Privacy Policy
Prepared: 11 August 2026
1. Controller
Company: Carina Solutions Oy
Business ID: 2520223-1
Address: Mustionkatu 2
Postal code: 20750
City: Turku
Email: ville.lahtinen@c4.fi
2. Person responsible for register matters and data protection officer
Company: Carina Solutions Oy
Name: Ville Lahtinen
Address: Mustionkatu 2
Postal code: 20750
City: Turku
Email: ville.lahtinen@c4.fi
3. Name of the register
Customer and marketing register
4. Legal basis and purpose of processing personal data
The processing of personal data is based on a customer or contractual relationship, on another legitimate basis, or on the explicit consent of the data subject.
Personal data may be processed in order to fulfil contractual or statutory obligations, to communicate with the data subject and with any other party necessary for managing the contractual relationship, to send newsletters, to provide information, to market products and services, and to carry out market analysis and develop operations.
5. Data content of the register
The following may be stored about a data subject: name and the necessary contact details such as address, telephone number and email address, business ID, position in the organisation, date of birth or personal identity code, information about the products and services the customer has ordered and about their delivery and invoicing, messages, comments and materials exchanged between the controller and the data subject or another party necessary for managing the contractual relationship, consents, prohibitions and customer feedback.
Technical information may be collected about the use of online services, such as IP address, country or city of location, the online services used, information about the device and operating system used, browser type, and the external sites from which the user has arrived or to which the user moves on from the controller’s online service.
Information about the use of the services may be collected on the controller’s website using cookies.
6. Regular sources of data
The data stored in the register is obtained from the data subject themselves, technically from the data subject’s use of online and electronic services, from analytics services provided by third parties such as Google Analytics, from public sources of information, or from providers of public contact information.
7. Regular disclosures of data
Personal data is not regularly disclosed to outside parties. Disclosure is however possible for a justified purpose.
8. Transfer of data outside the EU or the EEA
Personal data is not regularly transferred outside the EU or the EEA. If data is nevertheless transferred, the controller ensures an adequate level of protection for personal data, among other things by agreeing on the confidentiality and processing of personal data in the manner required by law.
9. Principles of protecting the register
MANUAL MATERIAL
Manual material is kept in a locked space and destroyed once it has been converted into electronic form.
ELECTRONIC MATERIAL
Electronic material is stored appropriately protected on the controller’s premises on a computer or a storage medium, or appropriately protected on an external server or service.
Personal data may be processed by those members of the controller’s personnel who need the data in order to perform their duties.
The register data is protected from parties outside the organisation by technical solutions and applications.
An SSL-secured connection is used when collecting and transferring confidential information such as bank and credit card details.
The register data is backed up regularly and the ability to restore the backed-up data is tested.
The controller reports any personal data breaches directly to the authorities or to the user in accordance with the legislation in force.
10. Right of access
As a rule, everyone has the right to check the data stored about them in a personal data register.
Requests for access are addressed to the controller’s contact person using the contact details above, in writing and signed by the data subject.
11. Right to request rectification and erasure of data
Everyone has the right to request the rectification or erasure of incorrect data held in a personal data register.
The request is addressed to the controller’s contact person using the contact details above, in writing and signed by the data subject.
12. Other rights relating to the processing of personal data
The data subject has the right to request that their data be transferred in electronic form to another service provider.
The data subject has the right to withdraw the consent they have given to the processing of personal data.
The data subject has the right to prohibit the use of their data for distance selling and other direct marketing, and for market and opinion research.
A request, withdrawal of consent or prohibition by the data subject is addressed to the controller’s contact person using the contact details above, in writing and signed by the data subject.
The data in the marketing register is retained until further notice.
The controller retains other personal data in accordance with the legislation in force at any given time, and only for as long as retaining it is necessary for the purposes described in this privacy policy.
Data may also be retained after the end of the customer relationship or other basis for processing personal data, where accounting legislation or other mandatory legislation so requires and in accordance with the provisions of that law.
A visitor to the controller’s website can clear or block cookies in the settings of the browser or device they are using, which may however degrade the experience of using the site or cause malfunctions.
The data subject has the right to object to the processing of personal data concerning them, to require that the processing of their data be restricted, and to lodge a complaint with the supervisory authority for data protection matters, www.tietosuoja.fi.
This is a translation of the Finnish privacy policy. In case of any discrepancy, the Finnish version prevails.
