Registry and privacy policy
This is the register and data protection statement of Opetus-ja Kuljettajapalvelut Ari Hangasvaara Oy in accordance with the EU General Data Protection Regulation (GDPR), which is used as a statement of processing activities and to inform data subjects about the processing of personal data. Prepared on 29.08.2026. Last modified on 29.08.2026.
Registrar
Opetus-ja Kuljettajapalvelut Ari Hangasvaara Oy/3268496-1. Tähtisumu 7, 96190 Rovaniemi.
Yrityksen käyntiosoite: Autokoulu S.Nuutinen, 96190 Rovaniemi.
Contact person responsible for the register
Ari Hangasvaara, [email protected], +358503307320.
Data subject groups
The personal data register includes the following groups of data subjects:
● customer register
● marketing register
● partner register
● employee and applicant register
● website visitors
Basis and purposes of processing personal data
Customer register
The legal basis for processing personal data is the legitimate interest of the controller or an agreement between the parties. Personal data is used for customer communication and other customer relationship management, management, development, analysis, measurement, service provision, and business development and planning. The customer may be asked for consent to the transfer and processing of personal data in external services..
Student records must be kept for six calendar years following the year in which the teaching was organised, after which the student records must be destroyed.
Marketing register
The legal basis for processing personal data is the consent received for marketing in the case of private individuals and the legitimate interest of the controller in the case of contact persons of companies and other organizations. Personal data is used for marketing the company’s services and products..
Partner register
The legal basis for processing personal data is the legitimate interest of the controller or an agreement between the parties. The purpose of processing personal data is to enable communication and other cooperation between the parties..
Employee and applicant register
The legal basis for processing personal data is primarily a contract and secondarily the legitimate interest of the controller. The purpose of processing personal data is to handle matters related to the employment relationship between the employer and employees and applicants..
Website visitors
The data of website visitors is processed on the basis of the legitimate interest of the controller, for example to ensure data security and to collect statistical data on website visitors. Consent may be requested for the use of strictly necessary cookies.
Data content and data retention periods of the register
Customer register
● Person’s name
● Contact information (address, email address, phone number)
● Job title, job role
● Company, company size and other information describing the company’s operations
● Company contact and billing information
● Customer relationship information such as contracts, purchased products and services, and other necessary information
● Information about the services used by the customer and changes to them
● Consents and prohibitions given
● Social media accounts to the extent that consent has been obtained for their use in communication
● IP address of the network connection
● Any other information collected with the customer’s consent
The information is retained as long as it is needed to implement the contract with the customer or to develop customer service. Some personal information, such as contact information, is retained for possible further cooperation. In addition, some personal information is retained for archiving purposes for 10 years in accordance with the requirements of the Accounting Act (including billing information, contact person, contact information, purchased services, other possible business-related accounting material).
Marketing register
● Person’s name
● Contact information (address, email address, phone number)
● Job title, job role
● Company, company size and other information describing the company’s operations
● Company contact information
● Consents and prohibitions given (marketing permission, use of cookies and tracking, marketing-related profiling)
● Information that promotes marketing and sales, such as marketing measures targeted at the data subject
● Social media accounts to the extent that consent has been obtained for their use in marketing
● IP address of the network connection
● Any other information collected based on consent
The information is retained as long as it is needed for marketing purposes, the person withdraws their consent or prohibits the use of their information for direct marketing. The information of a contact person of a company or other organization is also deleted from the register if it is determined that they have left the role in question.
Partner register
● Person’s name
● Contact information (address, email address, phone number)
● Job title, job role
● Company, company size and other information describing the company’s operations
● Company contact information
● Consents and prohibitions given
● Information related to and promoting cooperation
● Social media accounts to the extent that consent has been obtained for their use in communication
● IP address of the network connection
● Any other information collected based on consent
The data of the partners’ contact persons will be processed as long as the parties are in a collaborative relationship. The contact person’s data will also be deleted from the register if it is determined that they have left the relevant role.
Employee and applicant register
● Name
● Contact information such as email, phone number, and address
● Personal identification number
● Job duties, working hours and salary information
● Tax number
● Account number
● Professional qualifications
● Resume
● Application and other information provided in connection with the search
● Work-related devices provided by the employer, along with their addresses and phone numbers
● Usernames for cloud services and other work-related systems
● Other employment-related information
The data is retained for the duration of the employment relationship and for the period necessary to fulfill the employer’s obligations. Job applications are retained for two years, unless a longer retention period is agreed with the job applicant..
Website visitors
● IP addresses
● Essential cookies
● Non-essential cookies and the consents that are the basis for their use
Regular data sources
Customer register
The information stored in the register is obtained from the customer, for example, through messages sent via web forms, email, telephone, social media and instant messaging services, marketing services, events and training, agreements, through partners, customer meetings and other situations in which the customer provides their information.
Marketing register
The information stored in the register is obtained from the customer, for example, from messages sent via www forms, by email, by telephone, through social media and instant messaging services, through marketing services, from events and training, agreements, through partners, customer meetings and other situations in which the customer provides their information. Information about contact persons of companies and other organizations can be collected from public sources such as websites, directory services and other companies..
Partner register
Personal data is mainly obtained directly from cooperating companies or their contact persons. Data may also be collected from public sources such as websites..
Employee and applicant register
The information about an employee or job applicant is mainly obtained from the employee himself, for example from a job application, an employment contract and other situations in which he discloses his information. Job applicant information can also be obtained through recruitment portals and employment services..
Website visitors
Information is collected automatically when visiting websites and in situations where the visitor consents to the use of non-essential cookies.
Lawful transfers of data, transfer of data outside the EU or EEA and processors of personal data
The information is not routinely disclosed to other parties. The information may be disclosed and published to the extent agreed with the data subject.
Data may be transferred outside the EU or EEA in the course of processing by the controller and its processors to countries approved by the EU Commission and to US companies that are party to the EU-US data protection framework. Data may also be transferred outside the EU and EEA on the basis of model contractual clauses and additional safeguards approved by the EU Commission, or with the consent of the data subject. Data may be transferred to subcontractors and service providers with whom the controller has an agreement for the processing of personal data. In such cases, these parties use the data in the role of a processor on behalf of the controller. Personal data is always processed
within the framework of agreements and confidentially, so that their use is based on the access rights according to each employee’s duties, and their use is monitored. The information is not disclosed to third parties without a legal basis.
Principles of register protection
The register is handled with care and the data processed by the information systems are protected appropriately. When the register data is stored on Internet servers, the physical and digital security of their equipment is appropriately ensured. The controller ensures that the stored data, as well as the access rights to the servers and other information critical to the security of personal data, are handled confidentially and only by employees whose job description requires it.
Automated decision-making and profiling
We do not use data for automated decision-making or profiling without the express consent of the data subject.
Right to inspect and right to request correction of information
Every person in the register has the right to check their data stored in the register and to demand correction of any incorrect data or completion of incomplete data. If a person wishes to check the data stored about them or to demand correction, the request must be sent in writing to the controller. The controller may ask the person making the request to prove their identity. The controller will respond to the customer within the time period stipulated in the EU Data Protection Regulation (generally within one month).
Other rights related to the processing of personal data
The person in the register has the right to request that personal data concerning him or her be deleted from the register (“right to be forgotten”) to the extent that the controller has no legal right to continue processing the personal data or the data is no longer needed for the performance of a contract. To the extent that the data is processed on the basis of the controller’s legitimate interest, the data subject has the right to object to the use of his or her data. To the extent that the data is processed on the basis of consent, the data subject has the right to withdraw the consent he or she has given.
Data subjects also have other rights under the EU General Data Protection Regulation. Requests must be sent in writing to the controller. The controller may ask the requester to prove their identity. The controller will respond to the customer within the time period set out in the EU General Data Protection Regulation (generally within one month). The data subject has the right to file a complaint with the Data Protection Ombudsman if they believe that we are violating applicable data protection legislation in the processing of personal data.