PRIVACY POLICY
Last updated: 21 May 2025
Banaani (Potassium Industries Oy) CUSTOMER REGISTER PRIVACY NOTICE
1 Data controller
The data controller of the register is Potassium Industries Oy (Business ID (Y-tunnus): 3598900-7)
The contact person for matters concerning the register is: Ville Wendelin
Potassium Industries Oy
Address: Kotimäenkatu 8, 20540, Turku, Finland
Phone: 0405540540 (Note: we do not have customer service by phone. Please contact us by email.)
Email: info@banaanieyewear.fi
2 Name of the register
The name of the register is the customer register of Potassium Industries Oy.
3 Purpose of processing personal data
Personal data is processed for purposes related to managing, administering and developing the customer relationship, offering and delivering services, and developing and invoicing services. Personal data is also processed for the purposes required to resolve possible complaints and other claims.
In addition, personal data is processed in communication directed at customers, such as for information and news purposes, and in marketing, as part of which personal data is also processed for purposes related to direct marketing and electronic direct marketing.
The customer has the right to prohibit direct marketing directed at them.
The data controller processes the data itself and also uses subcontractors that act on behalf of and for the account of the data controller in processing personal data.
4 Legal bases for processing
The legal bases for processing personal data are the following grounds under the EU General Data Protection Regulation (hereinafter also "GDPR"):
the data subject has given consent to the processing of their personal data for one or more specific purposes (GDPR Art. 6(1)(a));
processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (GDPR Art. 6(1)(b));
processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party (GDPR Art. 6(1)(f)).
The legitimate interest of the data controller mentioned above is based on a relevant and appropriate relationship between the data subject and the data controller, which results from the data subject being a customer of the data controller, and where processing takes place for purposes that the data subject could reasonably expect at the time the personal data was collected and in the context of an appropriate relationship.
5 Data content of the register (categories of personal data processed)
As a rule, the register contains the following personal data on all data subjects:
the person's basic and contact details: first name, last name, address, phone number, email address
information related to the person's company or other organisation and the person's position or job title in that company or organisation;
the person's direct marketing consents and prohibitions.
6 Regular sources of data
Personal data is collected from the data subject themselves.
Personal data is also collected and updated, within the limits of applicable legislation, from publicly available sources that relate to carrying out the customer relationship between the data controller and the data subject and that help the data controller fulfil its obligations related to maintaining customer relationships.
7 Retention period of personal data
The data collected in the register is kept only for as long as, and to the extent that, it is necessary in relation to the original or compatible purposes for which the personal data was collected.
The need to keep personal data is assessed every 2 years and its necessity is assessed in relation to warranty and product liability periods. In any case, data concerning a data subject is deleted from the register 3 years after the customer relationship between that data subject and the data controller has ended and the obligations and measures related to the customer relationship have been completed. For example, accounting vouchers are kept for five years from the end of the financial year.
The data controller regularly assesses the need to keep the data in accordance with its internal code of conduct. In addition, the data controller takes all possible reasonable measures to make sure that personal data that is inaccurate, incorrect or outdated in relation to the purposes of processing is deleted or corrected without delay.
8 Recipients of personal data (categories of recipients) and regular disclosures of data
Personal data is not disclosed to outside parties.
9 Transfer of data outside the EU or the EEA
Personal data in the register is not transferred outside the EU or the EEA.
10 Principles of protecting the register
Materials containing personal data are kept in locked premises that can be accessed only by named persons who are authorised to access them because of their duties.
The database containing personal data is on a server kept in a locked room that can be accessed only by named persons who are authorised to access it because of their duties. The server is protected by an appropriate firewall and technical protection.
The databases and systems can be accessed only with personal usernames and passwords that are granted separately. The data controller has limited the access rights and authorisations to the information systems and other storage platforms so that the data can be viewed and processed only by the persons who are necessary for its lawful processing. In addition, usage events in the databases and systems are recorded in the log data of the data controller's IT system.
The data controller's employees and other persons have committed to a duty of confidentiality and to keeping secret the information they receive in connection with processing personal data.
11 Rights of the data subject
The data subject has the following rights under the EU General Data Protection Regulation:
the right to obtain confirmation of the processing of data and access to the personal data
the right to withdraw consent
the right to rectification of data
the right to erasure of data
the right to restriction of processing
the right to have the data transferred to another data controller
the right to lodge a complaint with a supervisory authority
Requests concerning the exercise of the data subject's rights are addressed to the data controller's contact person mentioned in section 1.