Register Statement and Privacy Policy

This is Ecolor Oy’s register statement and privacy policy in accordance with the EU General Data Protection Regulation (GDPR). Created 28 July 2022 Last updated 1 August 2022. Ecolor Oy stores and processes personal data in accordance with the EU GDPR and the current Personal Data Act (523/1999).

We may update this privacy policy from time to time by publishing a new online version of it. Therefore, we recommend that you read through our privacy policy when using our services.

1. Registry holder
Ecolor Oy (hereafter referred to as Ecolor)
Business ID: 10586551
Hiomotie 3
00380 HELSINKI

2. Other contact informations:
Customer service: asiakaspalvelu(at)ecolor.fi
homepages: www.ecolor.fi ja www.kuvaverkkokauppa.fi

3. Person managing registry matters
Oskar Levänen
oskar.levanen(ät)ecolor.fi

4. Name of the registry
The customer register, marketing register, online service user register and employee register jointly maintained by Ecolor and the studios.

Ecolor subcontracts the implementation of webshops, consumer relationship management and related information systems to companies in the photography industry. All customer data is stored in Ecolor Oy’s systems in the customer register, where the company acts as a joint registry holder with the studios. Ecolor Oy also holds employees’ personal data in Ecolor Oy’s HR system.

5. The legal basis and the purpose for handling personal data
The legal basis for handling personal data, according to the EU General Data Protection Regulation, is:

Legitimate interest (customership)

Permission

We handle personal data based on customerships and other appropriate connections, such as partnerships, for purposes such as managing, maintaining and developing the aforementioned relationships with schools/daycare centres/sports clubs/businesses/communities (hereafter referred to as the Purchaser). Personal data is handled in order to deliver services, such as taking, developing and delivering photos, as well as sending invoices to and communicating with the customers. Furthermore, we handle personal data in order to analyse and develop our services and other business operations.

The data will not be used for automated decision-making or profiling.

6. The data content of the registry
The data recorded in the registry includes:

  • Basic information, such as
    • the first and last name of the guardian and/or the person being photographed
    • contact information (post address, email address, phone number)
  • Information related to the customership or other appropriate connection, such as
    • the group or class of the person being photographed
    • the Purchaser’s information
    • image files
    • information concerning the registration (password and login)
    • information concerning order history, including payment methods and debt collection
    • reclamations, feedback and other communications and measures related to the customership or other connection, including recorded phone calls and the registrant’s actions in social media services related to the registry holder
    • marketing bans
    • marketing measures targeted at the registrant and their use
    • cookies and the information concerning the registrant’s terminal and online actions (such as IP address) learned through the use of cookies or similar techniques
  • Ecolor Oy retains in the register the data relevant to the establishment and maintenance of the customer relationship until there is no legal basis to retain the data.

The data content of the employee register:

The data in the employee register is collected directly from the Employee and maintained in the HR system chosen by Ecolor Oy. The processed data may include:

  • basic information (name, date of birth, contact details, personal identity code)
  • information on education, work experience and competence
  • a job application and CV, if applicable
  • information on the employment relationship (e.g. job title, the start and estimated end date of employment)
  • basic information related to payroll
  • employee time tracking and annual leave details, travel and expense invoices, etc.
  • other information on the employment relationship, where authorised or required by legislation.

Purpose and legal basis for processing employees’ personal data

  • Personal data is processed in accordance with applicable legislation.

Data retention period

  • Ecolor Oy retains in the register the data relevant to the establishment and maintenance of the employment relationship until there is no legal basis to retain the data.

7. Right of access and the right of requesting corrections
Every person included in the registry (Customer) has the right to check their personal data that has been saved in the registry and request that any errors or omissions be rectified. If a Customer wants to check their personal data that has been stored in the registry or request a correction, they must send a written request by mail to the company’s address or via email to asiakaspalvelu(at)ecolor.fi.

The registry holder may ask proof of identity from a person submitting such a request, if necessary. The registry holder will reply to the Customer within a time period specified in the General Data Protection Regulation (typically within a month).

8. Right of prohibition
A Customer whose data has been stored in our registry has the right to request that this data be removed from the registry (‘right to be forgotten’). All requests must be sent in writing to Ecolor Oy or via email at asiakaspalvelu(at)ecolor.fi. Ecolor Oy may ask proof of identity from a person submitting such a request, if necessary. Ecolor Oy will reply to the Customer within a time period specified in the General Data Protection Regulation (typically within a month). The registrant may, if she/he wishes, give Ecolor Oy consents or prohibitions concerning direct marketing by contacting customer service.

9. Regular disclosure of data and data transfer outside the EU or the EEA
Ecolor Oy shall not assign or transfer the data in its customer information registry for any other purposes than issuing invoices, debt collection and, upon request, to the people in question or authorities. The regulations of the EU General Data Protection Regulation will be followed in all data transfers. The information may be used for sending notifications concerning the photography session, customer surveys and other marketing purposes.

In accordance with the order and delivery terms, the Customer gives Ecolor Oy permission to deliver the photographs of a person to the school/daycare centre/sports club/company/community that purchased the photo session and to publish and deliver group and friend photographs of a person to all the people in the photos and/or to their guardians.

Personal data will not be transferred outside the EU member states’ territory or the EEC. The data will not be transferred to the United States without the express consent of the data subjects.

10. Registry protection
A) Manual material

After the manual material, mainly sign up forms, have been delivered to Ecolor Oy, they will be saved into the information systems and disposed of as appropriate.

B) Information saved into the information system

The register will be processed carefully and the data processed by using data systems will be protected appropriately. When the data in the register is stored on Internet servers, the physical and digital data security of the equipment will be ensured appropriately.Data contained in the registry and handled electronically is protected by firewalls, passwords and other technical means commonly approved in the field of information security. We will guarantee that the stored information and server access rights, as well as other personal data critical to data safety, are handled on a confidential basis and by only those employees whose roles include the handling of said data.

11. Regular information sources
The registry’s regular information sources are the Customers themselves when they sign up for photo sessions or use Photo studios’ online shop. Customers provide information about themselves when registering, purchasing photo products, using Ecolor Oy’s other services or participating in marketing campaigns, among other things. Additionally, we collect personal data through the terminals used by the Customers with cookies or similar technologies.

12. Use of cookies in our online service
Our website uses cookies. A cookie is a small piece of data stored on the user’s browser, which enables a secure session to be created for the user, during which the system will know that the user remains the same. Cookies will not harm the users’ computers or files.

Cookies can be used to monitor the number of service users and gain information on the websites, browsers and operating systems used by the visitors. Also the users’ IP and web addresses will be recorded with cookies. Cookies also collect information about the use of the device, including the user ID, language selection, font size and various screen settings.

Ecolor Oy uses cookies to improve and develop its services so that they meet the users’ wishes the best way possible. Cookies can be utilised to make tailored recommendations and identify a user’s interests. Data collected with cookies can also be combined with other data of a user originating from another source in order to achieve a better user experience. We combine the data we collect and create profiles that we use to personalise our services and marketing.

Ecolor Oy also uses the Google Analytics monitoring tool on its websites. Google Analytics uses cookies for the monitoring, and data on the website’s use that is collected with cookies is transferred to and stored in Google. According to the terms and conditions of Google Analytics, Google will not combine the IP addresses of registered customers with any other data stored in Google.

If a user does not want to accept cookies, their use can be prevented. However, in that case we cannot guarantee that our services will continue to work smoothly, because the cookies are necessary for the appropriate functioning of our website and services.

This registry statement will always be available at addresses www.kuvaverkkokauppa.fi and www.ecolor.fi managed by Ecolor Oy.