updated 11 August 2024
Data Controller
Koulutustukku / Nordic Competence Group Oy, Business ID: 2251720-3
Contact Person for Registry Matters
Data Protection Officer
Nordic Competence Group
info@competencegroup.fi
Name of the Register
Koulutustukku.fi Customer Register
Purpose of Personal Data Processing
The processing of personal data is based on the legitimate interest of the Data Controller.
The purpose of processing personal data is to manage the customer relationship, fulfill the rights and obligations of the customer and the Data Controller, administer customer orders, provide services, maintain the customer register, maintain customer qualification data, archive and process data, and otherwise manage the customer relationship.
The data may be used to develop the company’s operations, for statistical purposes, and to produce more personalized targeted content and targeted advertising. Personal data is processed within the limits permitted and required by data protection legislation.
Data Content of the Register
The personal register may contain the following information:
- Identification Data
- Name Information
- Contact Information, such as delivery address, billing address, email address, phone number
- Information used for identification and registration of qualifications, such as date of birth or personal identity code
- Payment information, including credit agreements and other billing information.
- Photo ID image
- Customer Relationship Information
- Registration and participation information for training courses and events
- Training information, management of training courses and qualifications
- Purchase history
- Contact history
- Company related to the customer relationship and the position, role, and function in that organization
- Any agreements
- Product reviews submitted
- Notes and memos related to the customer relationship
- Service usage data
- Permissions and consents
- Information on marketing consents and prohibitions
- Identifiers used for marketing targeting
- Customer segmentation data and other data derived through analytics
- Cookie data
- Log data
- Session identifiers
- IP addresses
- Payment information and payment processing data
- Responses to customer feedback surveys when not submitted anonymously
- User credentials for digital services managed by Koulutustukku
- Log data on user activity in digital services managed by Koulutustukku
Regular Data Sources
Personal data is obtained from the customer themselves through orders placed by the customer in the online store, via web forms, by phone, by email, or in connection with training courses.
Information is obtained from registrations made by the customer and from notifications made by the customer during the customer relationship. Updates to name and contact information are also obtained from authorities and companies providing update services. Information may also be obtained from subcontractors related to the use or provision of the service.
Personal data may also be supplemented from other services managed, collected, or purchased by the company that process personal data.
Regular Disclosure of Data
Customer register data is only for the company’s use, except when using an external service provider either to produce a value-added service or to support a credit decision.
The Data Controller may disclose information within the limits permitted and required by applicable legislation, including to the Data Controller’s selected partners for marketing purposes, unless the Data Subject has prohibited such disclosure of their information.
Information is disclosed outside the Data Controller or to its partners only in matters related to organizing training courses, maintaining qualifications and completion records, credit applications, debt collection, or billing, and when required by legislation.
Regular disclosures of data are made to the following systems in connection with organizing training courses and maintaining qualifications and completion records:
- Participants in first aid training according to the Red Cross training programme are registered in the Competence Admin system of Punainen Risti Ensiapu Oy.
- Participants in continuing professional competence training for truck, bus, and taxi drivers are registered in the Traficom system.
- Participants in Occupational Safety Card training are registered in the registration system of the Finnish Centre for Occupational Safety. Please review the updated Privacy Policy for Occupational Safety Competence Training by the Finnish Centre for Occupational Safety from December 2024 here.
- Participants in Hot Work Permit training are registered in the SPEK registration system.
- Personal data may also be disclosed within the limits permitted and required by applicable legislation to a court, the police, or enforcement authorities.
Transfer of Data Outside the EU or EEA
Data is not transferred outside the EU/EEA area.
Use of Cookies and Other Technologies
Koulutustukku uses cookies and other similar technologies on its website to implement and develop services. Cookies ensure the security, efficiency, and user-friendliness of the service.
The use of cookies can be declined when arriving at the website when consent for cookie use is requested, or later through browser settings. Please note, however, that cookies may be necessary for the proper functioning of some pages and services maintained by Koulutustukku. Therefore, we cannot guarantee the functionality of all services if the cookie function is disabled.
Koulutustukku’s website uses Google software for user tracking, provided by Google Inc. More information about Google Analytics tracking is available on Google’s privacy page. Google Analytics tracking can be disabled at http://tools.google.com/dlpage/gaoptout.
We also use Leadoo user tracking on our website, through which collected data is combined with information gathered, for example, through chat interactions. This tracking is based on ETag tracking, which differs from cookie-based tracking by combining data from multiple user sessions. If you do not want your data to be tracked, you can clear your browser cache. More information about Leadoo user tracking is available at https://leadoo.com/privacy-policy/ and https://leadoo.com/privacy-policy-processes/
Koulutustukku’s website contains links to social media channels. These links lead to third-party sites that may collect personal data from users visiting the site and whose privacy principles may not correspond to the principles of personal data processing described in this Privacy Policy.
Retention Period for Personal Data
The Data Subject may also request the deletion of their data from the register. The Data Subject’s personal data will be deleted at the user’s request, unless legislation, regulatory requirements, guidelines from training governing bodies, outstanding invoices, or debt collection proceedings prevent the deletion of the data.
The personal identity code is deleted from the register no later than upon expiry of the qualification arising from the training.
Principles of Register Protection
Personal data in the register is kept confidential. The data security and availability of personal data processing is ensured by appropriate technical and administrative measures. Personal data is protected from unauthorized access and from unlawful or accidental data processing. The network and equipment on which the register is located is protected by a firewall and other necessary technical measures.
Right of Access
The Data Subject has the right to inspect the data concerning them in the customer register. A signed written access request must be sent to the person responsible for registry matters. The customer must provide the customer’s basic information necessary for locating the data in the access request. The Data Controller will send a copy of the customer’s personal data to the customer by post. If the customer requests multiple copies or more than once a year, the Data Controller may charge a reasonable fee based on administrative costs. Access requests will be responded to within a reasonable time as quickly as possible.
Correction of Data
A request to correct data must be made in writing and submitted to the person responsible for registry matters. The customer must provide the customer’s basic information necessary for locating the data in the data correction request.
Consents and Prohibitions
The customer may give the Data Controller consents for direct marketing in accordance with Section 200 of the Information Society Code or prohibit the Data Controller from processing data concerning them for direct marketing purposes.
The customer has the option to prohibit direct marketing in different channels. If the customer does not give any consents and sets all possible prohibitions, only customer relationship communications necessary for the implementation of the Data Controller’s services and the management of the customer relationship will be sent to the customer.
The customer may provide and maintain consents and prohibitions by contacting Koulutustukku customer service or the Data Controller in writing. In this context, the customer’s basic information necessary for customer identification must be provided.
Changes to the register will be made no later than one month from the notification.
Changes to This Privacy Policy
The Data Controller reserves the right to update and modify this Privacy Policy. Changes will not necessarily be notified separately to the Data Subject or customer. For this reason, the Data Controller encourages customers to periodically review this Privacy Policy for any changes.