Fish and crustaceans Ostrobothnia

Register and data protection statement

This is the Company’s Register and Privacy Statement in accordance with the EU General Data Protection Regulation (GDPR).

1. Controller

Ab Rågårds Lax Oy 0348434-6 [email protected]

3. Register name

Company's customer register, marketing register, stakeholder register, online service user register, member register, employee register, etc.

4. The legal basis and the purpose of personal data processing

The legal basis for processing personal data under the EU's General Data Protection Regulation is

• Consent of the person (documented, voluntary, specific, informed and unambiguous)
• agreement to which the data subject is a party
• lake (what)
• How the performance of a public duty is based (or)
• Controller's legitimate interest (e.g., customer relationship before contract, employment relationship, membership).

The purpose of processing personal data is to communicate with customers, maintain customer relationships, marketing, etc. The data will not be used for automated decision-making or profiling.

5. Register Data Content

The information to be recorded in the register includes: person's name, position, company/organisation, contact details (phone number, email address, address), website addresses, internet connection IP address, social media service IDs/profiles, information on ordered services and their changes, billing details, and other information related to the customer relationship and ordered services. If there are several groups of registered individuals (e.g., customer register and marketing register), list them and their data content in broad terms. Also state the data retention period here, if possible. Also, state if the data is, for example, anonymised after a certain period. Website visitors' IP addresses and cookies necessary for the service's functionality are processed based on legitimate interest, for example, to ensure data security and to collect statistical data on website visitors in cases where they can be considered personal data. Consent for third-party cookies will be requested separately if necessary.

6. Regular sources of information

The data recorded in the register is obtained from the customer via, for example, messages sent via web forms, by email, by telephone, through social media services, from contracts, from customer meetings, and in other situations where the customer discloses their information. Information about contact persons at companies and other organisations may also be collected from public sources such as websites, directories, and from other companies.

7. Regular disclosures of information and transfer of information outside the EU or EEA

Data is not routinely disclosed to other parties. Data may be published to the extent agreed with the customer. The data may also be transferred by the data controller outside the EU or the EEA. Data will not be transferred to the United States without the explicit consent of the data subjects. If you disclose personal data to various parties, please specify here the potential recipients or categories of recipients (including data processors/subcontractors), the purposes of processing personal data in relation to them, and the legal basis for the transfer if the data is transferred outside the EU.

8. Principles of Registry Protection

Care and appropriate protection are exercised when processing registers, and information processed by information systems is adequately protected. When register data is stored on internet servers, the physical and digital security of the hardware is duly ensured. The controller ensures that stored data, as well as server access rights and other information critical to the security of personal data, are handled confidentially and only by employees whose job description includes such access.

9. Right of inspection and right to request correction of information

Every individual registered has the right to check the data recorded about them in the register and to request the correction of any inaccurate data or the supplementation of any incomplete data. If an individual wishes to check the data recorded about them or request its amendment, the request must be sent in writing to the data controller. The data controller may, if necessary, request the applicant to prove their identity. The data controller shall respond to the customer within the time limit specified in the EU General Data Protection Regulation (as a general rule, within one month).

10. Other rights relating to the processing of personal data

A registered individual has the right to request the deletion of their personal data from the register ("the right to be forgotten"). Likewise, registered individuals have other rights under the EU General Data Protection Regulation, such as the right to restrict the processing of personal data in certain situations. Requests must be submitted in writing to the data controller. The data controller may, if necessary, request the requester to prove their identity. The data controller shall respond to the customer within the time limit prescribed by the EU Data Protection Regulation (as a main rule, within one month).

About cookies

The cookies used on our website are listed below. You can manage your cookie settings via the cookie settings link.