 2087049-2)
Yrittäjäntie 1
27230 Lappi
www.narvi.fi
2. Contact for Data Protection Matters
Riitta-Stiina Salovaara
riitta-stiina.salovaara@narvi.fi
For all questions related to the processing of personal data, deletion of data, or exercising your rights, please contact the person mentioned above.
3. Legal Basis and Purpose of Processing
The legal basis for processing personal data includes:
- Consent given by the data subject for processing personal data
- The legitimate interest of the controller based on an existing or potential customer relationship between the data subject and the controller
Purposes of processing personal data include:
For the website
Obtaining information about the use of the website and services, utilizing this information for service and website development, usage analysis, and targeting and optimizing marketing and advertising.
For the online store
Processing orders and payments, delivery of orders, customer communication, and direct marketing.
For the application
Enabling and improving the use of the application, customer communication, and direct marketing.
4. Regular Sources of Data
Personal data is regularly obtained from the following sources:
- Directly from the data subject
- Cookies
Cookies are used on the website to provide the best possible user experience for site and service users. Cookies are small text files stored on the user’s device by the web server.
Cookie use can be disabled in cookie settings. More information about cookies can be found at www.aboutcookies.org. The site uses cookies such as Google Analytics, YouTube, and Facebook. These cookies collect information about website usage. The collected data is anonymous and does not reveal identifiable information about users.
Read more about our cookie policy below.
5. Personal Data Processed
The controller collects only personal data that is relevant and necessary for the purposes described in this Privacy Policy.
Personal data processed includes:
- Data related to website usage
- Contact and address details
- Purchase information from the online store
- Language preference
- Usage data related to the application.
6. Disclosure of Personal Data
Personal data is generally not disclosed to third parties. Personal data may be disclosed to third parties acting as service providers or subcontractors. Additionally, data collected by cookies may be transferred and stored on third-party servers.
Data may also be disclosed to authorities as required by law.
7. Transfers of Personal Data to Third Countries
Personal data is generally not transferred outside the EU or the European Economic Area. If such transfers occur for specific reasons, they will be carried out in accordance with the European Commission’s adequacy decisions.
8. Protection of Personal Data
The controller processes personal data in a manner that ensures appropriate security, including protection against unauthorized processing and accidental loss, destruction, or damage.
The controller uses appropriate technical and organizational measures to achieve this, including firewalls, encryption technologies, secure facilities, proper access control, careful management of system user credentials, and staff training.
All employees handling personal data are bound by confidentiality obligations under the Employment Contracts Act (55/2001) and supplementary non-disclosure agreements.
9. Data Retention Period
Personal data is retained only as long as necessary for its intended purpose or as required by law. Unnecessary personal data will be deleted.
10. Rights of the Data Subject
The data subject has the following rights under GDPR:
Right of access
Obtain confirmation whether personal data concerning them is processed and receive a copy of such data.
Right to rectification
Request correction of inaccurate or incomplete personal data.
Right to erasure
Request deletion of personal data under certain conditions (e.g., data no longer needed, consent withdrawn, unlawful processing).
Right to restriction of processing
Request restriction under specific circumstances (e.g., contesting accuracy, unlawful processing, or for legal claims).
Right to object
Object to processing based on personal circumstances or for direct marketing purposes, including profiling related to such marketing.
Right to withdraw consent
Withdraw consent at any time without affecting prior lawful processing.
Right to data portability
Receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to lodge a complaint
File a complaint with the national supervisory authority (Office of the Data Protection Ombudsman in Finland) if you believe your rights have been violated.
11. Changes to Privacy Practices
The controller continuously develops its operations and may update its privacy practices as necessary. Changes may also result from amendments to data protection legislation. If changes involve new purposes for processing personal data or are otherwise significant, the controller will notify data subjects in advance and request consent if required.