- Tilaa
- Kirjaudu
Data collection, register creation and the data controller
When a user orders products or services through the Johku-based platform, Johku collects anonymous monitoring data from the purchasing process. Personal data entered in the ordering process is stored in the My Johku register and a customer register restricted to the merchant. In the process in question, Aptual Commerce Oy serves as the data controller of the My Johku register and as processor of the data for the merchant’s customer register. The merchant, on the other hand, serves as the data controller for its own customer register.
The merchant may, if it so desires, collect more extensive monitoring data from the purchasing process in its own customer register in third-party systems, by introducing third-party services and/or applications that can be connected to Johku, or by transferring information as raw data outside Johku. The principles that the merchant complies with when using the data must be clearly explained in the merchant’s own privacy statement.
What data we process, why and for how long
We basically aim to minimise the volume of data to be processed in all Johku’s processes. We only collect data that is essential for the successful formation, analysis and development of commerce processes, and in order to manage the customer-/contractual relationship.
The My Johku service makes personal data processing transparent
We collect and process the following information about all users who order from the Johku platform: First name and surname, street address, postcode, town, country, telephone number, e-mail address, personal ID (only when the user buys from the merchant on credit, e.g. invoicing payment method), order history from different Johku merchants, source page of order, IP address, acceptance of opt-in for conditions, consent for opt-in for direct marketing. For customers that are companies and organisations, the following are also collected: company name, business ID, e-invoicing address, e-invoicing operator code, reference and mark. In addition to these, we also collect and process other data related to the ordering process.
We collect and process the above-mentioned data for the following purposes:
- Centralised management of the registered data of users and technical enabling of the rights of the data subject accordant with GDPR (checking, correction, the right to be forgotten, limitation, the right to transfer data from one system to another)
- User-centred management of electronic marketing authorisations and other merchant-specific services
- Transactions that are made using My Johku codes, such as the pre-filling in of ordering information on the order form at Johku stores
- Communication concerning the My Johku service and management of customer relations
- Production, provision, development, improvement and protection of the My Johku service
- User-specific and user-centred personalisation of the Johku service
- Analysis and statistics concerning the use of Johku
- Development, analysis, grouping and statistics of customer relationships
- Prevention and investigation of malpractice
- Other similar purposes
We operate on the conditions of the user
My Johku has been created to give the user more power in the electronic management of his/her personal data concerning his/her own transactions.
The basis of the processing of all user data is an agreement, which is created when ordering products and/or services from different merchants. Insofar as the data is used in electronic marketing, processing is based on consent.
Personal data concerning data subjects is mainly collected from the data subjects themselves by electronic means when they do business with and with the help of Johku.
Time for storing data
Data is stored for as long as there is a valid agreement and/or consent between the user and Johku.
Data may be stored for longer insofar as this is necessary to fulfil obligations set in valid legislation such as responsibilities concerning bookkeeping, and to demonstrate that they have been appropriately fulfilled.
Data disclosure and data transfer
Data collected in My Johku is expressly for the use of Johku.
With the consent of the user, data may be disclosed to our partners or other merchants (e.g. for publication to other Johku merchants through a sales channel). Primarily, the disclosure of data may only take place for purposes that are not in conflict with Johku's data protection principles.
Data may also be disclosed to buyers in connection with corporate transactions, if Johku sells or otherwise reorganises its business.
Data may be transferred to partners and/or subcontractors selected by the data controller, that process data on behalf of the data controller based on an agreement between the parties. In that case, the data processor does not have the right to process the transferred data on its own behalf.
Data may not be transferred outside of the European Union or the European Economic Area unless this is necessary in terms of the purposes of processing the above-mentioned personal data or of the technical execution of the data processing. Johku keeps a list of its partners and subcontractors, which also shows the location of the party in question and the principles concerning data protection used in the transfer of data.
Safety, protection and risks
Complete data can only be accessed by the personnel of the data controller. All members of personnel are bound by a valid non-disclosure agreement.
Johku is located in a server environment under the express control of Aptual Commerce Oy, which is isolated from other servers. The server environment is protected by firewall, and access to remote management is strictly limited to certain personnel through a secure connection. There are no other services in the same server environment. The server environment is in the extremely reliable and highly secure Amazon EC2 cloud, which is physically located in Ireland (EU).
The latest, data-secure software versions are used in the server environment. All browser traffic goes through an encrypted HTTPS connection (Johku.com has an A+ SSL-rating)
All data is protected from unauthorised access and accidental or illegal data destruction, modification, disclosure, transfer or other illegal processing.
Rights of the data subject
Johku communicates with the user through the My Johku service whenever his/her personal data is being processed. A message coming from the service always contains information about the data controller carrying out the processing and a link to the My Johku service.
In My Johku, a user may check data saved about him/herself and, if necessary, make corrections to it. The service also has a function by which the user can download the data in a structured format for transfer from one system to another. You can access the My Johku service at any time at the address johku.com/customer
My Johku also offers users the chance to terminate their My Johku agreement and to delete data from My Johku. If the user stops using My Johku and terminates his/her agreement with Johku, all automatic functions concerning the management of his/her data will cease and Johku’s possibilities to work for the benefit of the user in relation to the merchant will disappear. Once the agreement has ended, the user must manage his/her own data (checking, correction, the right to be forgotten, limitation, the right to transfer data from one system to another) in writing directly with the merchant keeping the register.
Under no circumstances does Johku use profiling and automatic decision-making based on it.
The use of the My Johku service is free of charge.
