Data Controllers
This notice describes the processing of personal data by companies belonging to the City Digital Group. The companies listed below are data controllers. The services to which this notice applies are listed at https://www.citydigital.fi/en/brands/.
City Digital Oy (Business ID: 2110789-4)
Online Technology Group Oy (Business ID: 3104918-1)
TableOnline Finland Oy (Business ID: 2349007-3)
EatAndTheCity Oy (Business ID: 2716427-5)
Ratkojat Oy (Business ID: 2685586-7)
Obesus Oy (Business ID: 2114776-5)
Address: Sturenkatu 16, FI-00510 Helsinki, Finland
Person responsible for data protection matters and the register: Niko Jokinen, [email protected]
What Do We Mean by the Different Terms?
In this notice, we use the terms personal data, data subject, customer, prospective customer, and stakeholder.
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter the “data subject”), such as a name, address, or telephone number. An identifiable natural person is a person whom we can identify, directly or indirectly, on the basis of various pieces of information relating to that person.
“Data subject” means the person whose personal data we process.
“Customer” means consumers and the contact persons of companies and other organizations (hereinafter a “company”) with whom we have a customer relationship.
“Prospective customers” means consumers and company contact persons with whom we seek to establish a customer relationship.
“Data Controller” means the companies identified at the beginning of this Privacy Notice.
“Stakeholders” means consumers and company contact persons with whom we have a cooperative relationship (for example, representatives of companies that provide services to us) or another connection (such as public decision-makers in connection with public affairs activities).
For What Purposes Is My Personal Data Processed?
We process personal data for the delivery of products and services; customer communications; the management, development, and analysis of customer and stakeholder relationships; sales and marketing (of both our own and, in some cases, third-party products and services); and the development of products and services.
We process data subjects’ personal data for the following purposes, one or more of which may apply simultaneously:
Delivery of Products and Services
We may process your personal data to deliver products and services if, for example, you or the company you represent has purchased a product or service from us, registered to use our digital services, subscribed to receive our content by email, or participated in our events.
Personal data is used to exercise rights and fulfil obligations arising from a contract or other commitment.
Customer Communications
We may use your personal data in our customer communications, for example, to send you notices and change notifications relating to products and services and to request feedback.
Management, Development, and Analysis of Customer and Stakeholder Relationships
We may use your personal data to manage, develop, and analyze the customer or stakeholder relationship established with you.
Marketing
We may contact you to tell you about new products, services, or benefits. We may also disclose your contact details to our partners for marketing purposes. Further information about such disclosures is provided in the section “With Whom May My Personal Data Be Shared?” of this Privacy Notice.
We may use your personal data to provide relevant content and tailor our offering. For example, we may provide recommendations or display tailored content and advertisements in our own services and those of third parties.
Development of Products and Services
We may use your personal data to develop our products and services, for example, to improve our product range and content.
Exercise of Other Rights and Fulfilment of Other Obligations
We may use your data, for example, to fulfil accounting obligations, collect receivables, or establish, exercise, or defend legal claims.
On What Grounds Is My Personal Data Processed?
We process personal data on the basis of consent, for the performance of a contract or compliance with a legal obligation, or on the basis of legitimate interests.
The legal grounds for processing personal data are the following provisions of Article 6 of the EU General Data Protection Regulation:
- you have given your consent to the processing of your personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request before entering into a contract;
- processing is necessary for compliance with a legal obligation to which the Data Controller is subject; and
- processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms requiring the protection of personal data.
For example, when you start using a digital service provided by us, we process your personal data to perform the contract. We cannot provide our services as requested, process orders, enable access to a digital account, verify customer transactions, communicate about matters relating to the contract, provide technical support, or invoice for our services without processing personal data.
We and our partners have legitimate interests relating to the conduct of business, such as the right to promote the sale of products and services through marketing and sales. On the basis of legitimate interests, we may, among other things, conduct direct marketing and sales using your contact details, including processing personal data for profiling. Other legitimate interests on the basis of which your personal data may be processed include advice and other customer service for non-customers, further development of our business, and the prevention and investigation of possible misuse. We consider these purposes necessary for our business and justified by the relevant relationship between you and the Data Controller, and therefore in accordance with our legitimate interests. Taking into account the nature of the data processed, the purposes of use, and the relationship between you and the Data Controller, we consider that the processing does not conflict with the data subject’s fundamental rights or freedoms. You may object at any time to processing based on legitimate interests.
If the processing of data is not based on a contract or legitimate interests, we may ask for your consent to other types of personal data processing. For example, direct marketing through electronic channels requires your consent in certain situations. Please note, however, that not all direct marketing activities require consent. You may also object to direct marketing or withdraw the related consent in accordance with the instructions we provide. The processing of special categories of personal data—such as racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, and/or data concerning sexual behavior or sexual orientation—in, for example, the E-kontakti service is also based on your consent.
We may also process your personal data where required by law, for example, as required by the Accounting Act.
What Types of Data About Me Are Processed?
We process basic information such as your name, contact details, and direct marketing preferences; order information such as order history; customer communications; and use of digital services. We also process additional information about company representatives and information relating to participation in our events.
The personal data we collect may include, among other things, the following types of information and any changes made to it:
- Basic information
- first and last name
- contact details (postal address, email address, telephone numbers)
- gender
- date of birth
- language (Finnish, Swedish, other)
- direct marketing preferences
- communications directed to the data subject and related activity
- recordings of customer service calls and email and online conversations relating to customer service, including conversations on social media channels
- Additional information about persons who have purchased the Data Controller’s products or services or registered as users of them
- the time and manner in which the customer relationship or a comparable relationship began and ended
- campaigns directed at the customer and their use
- information about which email addresses receive messages, which emails are opened, and which links in emails are clicked
- information relating to purchases and payments
- interests and other information reported by the customer
- the content of feedback and complaints, related correspondence, and follow-up measures
- usernames for digital services
- information about the use of digital services
- information about cookies and other similar technologies sent to the data subject’s terminal devices (such as computers and mobile devices), and data collected through them, where the person can be identified on the basis of such information (for example, information about how advertisements displayed on our websites are clicked)
- Additional information about registered users of the Treffit24 and E-kontakti dating services
- information about your interests and description provided in your dating profile, as well as photographs
- special categories of personal data, if you choose to provide them (racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, and/or data concerning sexual behavior or sexual orientation)
- Additional information about users of the TableOnline service
- restaurants you have selected as favorites in your profile
- reservations you have made through the service and their history
- reviews you have submitted about restaurants
- Additional information about users of the Keventäjät service
- height, weight, and other body measurements
- eating habits, exercise habits, health status, and personal notes (your own information)
- Additional information about company representatives
- title and/or job description in current and previous positions related to the Data Controller’s operations
- Information about data subjects who have participated in the Data Controller’s events
- dietary information (special-category data provided voluntarily by the user)
- date of birth for events where this is required by, for example, a shipping company
- the names and dates of birth of travel companions where this is required by, for example, a shipping company
- Information collected about the use of services through cookies and other similar technologies, as described in more detail below
From What Sources Is My Personal Data Collected?
We collect data, among other situations, when you start using digital services we provide or participate in competitions or prize draws, for example. We may also collect personal data from external data sources.
Most of the data is obtained from you at the beginning of and during the customer or stakeholder relationship as you use our products and services.
We also receive personal data and updates to it from authorities and organizations that provide services for obtaining and updating personal and credit information, as well as from public directories and other public sources, such as company websites and social media channels.
We also receive personal data about company representatives from their colleagues; in other words, a company’s primary contact person may provide us with personal data about other colleagues as well.
With Whom May My Personal Data Be Shared?
We do not provide, sell, or otherwise disclose your personal data to external parties unless otherwise stated below.
We share personal data—such as names, email addresses, telephone numbers, demographic data, and online behavioral data—within the City Digital Group. We process data centrally to create and model target audiences, as described in more detail below.
We may share your personal data with third parties that perform services for us, i.e. processors of personal data. These services may include customer service, marketing, software services, research, and event production.
We may share your personal data in connection with the collection of outstanding invoices, and we may transfer or sell unpaid invoices to third parties that provide debt collection services.
We do not permit these parties to use the data for any purpose other than providing the relevant services to us in accordance with this Privacy Notice and applicable law. We share your personal data with partners with whom we carry out joint projects, such as events.
We may share your personal data with partners for joint direct marketing purposes or for their independent direct marketing purposes, as well as for updating contact details. If you have consented to electronic direct marketing by our service partners, your data may also be disclosed to partners for electronic direct marketing purposes. Data may be shared for these purposes only where the partner’s intended use is not incompatible with the purposes we have defined in this Privacy Notice, and we disclose to the partner only the minimum information about you necessary for the agreed purpose (mainly your contact details). You have the right to object to the processing of your personal data for direct marketing. Instructions for objecting are provided in the section “How Can I Exercise My Rights Relating to My Personal Data?” of this Privacy Notice.
We may share your personal data in connection with a merger, acquisition, or other corporate transaction, or where our business is transferred to another company, as well as pursuant to an order by a court or authority or a justified request based on law.
At our discretion, we may share the personal data of participants in our events with other participants in the same event where appropriate in view of the nature of the event (for example, an event organized for stakeholders).
Is My Personal Data Transferred Outside the EU?
We may transfer data outside the country in which the services are used. In such cases, we ensure that the transfer can be made lawfully, that the data is protected, and that our contractual partner complies with the EU General Data Protection Regulation.
In conducting our business, we may use resources and servers located around the world. We may therefore transfer your personal data outside the country in which the services are used and possibly also to countries outside the EU whose data protection laws differ.
In these cases, we ensure that there is a lawful basis for the transfer and that your personal data is protected, for example, by using standard contractual clauses and data processing agreements approved by the authorities where necessary and by requiring compliance with appropriate technical and other data protection measures.
Is My Personal Data Used for Profiling?
We may use analytics and modeling that result in profiling, enabling us to provide personalized content or target marketing communications. For this profiling, we combine personal data collected from different services, such as personal data you have provided and data about your use of the services.
We may use your personal data for profiling—that is, process your personal data automatically and evaluate certain personal aspects relating to you, in particular by analyzing or predicting characteristics concerning your personal preferences, interests, and behavior.
This enables us to serve our customers better, develop our products and services to meet our customers’ wishes more closely, and target content and marketing as appropriately as possible.
We do not make automated individual decisions that produce legal or similarly significant effects. The consequences of the profiling we conduct primarily take the form of personalized content and targeted advertising to a selected target audience.
How Long Is My Personal Data Processed?
The periods for which personal data is processed vary between different groups of individuals, depending on the grounds for processing and applicable legislation.
We process your personal data for as long as we have a valid basis for processing the data as described in this Privacy Notice, and for a reasonable period thereafter.
The processing periods for the personal data of different groups of individuals are determined on the following grounds:
Service Users and Consumer Customers
We may process your personal data for as long as you are our customer or use our services, and until the end of the fifth year following the year in which that relationship ends.
After this, we may transfer the necessary personal data to our marketing register and process you again as a prospective customer.
Representatives of Corporate Customers
We may process your personal data for as long as you represent our corporate customer, and until the end of the fifth year following the year in which that representation ends.
After this, we may transfer the necessary personal data to our marketing register and process you again as a representative of a prospective corporate customer.
Prospective Consumer Customers and Representatives of Prospective Corporate Customers
We may process your personal data indefinitely until you request that your data be deleted from our marketing register.
Members of Stakeholder Groups
We may process your personal data for as long as you are a member of a stakeholder group, such as while you represent our partner, and until the end of the calendar year in which that relationship ends.
How Can I Exercise My Rights Relating to My Personal Data?
You can exercise your rights by using the accompanying forms or by specifying your request and sending it to one of the addresses listed below, depending on the group to which you belong.
As a data subject, you have various ways to influence the processing of your personal data. As a rule, we will fulfil your request within one month.
You can exercise your rights by sending a specific request to our customer service when you wish to access your data, request its deletion, or object to its processing. For other requests, describe your request in your own words.
Please note that we must always be able to identify the person making a request concerning the data or its processing. Send a request for access from the email address you used to register for our services.
Send your specific request either by email to [email protected] or by post to: City Digital Oy, Sturenkatu 16, FI-00510 Helsinki, Finland.
- Corporate customer: the postal address or email address stated above
- Employee, former employee, or job applicant: the postal address or email address stated above
- Registered users of the Suomi24, Treffit24, Keventäjät, and E-kontakti services: You can review and delete your profile within the service using your own login credentials. Enquiries: [email protected]
Your rights include the following (the scope of these rights depends on the legal basis for processing your personal data, meaning that not all of the rights below are available to you in every situation):
- Right of access to personal data collected about you. In practice, upon receipt of an appropriate request from an identified person, we will provide you with a report of the personal data about you that has been collected in the personal data register.
- Right to request rectification or erasure of personal data collected about you. If you notice errors or omissions in your data, you can submit a rectification request to us. We will process the request and, where necessary, correct or supplement the data.
- Right to request the erasure of personal data collected about you. We are obliged to erase the personal data you request from our personal data register if one of the following grounds applies and no retention obligation arises from other legislation or an order by an authority:
- the personal data is no longer necessary for the purposes for which it was processed;
- you withdraw the consent you have given and there is no other legal ground for processing;
- you object to the processing on grounds relating to your particular situation and there are no overriding legitimate grounds for the processing, or you object to the processing of your personal data for direct marketing;
- your personal data has been processed unlawfully;
- your personal data must be erased to comply with a legal obligation under European Union or Finnish law to which the Data Controller is subject; or
- your personal data was collected in connection with the provision of information society services, such as a subscription to the Data Controller’s digital information services.
- Right to request restriction of the processing of personal data collected about you. You may ask us to restrict the processing of your personal data where:
- you contest the accuracy of the personal data we hold about you;
- the processing is unlawful and you request restriction of use instead of erasure;
- we no longer need the personal data for the purposes of processing, but you need it to establish, exercise, or defend a legal claim;
- you have objected to the processing of personal data, pending verification of whether our legitimate grounds override yours.
- Right to object to the processing of personal data concerning you. If we process your data on the basis of legitimate interests, you have the right to object to the processing of personal data concerning you on grounds relating to your particular situation. You always have the right to object to the processing of your personal data for direct marketing.
- Right to data portability. If the automated processing of your personal data is based on consent or a contract, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and the right to transmit that data to another data controller.
- Right to withdraw consent. If all or part of your personal data is processed on the basis of your consent, you have the right to withdraw your consent at any time.
- Right to lodge a complaint with a supervisory authority. If a possible disagreement concerning the processing of your personal data cannot be resolved amicably between us, you have the right to refer the matter to the data protection authority for resolution.
How and When Do We Act as Joint Controllers?
The companies mentioned in the first section of this Privacy Notice process personal data independently on their own behalf. In addition, the companies act as joint controllers when they combine and model personal data from different registers, such as names, email addresses, telephone numbers, demographic data, and behavioral data collected using cookies and other similar technologies. This means that the companies jointly determine the purposes and means of using personal data and process the data centrally so that we can provide services and display advertisements that match your interests as closely as possible. To the extent that special categories of personal data are collected in the services—for example, in connection with the Treffit24 and E-kontakti dating services—such data is used solely to provide the services concerned and is not shared outside the service or used for profiling.
We also act as a joint controller with Facebook when we have a page on Facebook (e.g. facebook.com/Suomi24fi/). We are joint controllers with respect to visitor data for these Facebook pages. Further information about Facebook’s processing of personal data is available in Facebook’s privacy policy at www.facebook.com/privacy. Together with Facebook, we collect information including likes and visits, comments on our posts, inbox messages, and the reach of our posts.
How May This Privacy Information Be Updated?
We update this privacy information as necessary, for example, when developing our services or processing methods and when legislation changes.
We continuously develop our business, which may also involve changes to the processing of personal data. Where necessary, we update the Privacy Notice to reflect changes in our practices. Changes may also be based on amendments to legislation. We recommend reviewing the contents of the Privacy Notice regularly.
If we begin processing your personal data for a purpose other than the purpose for which it was collected, we will inform you about this and the updated Privacy Notice before such further processing. For other changes, we will announce updates to the Privacy Notice on our website.
Other Terms
The registers covered by this Privacy Notice and the processing of the personal data contained in them are governed by, among other things, Finnish law and the EU General Data Protection Regulation.
To fulfil our contractual obligations arising from our relationship with you, we must process personal data concerning you.
Without the necessary personal data, we cannot provide you with products and services that require the processing of personal data, such as our digital services that require registration.
The registers covered by this Privacy Notice and the processing of the personal data contained in them are governed by Finnish law and directly applicable EU legislation in Finland, such as the EU General Data Protection Regulation.
Are Cookies Placed in My Browser?
We use cookies and other technologies to provide and develop digital services and to target advertising. For example, we collect information about how you use our services, which browser you use, and which sections of a service you have browsed. We cannot identify you personally using cookies alone. If you are logged in to our services and have given your consent to cookies, we may create a customer profile about you and combine online behavioral data collected through cookies with your other data.
Most of the technologies we use are necessary for providing and developing the service. We need cookies to ensure that our service works, to improve it, and to provide you with content that interests you.
We ask for your permission to use non-essential cookies, such as cookies used to target advertising. We believe these cookies are useful to you because they allow you to receive advertising relevant to your interests.
We provide tools that allow you to manage the settings of cookies used for advertising targeting and to disable them in our services if you wish. Cookie settings must be configured separately on each website. You can access the tool through links in the cookie banner and at the bottom of the website. For more information about our use of cookies, see our cookie information at the bottom of the page in the “Cookie settings” link.