Privacy Policy

This is Lännentila Oy’s register and privacy policy in accordance with the EU General Data Protection Regulation (GDPR). Prepared on May 16, 2024. Last amended on October 14, 2026.

1. Data Controller

Lännentila Oy (Business ID: 2531220-3)

Lännentie 43, 91980 Lumijoki, Finland

2. Contact Person for the Register

Joonas Karjula
‍joonas.karjula@lannentila.fi‍
044 955 5372

3. Name of the Register

Lännentila Oy’s Customer and Marketing Register.

4. Legal Basis and Purpose of Processing Personal Data

Under the EU General Data Protection Regulation (GDPR), the legal bases for processing personal data are:

• Consent of the individual (documented, voluntary, specified, informed, and unambiguous).
• Contract to which the data subject is a party.
• Legitimate interest of the controller (customer relationship prior to a contract, employment relationship).

Purpose of processing personal data:

Communication with customers, maintaining customer relationships, and marketing. Data is not used for automated decision-making or profiling.

5. Data Content of the Register

Data stored in the register may include:

• Full name, title/position, company/organization
• Contact information (phone number, email address, postal address, website URLs)
• IP address of the internet connection and social media profiles/handles
• Information on ordered products/services and their changes, billing details
• Other information related to the customer relationship and ordered services

Website visitors' IP addresses and cookies essential for the functionality of the service are processed on the basis of legitimate interest (e.g., to ensure information security and collect statistical data on website visitors where such data can be considered personal data). Third-party cookies are subject to separate consent where applicable.

6. Regular Sources of Data

Data stored in the register is obtained directly from the customer via online forms, email, telephone, social media services, contracts, customer meetings, and other situations where the customer discloses their information.

Contact details of representatives of companies and other organizations may also be collected from public sources, such as websites, directory services, and other businesses.

7. Regular Disclosures and Transfer of Data Outside the EU/EEA

Data is not regularly disclosed to external third parties. Information may be published only to the extent agreed upon with the customer. Data may be transferred outside the EU or EEA by the data controller in compliance with data protection laws. Data will not be transferred to the United States without the explicit consent of the data subjects.

8. Principles of Register Protection

The register is handled with due care, and data processed using information systems is appropriately secured. When data is stored on internet servers, physical and digital security of the hardware is ensured accordingly. The data controller ensures that stored data, server access rights, and other information critical to the security of personal data are treated confidentially and accessed only by employees whose job description requires it.

9. Right of Access and Right to Request Rectification

Every individual in the register has the right to inspect the personal data stored about them and request the correction of inaccurate data or the completion of incomplete data. If an individual wishes to inspect their stored data or request an amendment, the request must be submitted in writing to the data controller. The data controller may require the requester to prove their identity if necessary. The data controller will respond within the timeframe specified in the EU GDPR (generally within one month).

10. Other Rights Related to Personal Data Processing

Individuals in the register have the right to request the erasure of their personal data from the register ("right to be forgotten"). Data subjects also hold other rights under the EU GDPR, such as restricting the processing of personal data in certain circumstances. Requests must be sent in writing to the data controller. The data controller may require the requester to prove their identity if necessary. The data controller will respond within the timeframe specified in the EU GDPR (generally within one month).