Privacy Policy
This privacy policy explains how HOP IN Oy (Business ID 3355387-5) processes personal data, what personal data the company collects, for what purposes the data is used, to whom the data may be disclosed, and how the data subject can influence the processing. This privacy policy complies with the EU General Data Protection Regulation (GDPR).
We reserve the right to make changes and updates to this privacy policy.
1. Contact Information
Data Controller
HOP IN Oy (3355387-5)
Contact Person or Data Protection Officer
Name: Janne Leppänen
Email: janne.leppanen@hop-in.fi
2. Processing of Personal Data and Purpose
2.1. Legal basis for processing personal data
We process your personal data always lawfully, fairly, and transparently. We collect and process data about you only when we have a legal basis to do so. Personal data processing is based on statutory obligations. We collect and use your data only if:
You have given us consent to use the data for a specific purpose
It is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract
It fulfills a legitimate interest (not overridden by your data protection interests), such as preventing abuse, statistical and research work, or protecting our legal rights and interests
3. Purpose and Legal Basis for Processing Personal Data
3.1. We collect and process personal data for the following purposes:
Customer relationships
Customer service
Customer communication
Maintenance of customer and partnership relations
Contractual relationships
Marketing purposes
Targeted marketing to customers and potential customers
Organizing events
Research
Statistics
Reservations and orders of products and/or services
Production, maintenance, development, and quality assurance of services/products
Ensuring security and preventing and investigating abuses
Risk management and abuse prevention
Compliance with legal obligations
Business planning and product development
Usage monitoring
3.2. Personal data is collected from:
The individual or company providing the data
3.3. The company processes the following data:
Personal or company information
Contact information
Billing and payment details
Data related to the customer relationship
Contract information
Product and order information
Customer feedback
Contacts and communications
Complaints
Marketing consents
Data related to online behavior
4. Regular Disclosures and Transfers of Data
4.1. We ensure care and data security in storage and processing through firewalls, passwords, and various commonly accepted technical methods. Manually maintained materials are kept in locked premises with restricted access. Data storage and processing are conducted via trusted service providers. Data is protected by strictly limited access rights and processed only for the purposes for which it was collected. All personal data is handled confidentially.
4.2. As a general rule, we do not disclose or transfer data to third parties without explicit consent. Exceptions may occur due to legal obligations or authorities’ requirements, assessed case-by-case. Another exception may be data disclosure based on contractual relationships with service providers or subcontractors who process data for service execution. In such cases, proper and lawful data handling is ensured by agreements and, if necessary, confidentiality agreements.
4.3. Data is not transferred outside the EU or EEA.
5. Retention of Personal Data
5.1. Personal data is retained for the duration of the customer relationship plus 30 days thereafter. After this period, data is deleted. Data may also be deleted upon the customer’s request after the end of the relationship. Data is retained for 30 days after the relationship to allow for potential complaint handling. We reserve the right to notify separately of shorter or longer retention periods.
5.2. We do not use personal data for automated decision-making.
6. Data Subject Rights
6.1. The data subject has the right to access their data and review it. Requests may be made in writing or electronically.
6.2. Correction and deletion
The data subject has the right to request correction of incorrect or incomplete data and request deletion.
6.3. Data review
The data controller actively ensures the removal, correction, and completion of inaccurate, unnecessary, incomplete, or outdated personal data in relation to the processing purpose.
6.4. Data transfer
The data subject has the right to request the transfer of their data to another data controller and to request restriction of processing in certain situations.
6.5. Objection to processing
The data subject has the right to object to the processing of their data for certain purposes and to prohibit the disclosure and processing of their data for direct marketing.
6.6. Withdrawal of consent
If the processing is based on consent, the data subject has the right to withdraw consent at any time without affecting the legality of prior processing.
6.7. Right to lodge a complaint
If the data subject believes that the processing of their personal data violates the GDPR or national data protection laws, they have the right to file a complaint with the supervisory authority.
6.8. Requests regarding data subject rights
All requests to exercise data subject rights must be made in writing and addressed to the data protection officer. Identity will be verified prior to data disclosure. Requests are handled within a reasonable time and as soon as possible after receipt. If a request is denied, the data subject will be informed in writing.
Last updated January 31, 2025