Please ensure the details (e.g., your service providers, cookies/analytics tools, and retention needs) match your actual setup.
Privacy Policy
1. General
Pallokauppa J.H. (Business ID 2911630-6) processes personal data relating to you in accordance with this Privacy Policy
and applicable legislation. Please read this Privacy Policy carefully.
By using our services or websites, or by contacting us, you accept that we process your personal data in accordance
with this Privacy Policy. If you do not accept these terms, we may not be able to serve you in the best possible way.
2. For what purposes is my personal data collected and processed?
We collect, store, and process personal data relating to you only for predefined purposes, including:
- Customer relationship management and customer communications
- Customer service and responding to contact requests
- Providing and developing our services
- Monitoring and analysing the use of our services and products
- Segmenting customers to provide personalised content in products and services
- Ensuring the security of our services and products and investigating misuse
- Customer, opinion and market research
- Developing our business
- Targeting marketing and advertising
- Direct marketing
We do not carry out profiling based on data subjects’ personal characteristics, nor processing that would lead to
automated decision-making related to such profiling.
3. What personal data is collected about me and from which sources?
We collect personal data mainly from you in connection with contacts and when you use our websites and services.
We also collect data manually, for example by phone in connection with customer service or sales.
In addition to the data you provide, we also collect information on our websites and services using cookies in order
to analyse and develop the use of our websites and services and to target marketing and advertising.
We also collect data from public sources such as trade and company registers as well as from providers of business
decision-maker data. Data collected from these sources may include company information and contact details of company
decision-makers, such as name, email address and phone number.
4. On what legal bases is personal data processed?
We process personal data on several legal bases permitted by law. The legal basis depends on our relationship with you.
Examples include:
- Contract (or steps prior to entering into a contract): processing customer data for the purposes listed above, for example to handle orders and provide services.
- Legal obligation: for example, storing and processing customer data for accounting purposes as required by law.
- Legitimate interests (controller’s or a third party’s): for example, customer service and responding to contact requests, visitor analytics and service development, ensuring information security and investigating misuse. Processing personal data of company representatives for marketing purposes may also be based on legitimate interests.
- Consent: for example, when a private individual orders a guide or newsletter from our site and we ask for consent for direct marketing at the time of collection.
5. Who processes my data and is it disclosed to third parties?
Your data is processed by persons belonging to our staff when performing their duties. We also may use third-party
information systems for storing and processing data. In such cases, we ensure (including by contract) that your data
is processed confidentially and lawfully.
We disclose data to our partners in the IT, payment, delivery/transport and accounting sectors to enable service delivery
(for example when you order from our online store). Such disclosures related to providing the service are specified in
connection with the order process where applicable.
We may also disclose data to fulfil contractual obligations or where required by law or by a competent authority. We may
also disclose your data if we are involved in a merger, acquisition or other business transaction.
6. Is my data transferred outside the EU/EEA?
Most infrastructure and IT service providers used have servers located within the EU/EEA. However, we may also use reputable
and reliable service providers whose servers are located outside the EU/EEA, in which case data may be transferred to a
limited extent outside the EU/EEA.
When personal data is transferred outside the EU/EEA, we use GDPR-compliant transfer mechanisms, such as:
- the European Commission’s adequacy decisions where applicable;
- the European Commission’s Standard Contractual Clauses (SCCs) and, where needed, supplementary measures; and/or
- where applicable for U.S. recipients, the EU–U.S. Data Privacy Framework for participating certified organisations.
7. How long is my personal data retained?
We retain your personal data only for as long as necessary for its purpose, or as long as required by contract or law.
We aim to update data and delete unnecessary data regularly.
As a rule, we delete data that has been unused for more than two (2) years, provided there is no other basis for retention,
such as ensuring service security or a statutory requirement.
Please note that, for example, accounting legislation may require retaining accounting materials for at least six (6) years
from the end of the financial year.
8. How is my data stored and protected?
Your data is stored on our service providers’ servers, protected in accordance with generally accepted industry practices.
We ensure that processing meets the requirements of applicable legislation and implements safeguards to prevent accidental
or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
The personal data we collect and process is kept confidential and access is restricted to persons who need the data for their
work. Such persons are bound by confidentiality obligations (contractual and/or statutory).
Access to personal data is protected with user-specific accounts, passwords and access rights.
9. Is providing data mandatory and what happens if I do not provide it?
If you do not provide personal data or do not allow processing as described in this Privacy Policy, we may not be able to
serve you or fulfil our service purpose. If you do not want us to process your data as described, please do not provide us
with any personal data.
10. Do you use cookies and what are they?
We use cookies on our website to provide the best possible user experience. Cookies are small text files stored on the user’s
device by a web server. Cookies help us understand how our websites and services are used. We use this information to develop
our services and websites, analyse usage, and target and optimise marketing and advertising.
You can allow or block cookies via your browser settings. Most browsers allow cookies automatically. Please note that blocking
cookies may limit the functionality of our website and services.
11. What rights do I have?
- Withdrawal of consent: if processing is based on consent, you may withdraw it at any time by notifying us. You can also unsubscribe from direct marketing via the “Unsubscribe” link in marketing emails.
- Right of access: you can request confirmation whether we process your personal data and obtain information about the data and processing grounds.
- Right to rectification: you can request correction of inaccurate, outdated or incomplete data.
- Right to erasure: you can request deletion of your data, e.g., when it is no longer needed for the original purpose or when you withdraw consent (where consent was the basis).
- Right to object to direct marketing: you may object at any time via the “Unsubscribe” link or by contacting customer service. If you object, we will only send messages necessary to manage the customer relationship.
- Right to object to processing: where processing is based on legitimate interests or public interest, you may object unless there are compelling grounds overriding your rights or the processing is needed for legal claims.
- Right to restriction of processing: in certain situations you can request that we restrict processing, e.g., while verifying disputed accuracy or if processing is unlawful and you oppose erasure.
- Right to data portability: where processing is based on consent or contract and carried out by automated means, you can request the data you provided in a machine-readable commonly used format, where technically feasible.
- No automated decision-making/profiling: we do not perform profiling based on personal characteristics or automated decision-making leading to such outcomes.
12. How can I exercise my rights?
You can exercise the rights described above by contacting us, for example by email at
info@pallokauppa.com. Please be prepared to verify your identity if your request concerns
your own personal data.
If you believe that the processing of your personal data is not lawful, you may lodge a complaint with the competent supervisory
authority. In Finland, this is the Data Protection Ombudsman. See:
tietosuoja.fi
13. Can this Privacy Policy be updated?
We may update this Privacy Policy as our operations develop and/or legislation changes. Please review this page from time to time.
The latest update date is shown at the top of this document. We aim to inform data subjects of significant changes in connection
with updates.
14. How can I contact you about data protection?
The easiest way to contact us is by email:
info@pallokauppa.com. Messages sent to this address are handled confidentially.
Data controller: Pallokauppa J.H. (Business ID 2911630-6)
Typpitie 1, 90620 Oulu, Finland
Email: info@pallokauppa.com
Phone: +358 50 546 2192
Customer Register Notice (Rekisteriseloste)
This notice is provided in line with the GDPR transparency requirements (Articles 13–14), as supplemented by Finland’s Data Protection Act.
Data Controller
Pallokauppa J.H. (also referred to as BalloonBuilder.com)
Typpitie 1, 90620 Oulu, Finland
Business ID: 2911630-6
Email: info@pallokauppa.com
Website: www.pallokauppa.com
Contact person responsible for register matters
Juho Hokkanen
Email: info@pallokauppa.com
Name of the register
BalloonBuilder.com Customer Register
Purpose of processing
The register is used for managing customer relationships and as a source of information for business-related decision-making.
The register may be used for marketing, but not for electronic direct marketing without the recipient’s permission.
Categories of personal data (data content)
The BalloonBuilder.com online store user register contains the information necessary for order transactions, such as:
- Name
- Address
- Phone number
- Email address
- Order details and return information
Regular sources of data
The data subject provides all information included in the register when registering for the service and while using the service.
In addition, we may collect usage data via cookies and similar technologies as described in the Privacy Policy.
Regular disclosures / recipients
We do not sell or otherwise disclose personal data for unrelated purposes outside the company.
However, to operate the online store and provide services, personal data may be shared with necessary service providers
(such as payment, delivery, IT and accounting partners) as described in the Privacy Policy.
Principles of register protection
The register is located on a protected server and can only be accessed by BalloobBuilder.com staff and authorised persons who need access for their duties, subject to access controls and confidentiality obligations.
Access to data (right of access)
You may request access to your personal data by contacting us. Requests are generally handled free of charge; a reasonable fee may apply only
in cases permitted by law (e.g., manifestly unfounded or excessive requests). We may ask you to verify your identity.
Objection to marketing and rectification of incorrect data
You have the right at any time to object to direct marketing related to the BalloonBuilder.com online store by contacting
info@pallokauppa.com. If you object, we will stop direct marketing to you.
You also have the right to correct your data in the register or request correction of inaccurate data by contacting the data controller.
Correction requests should be made in writing and should specify the data to be corrected.