1. Data controller
Not Bad Security Oy
Business ID: 3260076-4
P.O. Box 66, 00101 Helsinki, Finland
2. Contact details for matters concerning the register
Not Bad Security Oy
P.O. Box 66, 00101 Helsinki, Finland
+358 10 200 7520
hello@notbadsecurity.com
3. Name of the register
Not Bad Security's customer and marketing register.
4. Legal basis and purpose of processing personal data
- The purpose of processing personal data is communicating with customers, maintaining customer relationships and stakeholder communications.
- The legal basis for processing personal data is the controller's legitimate interest in communicating with its customers.
- The data may also be used for marketing if the customer has given their consent to it.
- The data is not used for automated decision-making or profiling.
5. Data content of the register
The data stored in the register includes: the person's name, position, company/organisation, contact details (phone number, email address), website addresses, the IP address of the network connection, usernames/profiles in social media services, information about ordered services and changes to them, billing information, and other information related to the customer relationship and ordered services.
6. Regular sources of data
The data stored in the register is obtained from the customer through, among other things, messages sent via web forms, by email, by phone, through social media services, from contracts, from customer meetings and from other situations in which the customer discloses their information.
Data on the contact persons of companies and other organisations may also be collected from public sources such as websites, directory services and other companies.
7. Regular disclosures of data and transfers of data outside the EU or EEA
Data is not regularly disclosed to other parties. Data may be transferred for billing or accounting, or to the extent otherwise required for maintaining the customer relationship, and data may also be published to the extent agreed with the customer. We may also partly outsource the processing of personal data to a third party, in which case we ensure through contractual arrangements that personal data is processed in accordance with applicable data protection legislation and otherwise appropriately.
8. Principles of register security
The register is handled with care, and data processed in information systems is appropriately protected. When register data is stored on Internet servers, the physical and digital security of their hardware is properly taken care of. The controller ensures that stored data, as well as server access rights and other information critical to the security of personal data, is handled confidentially and only by those employees whose job description includes it.
9. Right of access and right to request rectification
Every person in the register has the right to check the data stored about them in the register and to request the correction of any inaccurate data or the completion of any incomplete data. If a person wishes to check the data stored about them or request its rectification, the request must be sent in writing to the controller. The controller may, if necessary, ask the person making the request to prove their identity. The controller will respond to the customer within the time limit set out in the EU General Data Protection Regulation (as a rule, within one month).
10. Other rights related to the processing of personal data
A person in the register has the right to request the erasure of their personal data from the register ("right to be forgotten"). Data subjects also have the other rights under the EU General Data Protection Regulation, such as the restriction of the processing of personal data in certain situations. Requests must be sent in writing to the controller. The controller may, if necessary, ask the person making the request to prove their identity. The controller will respond to the customer within the time limit set out in the EU General Data Protection Regulation (as a rule, within one month).