Privacy Policy (B2B Customer Register)

Data Controller:

Tuudo Oy
Paavo Havaksen tie 5 F, 90570 Oulu
Email: info@tuudo.fi

Contact Person for Matters Concerning the Register:

Ville Mustalahti
Paavo Havaksen tie 5 F, 90570 Oulu
Email: ville.mustalahti@tuudo.fi

Name of the Register:

Tuudo Oy B2B Customer Register

Purpose of Processing Personal Data

The purpose of the register is to maintain Tuudo Oy’s customer database, archive and process customer orders, and manage customer relationships. Personal data is processed in accordance with applicable data protection laws. The register is also used for invoicing.

Data may also be used for the development of Tuudo Oy’s operations, for statistical purposes, and to produce more personalized and targeted content in our online services and marketing communications.

Data Content of the Register:

The register contains:

• Customer company name and address
• Customer contact person’s name, phone number, and email address
• Customer billing information
• Order details

Regular Sources of Data:

Publicly available internet sources, the tuudo.fi website, and information obtained through the customer relationship.

Regular Disclosures of Data:

The data in the customer register is used only by Tuudo Oy, except when an external service provider is used as part of customer relationship management. Personal data will be deleted at the registered person’s request unless legislation, unpaid invoices, an ongoing customer relationship, or debt collection prevent deletion.

Transfer of Data Outside the EU or EEA

Data is not transferred outside the EU or EEA, except in cases where the customer’s place of business is located outside these areas and it is necessary for customer relationship management to use an external local service provider.

Principles of Register Protection

The register is not disclosed to third parties. Access to the register requires internal network credentials within Tuudo Oy. The register is stored on a password-protected server. No manual data files are maintained.

Retention Period:

Tuudo does not retain personal data longer than permitted by law and only for as long as necessary to provide the Services or parts thereof. The retention period depends on the nature of the data and the purpose of processing. Therefore, the maximum retention period may vary by case. Customer data relating to your use of our Services will generally be deleted within a reasonable time after you stop using the Services. We retain Customer Data for as long as the customer is a registered user of our Services, or as required by law or justified by legal obligations such as claim handling, internal reporting, marketing, or accounting.

Analytics Data is retained for 12–26 months, after which it is anonymized.

Right of Access and Rectification:

The registered person has the right to inspect their personal data in accordance with data protection law and to request correction of inaccurate information, unless legislation, unpaid invoices, or debt collection actions prevent such correction.

Right to Lodge a Complaint:

If you believe that our processing of personal data violates applicable data protection laws, you may file a complaint with the local supervisory authority. In Finland, you can find the contact information of the Data Protection Authority at www.tietosuoja.fi.

Data Security:

We use administrative, organizational, technical, and physical safeguards to protect the personal data received and processed from customers. Such measures include data encryption, passwords, firewalls, secure facilities, and systems with restricted access rights.

Our safeguards are designed to ensure an appropriate level of confidentiality, integrity, availability, recoverability, and fault tolerance of data. We regularly test our Services, systems, and other equipment for vulnerabilities.

If, despite our security measures, a data breach occurs that is likely to have adverse effects on customers’ privacy, we will notify the affected customers and other relevant parties, as well as the competent authorities, as required by applicable data protection legislation.