Privacy Statement for newsletter register

This Privacy Statement describes how the data controller processes your personal data as a subscriber to the newsletter.

We comply with applicable data protection legislation in all processing of personal data. Data protection legislation refers to applicable data protection legislation, such as the General Data Protection Regulation of the European Union (2016/679) and the Finnish Data Protection Act (5.12.2018/1050). Any data protection-related terms that are not defined in this Privacy Statement shall be interpreted in accordance with data protection legislation.

Our services and website may also contain links to external websites and services operated by other organisations. This Privacy Statement is not applicable to their use, so we invite you to consult their privacy statements separately.

"Personal data" means any information relating to a natural person ("data subject") from which an individual can be directly or indirectly identified, as further defined in the GDPR.

1. Data controller

Visit Levi (marketing name for the following companies)
Levin Matkailu Oy, business ID 0794875-0 / Levi Marketing Oy business ID 3015252-3 /
Oy Levi Travel Ltd. business ID 2141990-0 / Lapland Productions Oy business ID 1761885-1
Myllyjoentie 2, 99130 Levi
Phone +358 16 639 3300

2. The person responsible for the register

CEO Satu Pesonen
Postal address: Myllyjoentie 2, 99130 Levi
Email: satu.pesonen (@ )visitlevi.fi

3. Name of the register

Visit Levi newsletter register

4. Purpose of the processing of personal data

The purpose of processing personal data is for multi-channel marketing, such as sending newsletters and targeting other marketing, for example digitally, to data subjects who have subscribed to our newsletters, i.e. given their marketing consent.

The purposes (and in brackets the legal grounds) for processing your personal data are:

• sending a newsletter to those who have given their marketing consent (contractual relationship or preparation for it)

• customer communications, service messages or other information (contractual or in preparation)

• customer service and customer satisfaction surveys (legitimate interest)

• marketing, marketing promotion and analysis and the production of statistics and measurement of marketing effectiveness (legitimate interest)

• direct marketing, including electronic direct marketing through various digital channels such as social media and other advertising networks, and telephone marketing, as well as the design and measurement of the effectiveness of advertising and marketing and the aggregation and updating of personal data for direct marketing purposes (legitimate interest, consent).

• profiling personal data to target advertising for products and services (legitimate interest)

• developing and improving services (legitimate interest)

• internal and group-wide reporting and other administrative measures (compliance with legal obligation)

• preventing and investigating misconduct and ensuring the security of information, persons and property (legitimate interest)

• meeting any other statutory obligations (e.g. accounting, taxation) and reporting obligations

When we process your personal data on the basis of legitimate interests, we assess the benefits and possible harms of the processing for data subjects (such as you). We have assessed that the rights and interests of data subjects do not override our legitimate interests. You have the right to object to the processing of personal data based on legitimate interests.

Where personal data is processed for electronic direct marketing, electronic direct marketing is based on consent, where required by law. You may withdraw such consent at any time.

Where we process your personal data to comply with legal requirements or to fulfil certain of our reporting obligations, the legal basis for the processing is primarily to comply with a legal obligation.

5. Data content of the register

We only collect the information that is necessary at any given time, so the amount of information we collect may vary from contact to contact. The newsletter subscriber may also be a Visit Levi customer, in which case the information may be supplemented with customer information such as purchase history.

Data groups and examples of data content

Identification and contact details
Name, phone number, address, email address, date of birth of the newsletter subscriber.

Information on products and services, including subscriptions and customer communications
Purchase history, customer communication data.

Information relating to marketing (including direct marketing) and the data subject's consents and prohibitions
Contact details for marketing purposes. Data collected through profiling. Consents and prohibitions to direct marketing.

Information about the use of websites and other electronic services
IP address, electronic communication identification data, search and browsing data, browser and operating system data and registration data.

We collect personal data mainly directly from you when you subscribe to our newsletter, when you use Visit Levi's services or when you otherwise contact us.

We may also receive personal data from other external sources, such as private registry services and registers maintained by public authorities.

6. Segmentation of the data

Segmentation and profiling refer to the automated processing of personal data to assess a person's personal characteristics. Segmentation means, for example, the analysis or prediction of characteristics related to personal preferences, interests, or behaviour. We segment customers for purposes such as marketing and service development.

We analyse information to send and display tailored offers and other benefits, services and promotions that best match your interests. We create segmented profiles or customer classifications of users based on, among other things, information provided by the data subject, website behaviour and purchase history. Segmentation is based on our legitimate interest. We use data subjects' information to target marketing in digital channels and other possible channels.

We consider that such segmentation does not have legal effects within the meaning of the GDPR or otherwise have a significant impact on the subject of the segmentation.

You may at any time object to the processing of personal data on the basis of legitimate interest. You may object to analytics and profiling and targeting in external channels. In this case, for example, we will not be able to target marketing messages sent to you and you will only receive general marketing communications, i.e. not information about the products in which we could infer your interest through segmentation.

7. Data retention period

Personal data will be kept for as long as necessary to maintain the register and to send newsletters, but for no longer than the period recommended by the Data Protection Authority. Data will not be kept for longer than is necessary to comply with legal requirements.

8. Data processors and regular data disclosures

The processing of personal data may be carried out by data processors acting on behalf of the controller. Such entities may include, for example, various service providers, such as providers of advertising and marketing and technical solutions or server space, or accounting and financial service providers. We will ensure that the parties we use to process personal data have the necessary agreements with us as required by data protection legislation.

Personal data may be disclosed to third parties in situations required by law or by a public authority, to investigate misconduct or to ensure security. Personal data may need to be disclosed in connection with legal proceedings or similar legal proceedings.

If the data controller or a company belonging to the same group as the controller is involved in a merger, acquisition or other business arrangement, personal data may be disclosed to the parties to the arrangement or to persons assisting in the arrangement.

Personal data may be transferred between companies belonging to the same group as the controller in accordance with the conditions laid down in data protection legislation for the purposes described in this privacy statement. Group companies may also process personal data on behalf of another group company.

We will provide additional information about the recipients of your personal data upon request.

It is Visit Levi's policy that your personal data will be processed within the European Union (EU) or the European Economic Area (EEA).

Some of the services that Visit Levi uses to process personal data may operate outside the EU or EEA. In such cases, your personal data may be transferred outside the European Union and the European Economic Area.

If your personal data is transferred outside the EU/EEA, the transfer will either take place to a country that the Commission has decided provides an adequate level of data protection, or the transfer will take place using appropriate safeguards, such as standard data protection clauses and other additional safeguards deemed necessary, or otherwise in a manner approved by the EU Commission or the competent data protection authority in accordance with the General Data Protection Regulation.

Otherwise, data will not be disclosed to third parties without the consent of the data subject, except where necessary to comply with legal obligations or in connection with the use of service providers, such as email service providers. In such cases, we will ensure an adequate level of data protection through contracts.

9. What are your legal rights as a data subject?

You have rights to your personal data under data protection law. However, the application of these rights in each individual situation depends on the purpose and context in which the personal data are used.

• Right of access to personal data. You have the right to obtain confirmation of whether your personal data is being processed and other information about the processing of your personal data in accordance with data protection legislation. You have the right to receive a copy of your personal data.

• Right to rectification of personal data. You have the right, subject to certain restrictions, to request the correction or completion of inaccurate or inaccurate personal data.

• Right to erasure of personal data. You have the right to request the erasure of your personal data, subject to the conditions set out in data protection legislation. Upon request, we will delete your personal data unless we are required by law or any other applicable exception under data protection legislation to retain your personal data.

• Right to restriction of processing. You have the right to request restriction of the processing of your personal data in certain circumstances, subject to the conditions set out in data protection legislation.

• The right to transfer personal data. You have the right to request the transfer of your personal data to another data controller. In principle, the right of transfer applies to personal data that you have provided to us in a structured and machine-readable form, for which the processing is based on your consent or on a contract and/or for which the processing is carried out automatically.

• The right to object to processing. You have the right to object to the processing of personal data based on legitimate interests, including profiling, under the conditions set out in data protection legislation. We may refuse a request if the processing is necessary for the purposes of compelling legitimate interests pursued by us, the controller, or by a third party. However, you always have the right to object to the processing of your personal data for direct marketing purposes and profiling for direct marketing purposes.

• The right to withdraw consent. If the processing of personal data is based on your consent, you have the right to withdraw your consent to the processing of personal data concerning you. Withdrawal of consent does not affect the processing carried out prior to the withdrawal. In addition, you can opt-out of direct marketing and you can withdraw your consent to electronic direct marketing by following the instructions included in the marketing communication (e.g. unsubscribe function included in an email or SMS).

10. Use of cookies

Our website may use cookies to analyse and improve our newsletters. Information and instructions on how to use cookies can be found here.

11. Changes to the Privacy Statement

This Privacy Statement is dated and publishes 3.10.2024. We will update this Privacy Policy as necessary. We recommend that you check it regularly.

12. Contact

Any questions regarding data protection, requests to exercise rights or other contacts can be sent to the data controller at the address above.