Personal Data Act (523/1999), Section 10
EU General Data Protection Regulation (GDPR, 2016/679)
Document date 24 May 2018
Kauppakeskus Mylly Oy
Tel. 02 332 3000
Kauppakeskus Mylly Oy’s marketing data file.
Customer data file for Kauppakeskus Mylly Oy’s website.
Kauppakeskus Mylly Oy
Tel. 040 778 5515
The marketing data file includes newsletter subscribers:
The website’s customer data file includes contact and feedback forms as well as personal
data obtained via the rental of promotional spaces:
Data processing in the marketing data file and the website’s customer data file is based on
customer relationship management, the data subject’s consent or implementation of the
controller’s legitimate interests.
Data which are necessary for the purpose of the data file are processed in the marketing
The marketing data file includes the following usage data:
Basic personal data obtained via contact and feedback forms and the rental of promotional
The legal basis for processing personal data is consent or the controller’s legitimate
interest. Personal data are collected from data subjects themselves when the customer
registers on the Mylly newsletter’s mailing list, participates in Mylly’s contests, sends
feedback, contacts Mylly in some other way or rents a promotional space at Mylly. It is also
possible to send feedback anonymously. In addition, cookies are used to collect
information on the use of the website.
Data are not disclosed without the data subject’s consent except within the limits permitted
by and obligatory under law or as required by authorities.
Subcontractors may be used to manage the tasks related to the purpose of the data file,
and data may be transferred outside the EU/EEA area if such is necessary in order to
implement the service. In such cases, the controller ensures a sufficient level of data
protection through agreements, as required by legislation.
The controller stores the data that are in the marketing data file only for as long as is
necessary for the purpose of the data file. A data subject my unsubscribe from a
newsletter and erase all data collected on them at any time via the link that can be found
at the end of the newsletter.
Personal data in the website’s customer data file are stored for five (5) years, after which
the data are erased.
Databases containing stored data are technically and physically protected such that
outside parties cannot access them. Only persons who require the data to take care of
their work tasks have access to the data. Mylly’s information network and equipment in
which the data file is located are protected with firewalls and other technical measures,
such as encryption, taking the costs of the measures into account.
The data subject has the right at any time to cancel their newsletter subscription, inspect
their data and have their data erased (‘right to be forgotten’). These measures can be
taken via the link that can be found at the end of the newsletter or by sending a written
request to the controller.
A data subject has the right to inspect the data that have been saved on them in the data
file, the right to demand that incorrect personal data be rectified and the right to have their
data erased from the data file. Please note that you have the right to be forgotten only if
we do not have a legal obligation to continue processing your personal data. A data
subject also has the right to restrict the processing of their personal data (the accuracy of
the personal data is contested or the processing is unlawful), the right to object (direct
marketing or processing based on some other legitimate interest), the right to withdraw
consent and the right to be notified about a personal data breach. A data subject also has
the right to lodge a complaint with the supervisory authority if they believe the processing
of their personal data is in violation of the applicable data protection regulation.
A signed request for inspection, rectification or erasure must be submitted in writing to the
person in charge of data file matters. With this signed letter, a data subject may obtain
data concerning them free of charge once a year.
The contents of web pages and the newsletter may contain links to third-party websites.
The company has no control over linked websites, nor is it liable for the contents of or links
within third-party websites. Anyone who goes to a linked website must read that website’s
The data subject has the right to receive the personal data concerning them, which they
have provided to the controller, in a structured, commonly used and machine-readable
format if the processing is based on consent or an agreement and the processing is
carried out by automated means.
Under Article 18 of the GDPR, the data subject has the right restrict the processing of their
The controller reserves the right to update and amend the privacy statement.