Privacy Policy

In accordance with the Finnish Personal Data Act (523/1999), Sections 10 and 24, the EU General Data Protection Regulation (EU) 2016/679 (GDPR), and the EU Data Act (EU 2023/2854).

1. DATA CONTROLLER
Mondex Oy (VAT number: FI17695136)
Kettukallionkatu 4
84100 Ylivieska, Finland

export@mondex.fi
www.mondex.fi

2. CONTACT PERSON RESPONSIBLE FOR DATA PROTECTION MATTERS
Teppo Petäjistö
teppo.petajisto@mondex.fi
+358 50 467 7819

3. NAME OF THE REGISTER
Mondex Oy Customer, Marketing, Product Registration and IoT Data Processing Register.

4. LEGAL BASIS FOR PROCESSING
Personal data is processed on the basis of a sales agreement with respect to the customer register and on the basis of consent with respect to the marketing register. By downloading, installing, or using any interface related to Mondex products, you agree to the terms of this Privacy Policy. The legal basis for processing your personal data is your consent and the performance of a contract. If you have provided consent for any processing of personal data, you may withdraw your consent at any time.

5. PURPOSE OF PROCESSING
The purpose of the customer register and marketing register is to archive and process customer orders, maintain statistics, and manage customer relationships. The purpose of the marketing register is communication, information sharing, and various targeted direct marketing activities, such as email newsletters, telephone calls, or other contact methods requested by the data subject. The customer register is also used for the development of the online store and Mondex Oy’s business operations, statistical analysis, and ensuring service quality. Personal data is processed within the limits and in the manner permitted and required by the Finnish Personal Data Act (523/1999) and the EU General Data Protection Regulation (EU 2016/679). The processing of IoT data is based on the provision of services and compliance with user rights under the EU Data Act. IoT data is processed to enable device functionality, provide technical support, ensure security, support product development (without competitive exploitation), and deliver services requested by the user.

Electronic direct marketing and newsletters are sent only to individuals who have provided separate consent. Consent may be given, for example, through a form on the website. Consent may be withdrawn at any time via the unsubscribe link included in newsletters or by contacting the data controller.

6. CONTENT OF THE REGISTER
The register may contain the following personal data:

Company and/or individual’s first and last name, street and postal address, email address, telephone number, website address, publicly available classification information
Information on marketing permissions and prohibitions
Classification information and additional information provided by the individuals themselves
IP address information or other telecommunications identifiers obtained through the service
Customer feedback information
Order, invoicing, and delivery information
Information collected through cookies
The register also includes information on orders placed by the data subject and their processing stages
IoT device identification data (ID)
Usage and performance data
Log data (connection, error, and diagnostic logs)
User-defined settings, profiles, and commands
Information on newsletter and marketing consent provided, as well as any withdrawal of consent

7. REGULATED SOURCES OF INFORMATION
Mondex Oy customer register. Public websites, including the online store. Information generated through customer service relating to services used, including standardised information and datasets provided by external system suppliers. Information collected directly from customers, including information gathered through website contact forms, newsletter subscription forms, and product registration forms

8. REGULAR DISCLOSURE OF DATA AND TRANSFER OF DATA OUTSIDE THE EU OR EEA
The customer register data is used only by Mondex Oy. Personal data is not disclosed to third parties or partners for their own use unless required for debt collection, invoicing, or compliance with legal obligations. Personal data is not transferred outside the European Union (EU) or the European Economic Area (EEA). The Data Act restricts data transfers to countries where there is a risk of unjustified government access. Mondex evaluates all transfers on a case-by-case basis and uses only EU-compliant platforms.

Personal data may be processed in systems operated by service providers acting on behalf of Mondex Oy, such as the Mailchimp service used for sending newsletters.

9. PRINCIPLES OF REGISTER PROTECTION
The processing of personal data follows good information management practices and the diligence and security obligations required by data protection legislation

Necessary technical and organisational measures are implemented to protect personal data against unauthorised access and against accidental or unlawful destruction, alteration, disclosure, transfer, or other unlawful processing.

Access to personal data is restricted to persons whose work duties require the processing of such data.

Digitally stored and processed data is kept in databases protected by firewalls, passwords, and other technical safeguards. Paper records are stored in locked premises.

All Mondex Oy personnel are bound by confidentiality obligations regarding all information.

10. RETENTION PERIOD AND RETENTION CRITERIA FOR PERSONAL DAT
Personal data is retained only for as long as necessary for the purposes for which it is processed. Data retention periods and deletion practices are defined, and outdated or unnecessary personal data is deleted. The obligation to retain personal data may also be based on legal requirements. Mondex retains IoT data for the lifetime of the product or longer at the user's request.

11. COOKIES AND PLUG-INS
We use cookies on our website. A cookie is a small text file that is sent to and stored on the user's computer. Cookies do not harm users' computers or files.

The primary purpose of using cookies is to improve and customize the visitor's experience on the website, as well as to analyze and improve the functionality and content of the site. Information collected through cookies may also be used for targeted communications and marketing purposes, as well as for optimizing marketing activities.

Visitors cannot be identified solely through cookies. However, information obtained through cookies may be linked to information provided by the user in another context, for example when the user fills out a form on our website.

The following types of information may be collected through cookies:

• visitor's IP address pages viewed and time spent on pages visitor's browser
• time of visit
• pages viewed and time spent on pages
• visitor's browser

Users visiting our website may disable the use of cookies at any time by changing their browser settings. Most browsers allow users to disable cookies and delete previously stored cookies. Disabling cookies may affect the functionality of the website.

Social media plug-ins

Mondex Oy’s websites may contain links to third-party websites as well as so-called social media plug-ins (for example, Facebook social plug-ins). The use of social media plug-ins may transmit identifiable information to the relevant social media service providers. By opening a plug-in, you may allow cookies from third-party websites to be stored on your computer, enabling the operators of those websites to monitor your use of the page if you are logged in to the relevant social media service. Third-party services and applications available through such websites are subject to the privacy policies, terms of use, and other terms of the respective third parties. Mondex Oy has no control over such third-party websites and is not responsible for any material published on them or for their use.

12. RIGHTS OF THE DATA SUBJECT
The data subject has the right to inspect the personal data stored about them in the register. A request for inspection must be submitted in writing, signed, and accompanied by proof of identity to the contact person specified above or to the company’s official postal address. The request may also be submitted in person at the data controller’s address mentioned above.

The data subject has the right to request the correction of inaccurate personal data relating to them.

The data subject has the right to access IoT data free of charge and without undue delay. Mondex Oy shares IoT data only at the user’s request, with a service provider chosen by the user, in a secure and standardized format.

The data subject has the right to request the deletion of their personal data from the register and to request the transfer of such data to another data controller. This right does not apply to data that must be retained due to legal obligations.

The data subject has the right to prohibit the use of their data for direct advertising, distance selling, other forms of direct marketing, and opinion or market research.

Electronic direct marketing may be directed to the data subject provided that the data subject has given their consent. The data subject has the right to withdraw their consent at any time.

Any disputes will primarily be resolved through negotiation with the data subject. The data subject also has the right to submit matters concerning the processing of personal data to the competent data protection authority for investigation