Privacy Policy

Date of preparation: 17 April 2025

This privacy policy states how Karelwood Oy collects, uses, and protects the personal data of its customers in accordance with the EU General Data Protection Regulation (GDPR) (2016/679) and Finnish legislation. Personal data refers to any information relating to an identified or identifiable natural person, as defined in the GDPR.

1. Registry Manager

Karelwood Oy

Telitie 1B 80100 Joensuu, 2313338-3, info@karelwood.com puh. 040 838 0358

2. Name of the register

Karelwood Oy's customer register

3. Purpose and Legal Basis for Processing Personal Data

Personal data is processed on the following grounds:

• Managing customer relationships
• Compliance with legal obligations
• Ensuring the security of services
• Risk management and the prevention and investigation of misuse

Personal data is processed for the purpose of managing customer relationships, fulfilling contractual obligations, and complying with statutory requirements (such as the Finnish Accounting Act).

4. Contents of the Register

The register may contain the following information:

• Name
• Address
• Telephone number
• Email address
• Personal identity code
• Bank account number
• Property identification number
• Other information necessary for managing the customer relationship

5. Sources of Information

Information is primarily obtained directly from the customer, for example when making contact or entering into an agreement.

6. Disclosure and Transfer of Data

Personal data will not be disclosed to third parties without the customer's consent, except to authorities when required by law or regulation.

7. Data Retention Period

Personal data is retained for the period required by the Finnish Accounting Act and other applicable legislation. Outdated data or data that is no longer necessary for business operations is regularly deleted, for example after the completion of projects.

8. Data Protection and Security

Access to personal data is restricted to persons authorised by Karelwood Oy or, upon separate request, to the client commissioning the work when necessary for the execution of the work.

• Data is stored in locked facilities or on secure servers.

9. Rights of the Data Subject

The data subject has the right to:

• Receive information about the processing of their personal data
• Access their personal data (requests must be submitted in writing; processing time is approximately 2–3 weeks from receipt of the request, and identity will be verified)
• Request the correction of inaccurate personal data
• Request the deletion of their personal data within the limits permitted by law
• Object to the processing of their personal data or request the restriction of processing on legitimate grounds

10. Contact Information

Requests concerning personal data and other data protection matters may be submitted in writing to:
info@karelwood.com