Privacy policy
Personal and business customer representatives
24 Center Oy, 1.10.2025
This is a statement on the processing of personal data in accordance with the EU General Data Protection Regulation (679/2016).
Controller
24 Center Oy
Business ID: 2774786-8
Address: Robert Huberintie 3 B, 01510 VANTAA
Contacts on data protection issues
Eero Väänänen (CTO)
tel. +358400932062
[email protected]
In all matters relating to the processing of personal data and in situations where the data subject wishes to exercise his or her rights, he or she is invited to contact the contact person mentioned above.
Purpose and ground for processing
The legal basis for the processing of personal data is:
- Contractual relationship between the data subject and the controller
- Legitimate interest of the controller based on the customer relationship between the data subject and the controller
- Consent of the data subject to the processing of personal data
The purposes of processing personal data include providing services, maintaining customer relationships and partnerships, and marketing (with the consent of the data subject).
Personal data processed
The controller only collects personal data from data subjects that are relevant and necessary for the purposes of use described in this Privacy Policy.
The following information about registered customers is processed:
Customer contact details
Name, telephone number, e-mail address, address, coordinates if any, company name and business ID, contact details of business customer representatives (name, position, e-mail, telephone number)
Identification and billing information
Personal identification number, date of birth, billing addresses (postal address, email address and e-invoice address), account number, tax information (e.g. household deduction information), billing references
Information related to customer orders
Description and instructions of the destination (e.g. location, floor code, registration number, recipient details), content of the order, type of service and price, order status, timestamps and processing steps
Information related to communication
Telephone recordings, chat messages, email messages, message logs, customer and partner feedback, complaints, customer satisfaction data, loyalty programme data, marketing sources (e.g. campaigns, website, search engines)
Technical and system information
User IDs, identifiers, timestamps for integrations and data transfers (e.g. HubSpot, Tracklution), data publishing and forwarding, log data, identifiers used in customer and partner systems, attachments (e.g. contracts, reports, invoices, order confirmations)
Disclosure of personal data
As a general rule, personal data will not be disclosed to third parties without the consent of the data subject. However, data may be disclosed to the following categories of recipients:
- Service providers and subcontractors who provide 24 Center Ltd with IT services, customer communications, financial management, marketing and other support services (e.g. accounting and billing services, website and information systems maintenance, communication and SMS services).
- The partners to whom the customer's order is passed to provide the service (e.g. installers and contractors). The partners will only receive the information necessary to carry out the order.
- Authorities and other bodies to which 24 Center Ltd is legally obliged to disclose information (e.g. tax authorities, police or courts).
A data processing agreement has been concluded with all partners and service providers that process personal data, which ensures that personal data is processed only in accordance with the instructions of 24 Center Ltd and in the manner required by the GDPR.
Personal data is not regularly transferred outside the EU or EEA. If the transfer is necessary (e.g. via a technical service provider), the controller will ensure appropriate safeguards (such as EU standard contractual clauses).
Protection of personal data
The controller processes personal data in a manner designed to ensure appropriate security of personal data, including protection against unauthorised processing and accidental loss, destruction or damage.
The controller will use appropriate technical and organisational safeguards to ensure this objective, including the use of firewalls, encryption techniques and secure equipment rooms, appropriate access control, careful management of user IDs for information systems and training of staff involved in the processing of personal data.
All employees who process personal data are bound by the Employment Contracts Act (55/2001) and the supplementary confidentiality agreements on matters relating to the processing of data subjects' personal data.
Data retention period
The controller processes personal data for the time necessary for the performance of the contractual service and for the duration of the customer relationship. The customer relationship begins with a one-time customer when the customer orders a service from 24 Center Ltd and ends at the request of the customer or 24 Center Ltd. For a contract customer, the customer relationship is for the duration of the contract.
After the end of the customer relationship, the personal data will be deleted or made anonymous in accordance with the controller's deletion processes within 1 month at the latest, unless there is another legal basis for their retention.
Legislation (e.g. the Accounting Act and tax obligations) requires that personal data relating to invoicing, payments and contracts can be kept for a maximum of 6-10 years after the creation of the document.
If the data subject has given his or her consent to the use of his or her data for marketing purposes, the data may be kept for up to 10 years from the date of receipt, unless the data subject withdraws his or her consent before that time.
The controller may also archive data to fulfil customer service and legal obligations. Archiving is carried out in such a way that access to the data is limited and appropriately protected.
The controller will check annually that there is a valid ground for the retention of personal data and delete data that are no longer needed. Data subjects have the right to request the erasure of their data if there is no other lawful basis for processing them.
Profiling
The processing of personal data includes profiling. Profiling is the automated processing of personal data, which uses the data to evaluate certain personal aspects relating to the data subject. Data subjects are profiled in order to better target direct marketing and other communications to them according to their interests.
Rights of the data subject
Right of access to personal data
The data subject has the right to obtain confirmation as to whether personal data concerning him or her are being processed and, if so, to obtain a copy of his or her personal data.
Right to rectification
The data subject has the right to request that inaccurate or incorrect personal data concerning him or her be corrected. The data subject also has the right to have incomplete personal data completed by providing the necessary additional information.
Right to erasure
The data subject has the right to request the erasure of personal data concerning him or her if.
a. the personal data are no longer necessary for the purposes for which they were collected; or
b. the personal data have been unlawfully processed.
Right to restriction of processing
The data subject has the right to restrict the processing of personal data concerning him or her if.
a. the data subject contests the accuracy of his or her personal data;
b. the processing is unlawful and the data subject objects to the erasure of his or her personal data and requests instead the restriction of their use; or
c. the controller no longer needs the personal data for the purposes for which they were originally processed, but the data subject needs them for the establishment, exercise or defence of legal claims.
Right to object
The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her.
The controller shall no longer process the personal data of the data subject, unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, including profiling where it relates to such direct marketing.
The right not to be subject to automated decisions
The data subject has the right not to be subject to a decision based solely on automated processing, such as profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
The above shall not apply if the decision is necessary for the conclusion or performance of a contract between the data subject and the controller or is based on the data subject's explicit consent.
The right to transfer data from one system to another
The data subject has the right to receive personal data concerning him or her and provided by him or her in a structured, commonly used and machine-readable format and the right to transmit such data to another controller.
Right to lodge a complaint with a supervisory authority
The national supervisory authority for personal data matters is the Office of the Data Protection Ombudsman, attached to the Ministry of Justice. You have the right to refer your case to the supervisory authority if you consider that the processing of personal data concerning you infringes the relevant legislation.
Changes to the privacy policy
The controller is constantly evolving and may need to change and update its privacy practices as necessary. Changes may also be based on changes in data protection legislation.
If the changes involve new purposes for the processing of personal data or otherwise change significantly, the controller will give prior notice and, if necessary, request consent.