Koulutus Invest Oy is responsible for the processing of personal data. In this privacy statement, we explain how we process and protect personal data when you use our website. We adhere to the current data protection legislation, including the General Data Protection Regulation (GDPR):

1. Purpose and Legal Basis of Personal Data Processing: We collect and process personal data only to the extent necessary for providing our services and conducting our business. Koulutus Invest Oy processes information about natural persons who have registered as users of the service. The data is processed for offering, developing, and maintaining the services chosen by the customer, as well as managing customer relationships. The information is also necessary for Koulutus Invest Oy's operational needs, such as implementing service processes, billing, reporting, and as guidance information. Data may also be processed for quality control, security, system maintenance and development, analysis, statistics, or market research to plan and develop Koulutus Invest Oy's business. The legal basis for data processing is primarily the fulfillment of the contract with the customer, but also the fulfillment of Koulutus Invest Oy's legal obligations (e.g., accounting law, payment services law), legitimate interests of Koulutus Invest Oy (e.g., market research, maintenance, and development, statistics, modeling, and analysis), or customer consent (e.g., electronic direct marketing, combining cookie data with customer information).

2. Data Processed in the Consumer Register and Storage Period: The consumer customer register contains the following mandatory information for adequate identification and service provision:

   • First and last names

   • Addresses

   • Phone number(s)

   • Email address

   • Date of birth

   Regarding payment services, information about payment transactions, such as paid invoices and payment instructions, is stored. This includes details like the invoice amount, allocation information, due date, payment date, and payment method information. Additionally, data necessary for customer identification and compliance with requirements to prevent money laundering and terrorist financing is collected. The register also stores choices made by the customer regarding direct marketing, as well as other necessary information for services, such as service activation and termination dates, and other payment-related details. Information generated from the use of services, such as data from various functional features like purchase functionalities, searches, and similar functions, may also be collected. A nickname may be stored in the register. To form target groups, cookie data, external classifications, and statistical information may also be stored. In mobile postcard and payment services, consents related to credit card payments are stored if the customer wishes. The credit card number is not stored by Koulutus Invest Oy in this context. Customer register information is retained for the duration of the contractual relationship. After termination of the contract, the content of services used by the customer is retained for 14 days before deletion.

3. Secure Data Transfer: With the customer's consent, target groups may be disclosed for marketing purposes to carefully selected partners of Posti for joint or independent direct marketing purposes. Personal data may be disclosed to fulfill the customer's chosen distribution method for delivering letters or other messages or shipments, and to implement services chosen by the customer with the customer's approval. If a customer, through the interface, enters into an agreement for a service offered by a third party in payment services, the necessary information about the customer for concluding the agreement may be disclosed to such a third party with the customer's approval. In services involving payment transactions, all necessary information about the customer, invoice, and payment may be disclosed to the invoicer or third parties participating in the payment transaction, such as banks, for the implementation of the payment and the identification of the customer and payment. Companies acting as subcontractors for Koulutus Invest Oy may also process customer register information. Due to the technical implementation of data processing, some data is physically located on servers or equipment of external subcontractors, where it is processed through technical connectivity. In these situations, the precondition for the transfer and transmission of data is that the parties receiving and processing the data have, if necessary, concluded an agreement with Koulutus Invest Oy containing standard clauses approved by the EU Commission, ensuring the lawful processing of data.

4. Rights of the Data Subject, Access to Own Data, Correction and Completion, Giving Restrictions on Use: The data subject has the right to information about the processing of their personal data, to review their own personal data, and to demand the correction of inaccurate or incorrect information and the completion of data. The data subject may request the deletion or transfer of personal data or request restrictions on processing. When processing is based on consent, the consent can be withdrawn at any time. Requests are processed on a case-by-case basis, as there may be limitations due to the situation and circumstances associated with the exercise of these rights. Every data subject has the right to lodge a complaint with the supervisory authority, especially in the member state where the data subject has their habitual residence or place of work, or where the alleged violation of the data protection regulation has occurred (in Finland, the Data Protection Ombudsman).