Optimaze Privacy Policy
Updated on 25 April 2018
1. Controller
The controller is the organization you represent.
Rapal Oy is in a contractual relationship with the organization you represent, i.e. the customer, and acts as a processor of personal data for the system on behalf of the controller.
See section 3 for exceptions.
2. Contact person for matters relating to the personal data file
The controller is the organization you represent; the administrator of the organization, the person responsible for data security, or another designated person acts as the contact person.
Contact details of the processor
Optimaze User Support
+358 44 031 2252
The person responsible for data security at Rapal Oy gdpr@rapal.com assists the controller with the processing of personal data in matters related to the Optimaze system.
3. Purpose of processing personal data, processing, and the general rights of the data subject
Your organization as the controller
Personal data is used to identify the users of the system and manage their access rights in accordance with the purpose of use defined by your organization.
In such cases, your organization is the controller and you can obtain more detailed information from your organization on the processing of your personal data and on your rights.
Rapal Oy as the controller – personal data processing based on your consent
With your consent, Rapal Oy will process service user information provided by your organization for the performance or user studies (frequency of use, times, role) and the contact details of customer employees (name and e-mail address) for user communications, the marketing of other Rapal Oy services, and customer satisfaction surveys, as follows:
User communications
- By allowing user communications, you allow the supplier to use your personal data (name and e-mail address) and send you information on the latest changes and developments affecting the service software and services related to its use, such as version updates, user days, training sessions, service presentation events and/or webinars. By allowing user communications, you also allow the use of a third party software service (Emaileri) in communications. The data used by the Emaileri service is located in Finland. Emailer does not have permission to use or transfer your personal data. Notifications of critical deviations will be sent, regardless of whether or not you give your consent, in accordance with the agreement signed with the customer.
Marketing communications
- By allowing marketing communications, you allow the supplier to use your personal data (name and e-mail address) and send you information by email about events and product releases, and other Rapal products and services related to the service. By allowing marketing communications, you also allow the supplier to use the aforementioned third-party application service (Hubspot). The Hubspot service’s data is located in a cloud service in the USA. Hubspot does not have permission to use or transfer your personal data.
Customer satisfaction surveys
- By allowing customer satisfaction surveys, you allow the supplier to use your personal data (name, e-mail address, telephone number) for electronic customer satisfaction surveys of software users. By allowing customer satisfaction surveys, you also allow the supplier to store your personal data in third party software (Surveypal). The Surveypal service’s data is located in Great Britain. In addition to the electronic customer satisfaction survey, feedback is collected by other means by phone or through various events. Surveypal does not have permission to use or transfer your personal data.
In the three aforementioned cases, Rapal Oy is the controller. The above mentioned processor contact details will therefore serve as the contact details of the controller. As the controller, Rapal Oy will only process your aforementioned personal data internally, within Rapal Oy. It will be distributed to members of the Optimaze Service Monitoring Group (user studies) and the Marketing Department (marketing of other services). Personal data will not be disclosed to third parties (except when third-party software is used), and will not be processed automatically. Personal data will be retained as long as the agreement between Rapal Oy and your organization is valid and, at a maximum, for as long as you are a user of the Optimaze service. You can withdraw your consent and forbid the use of your personal data at any time, by sending an email to Rapal Oy at the address mentioned in section 2. Like all data subjects, you have the right to file a complaint with the supervisory authority, i.e. the Data Protection Ombudsman, if you believe that data protection legislation has been violated in relation to you. You have the right to inspect any data concerning you, to receive a copy of any data being processed and to have any incorrect data rectified. A data subject’s right to be forgotten is implemented to the extent possible, taking account of the fact that you are a user within your organization and your data is required in relation to your user role.
Send a message to the Rapal Oy e-mail address mentioned in section 2, if you want to exercise your right as a data subject, and we will get in touch with you.
Because this matter concerns personal data obtained from your organization, which is closely related to the use of a private service (i.e. the Optimaze service), your personal data cannot be transferred to another controller or processor of personal data.
Please contact your organization, in its capacity as the controller, in all matters other than those mentioned above concerning the processing of your personal data on the basis of your consent.
Rapal has ensured that your data remains confidential.
4. Transfer of data outside the European Union or the European Economic Area
No personal data will be transferred outside the EU or EEA, unless this is specifically agreed with your organization, i.e. the customer.
In cases where Rapal Oy is the controller and
- personal data is processed in user communications or when sending customer satisfaction surveys, personal data is not transmitted outside the EU or EEA.
- personal data is processed in marketing communications, personal data stored in the service used is saved in a cloud service. However, such data will not be stored in the service and will not be processed without the explicit consent of the customer and the user i.e. you. Read more (link to Hubspot GDPR)
5. Principles of personal data protection
The principles of personal data protection have been agreed with your organization, i.e. the customer. The same principles mainly apply, and procedures for securing your personal data also apply, in cases where Rapal Oy is the controller. These principles have also been communicated to, and their use has been approved by, your organization.
