1. Data controller

Oy Verman Ab
Kauppakaari 2
04200 Kerava Finland
info@verman.fi

2. Types of personal data processed

In this section the types of personal data we processe as well as the different ways for collecting such data shall be informed.

Data collected when you contact us via an online form:

• Subject or reason for the contact
• Name (not compulsory)
• Address details (not compulsory)
• Phone number and email
• Content of your message

Data collected when you register to our event via an online form:

• Name
• Work phone number and email address
• Name of the company where you work
• Information on food allergies

Data collected when you subscribe to our newsletter

• Name
• Email

Data collected when you register to our online service (only for our resellers)

• Name
• Email and password
• Address details
• Reseller’s contact information

Note that our online services may have their own specified privacy notices according to which personal data is processed. Before registering to our online service, please read the relevant privacy notice with care.

Data collected by using cookies

• Data collected on the use of our websites. Such data includes, for instance information on your browser, operating system and IP-address, etc.

Generally, we do not create an individual profile of your activities on our websites.

3. The purposes of processing personal data and the legal basis for such processing

We only process personal data where it is necessary and the purposes for such processing are determined. In the following table we provide information on the purposes of processing personal data as well as on the legal basis under which we process personal data.

4. Personal data retention periods

We store personal data for as long as it is necessary to perform the purposes set out in section 3 of this Privacy Notice.

Personal data collected from the use of online forms shall be stored for a maximum of 12 months following from the date we received such a contact or feedback through an online form.

Personal data related to the subscription of our newsletter shall be stored as long as you are subscribing. Personal data relating to the subscription of our newsletter shall be deleted at the time you withdraw your consent to the subscription.

Personal data required for registration and signing up to our separate online services shall be stored for as long as we regard a user to be active. If a user has not signed in to our online service for 18 months, we regard such a user to be inactive. Personal data of a user, regarded as inactive, shall then be deleted no later than 12 months after finding a user to be inactive.

Although the storage time differs depending on the type of cookie in question, the retention period for personal data collected using cookies shall never exceed 24 months.

5. Recipients of personal data

For the purposes of processing personal data, set out in section 3 of this Privacy Notice, we use different service providers, which process personal data on behalf of us. Such service providers include:

• Online and website service provider (including maintenance and hosting services)
• Web analytics service provider
• Online forms service provider.

In addition to our service providers, we may share personal data with companies belonging to the same group of companies as Verman.

Furthermore, where the disclosure of personal data is strictly necessary, in accordance with applicable laws, for regulatory purposes, we may disclose personal data to competent authorities or courts of law. For instance, we may disclose data, as required by law, to the Finnish Medicines Agency in the connection of a report we receive on adverse reactions of our products. Note that the report we send to the Finnish Medicines Agency on adverse reactions will be anonymised.

6. Transfers of personal data outside the EU or the European economic area

Verman processes personal data inside Finland and the EU. Nevertheless, it is possible that personal data may be transferred outside the EU or the European economic area when we use service providers set out in section 5 of this Privacy Notice. Where personal data is transferred outside the EU or the European economic area, we ensure that the protection of personal data will not be jeopardised by implementing necessary and adequate measures, as required in applicable data protection legislation.

7. Profiling

We may use profiling to generate more personalised online advertising or to develop the user experience of Verman’s website or our online services. Even though we may use profiling for the aforementioned purposes, we do not adopt decisions based on profiling that could have legal effects on the users of Verman’s website.

8. Rights of the data subjects

You, as a data subject, have the following rights in accordance with data protection legislation:

Right to access data and right to rectify data

You have the right to review what personal data of you is stored and receive a copy of such data. You also have the right to rectify inaccurate data concerning you.

Right to have data erased (“right to be forgotten”)

You have the right to have your data deleted if one of the following conditions is met:

• Data is no longer needed for the purposes for which they were collected
• You withdraw your consent for the processing of personal data and no other legal basis apply for such processing (only when the legal basis for processing is consent)
• You oppose the processing of personal data on the grounds of an exceptional personal situation, when the legal grounds for processing your personal is based on our legitimate interests. At the time of opposing you must specify the exceptional situation under which your data should be deleted (only when the legal basis for processing is our legitimate interests)
• You oppose the processing of personal data for direct marketing purposes
• Your personal data has been processed unlawfully
• We are obliged to delete personal data under a statutory obligation.

Right to oppose processing

You have the right to oppose the processing of personal data on the grounds of an exceptional personal situation, when the legal grounds for processing is our legitimate interests. At the time of opposing you must specify the exceptional situation under which you oppose to the processing.

Notwithstanding the above mentioned, you have, at any time, the right to oppose the processing of personal data for direct marketing purposes.

Right to lodge a complaint to supervisory authority

Where your rights, under applicable data protection laws, have been infringed, you have the right to lodge a complaint to a data protection authority within the EU. In Finland the competent supervisory authority is the Office of the data protection ombudsman (Tietosuojavaltuutetun toimisto), which contact details may be found at www.tietosuoja.fi.

Using your rights

You may use your rights by contacting us, as set out in section 1 of this Privacy Notice.

9. Other

We constantly strive to develop Verman’s website and online services. Thus, new functions, features and services may emerge, or they may alter, after which we update this Privacy Notice accordingly. In addition, changes in laws or guidelines provided by competent authorities may render it necessary to update this Privacy Notice.