Touhula's customer register's privacy statement

1. Controller

Touhula Leikki Oy and companies in the same group (“Touhula”) process personal data to manage customer relationships, enable customer communication, implement agreements and carry out direct marketing. We also collect analytics on visitors to our website.

Touhula not only has private customers but also works with organisations and partners, whose representatives’ personal data may be processed as part of this data file. Data about organisations’ representatives are only used for communication and marketing to the organisation.

It is important for us in Touhula that you know how we process your personal data. See below to find out how we process your personal data. Please note that this Privacy Statement only applies to the processing of personal data performed by Touhula as the controller.

2. Contact details

Controller’s contact details:

Business ID: 2334458-6
Address: Kiviharjunlenkki 1 E, 90220 Oulu
Email: tietosuoja@touhula.fi
www.touhula.fi

Person in charge of the data file:
Mikko Peltoniemi

3. Data collected

Customers and marketing contacts

  • Child’s name, personal identity code, address
  • Guardian’s name, personal identity code, address, email address, telephone number
  • Application data and service need
  • Data on customer payment and determining the payment amount
  • Daily entries about the service and other data necessary to organising early childhood education
  • Content produced by the data subjects themselves and any additional information about the service (persons authorised to pick up a child, allergies, photography permission, etc.)
  • The child’s profile photo, data concerning the child’s daily activities and communication between home and the controller when using TouGo mobile application

Website

  • IP address
  • URL route on the website
  • Time of visit
  • Browser type and version
  • Device type
  • Name and email address of person who ordered the newsletter from the website

4. How do we obtain personal data?

As a rule, we receive the information referred to in this Privacy Statement from the data subjects themselves or their guardians.

Data collected from visited websites is stored on the server during the visit. Data collected with the mobile application is stored in a separate database.

Personal data and data about the families is obtained primarily either through an electronic application or appointment booking from the child’s guardians or the child’s domicile’s early education service counsellor. The data is supplemented by data provided by the guardians. Data on service implementation is created during the customer relationship, and entered by the daycare centre staff. If an application for early childhood education is sent by the municipality, the service provider will receive personal and family data from the municipality’s early childhood education service counsellor.

You can now send feedback anonymously or in your own name via the Touhula daycare centres’ websites.  You can also do business through a chatbot that collects customer contacts. The contacts may provide customer data (name and contact details) in support of customer service. Chatbot threads and feedback are recorded.

5. Grounds and purpose of data processing

Personal data processing is, as a rule, based on early childhood education legislation. Personal data is also processed in order to fulfil obligations specified in the care contract and for processing that requires separate permission, such as taking photographs of children, on the basis of the customer’s express consent.

Touhula’s legitimate interests serve as the grounds for processing personal data when we need to do so in order to manage or develop our business operations on the basis of messages arriving via e.g. chat and the feedback channel, or when, via direct marketing, we provide our customers or potential customers with information and offers on our services. We do not profile underage children or approach them through marketing communications.

When considering our legitimate interests with regard to activities such as direct marketing measures or processing customer feedback, we weigh up the benefits and possible harm to customers in every case. We also minimize the amount of identifiable personal data involved.

You have the right to object to data processing based on our legitimate interests.

Personal data can be used for the following:

Service provision or fulfilment of contractual relationship

  • Fulfilment of requirements set by early childhood education legislation
  • Appointment booking service and customer service
  • Service provision and implementation
  • Service communication and reminders
  • Customer invoicing
  • Collection and analysis of early childhood education statistics
  • Collection and processing of customer feedback and customer satisfaction data
  • Controller’s business development and the related customer service development and direct marketing

Processing tasks can be outsourced to Touhula group companies and/or external service providers in accordance with and within the limits of data protection legislation.

Customer communication and customer relationship management

Personal data is used for management and care, maintenance and development and communication with regard to the customer relationship between Touhula and Customer.

If you contact us, we will use data we have been given to answer any questions and to solve problems and process your message.

Direct marketing purposes

We may send you direct marketing material on Touhula’s operations, presentations etc.

Data subjects always have the right to prevent us from using their personal data for direct marketing, market research or profiling, by contacting us using the above contact details or by choosing the cancellation option made available in direct marketing messages and bulletins.

6. Storage period

We will store personal data only as long as the law requires or as it is necessary to implement the purposes specified above.

7. Transfer of personal data outside the European Economic Area

Personal data will not be transferred outside the European Economic Area.

8. Categories of recipients of personal data

Early childhood education data is primarily confidential. Personal data will only be disclosed, on the basis of a specific information request, to authorities with the appropriate authorisation on the basis of early childhood education legislation. Persons processing data are bound by confidentiality that extends beyond the customer and care relationship. If early childhood education is provided by means of a service voucher, the municipality will have ownership of any created documents, and at the end of the customer relationship, the documents will be delivered to the municipality for archival. Data will be transferred to Kela of customers who have begun a care relationship, so long as the service is provided under Kela’s private care allowance. The municipality and/or Kela supervising the service will be responsible, on their part, for the maintenance of the data file created.

We will not disclose your personal data to parties outside the Touhula organisation, except in the following cases:

For legal reasons

We may disclose personal data to parties outside the Touhula organisation if access to personal data is considered necessary within reason in order to (I) conform to a law, regulation or court ruling; (II) detect, prevent or otherwise process fraud, money laundering, terrorism funding, or data security and IT problems; or (III) protect the property or safety of property belonging to Touhula or our customers, or to ensure the common good as specified by law.

To authorised service providers

We can disclose personal data to authorised service providers that provide services to us. Our agreements with our service providers contain commitments according to which the service providers are committed to restrict their use of personal data and to follow at least the privacy and data security standards within this Privacy Statement.

With your specific consent

We can disclose personal data to third parties outside the Touhula organisation for other than the above reasons if we have the data subject’s specific consent to do so. Data subjects have the right to withdraw their consent at any time.

9. Rights of the data subject

Right of access by the data subject

Data subjects have the right to access their personal data processed by Touhula. You may contact us to find out what personal data we process and for what purpose it is used.

Right to have data corrected

You have the right to request us to correct or supplement any incorrect, inaccurate, inadequate, outdated or unnecessary personal data that we store. By contacting us, you can, for example, update your contact details and other personal data.

Right to have data erased

You can ask us to erase your personal data. We will do what you ask as long as we do not have a justified reason not to erase it.

Right to object and right to restrict processing

You have the right to object to the processing and profiling of your data if your data is processed for direct marketing purposes. You also have the right to restrict the processing of your personal data if, for example, your data is incorrect. You also have the right, in certain specific situations, to restrict the processing of your personal data if the reason for it is a personal special situation.

Right to data portability

Data subjects have the right to obtain their personal data from us in an organised and generally used format, and to independently transfer such data to a third party.

Exercise of rights

If you want to exercise any of the above rights, please contact Touhula by letter or email, giving us the following information: name, address, telephone number and a copy of your valid ID card. We may ask you for additional documentation in order to prove your identity.

We may disregard requests that are made unreasonably often, are excessive or clearly unfounded.

10. Data security

We have carried out administrative, organisational, technical and physical protective measures to protect personal data we have collected and processed. These measures are designed to maintain an appropriate level in terms of data confidentiality, integrity and availability.

Personal data can only be processed by persons for whom processing is justified on the basis of their duties. Personal data use has been protected with the appropriate user-specific identifiers, passwords and user rights.

11. Filing a complaint

You have the right to file a complaint with the supervisory authority if you consider that Touhula’s personal data processing has been in breach of data protection legislation.

12. Changing the statement

Touhula reserves the right to change this Statement. We will notify of the changes on our website, where you will also find the latest version of this Statement.