Privacy and Data Protection Statement Miracle Finland Oy 2025
In accordance with EU General Data Protection Regulation (GDPR)
1. Data Controller
Miracle Finland Oy
Työpajankatu 10 A 10a
00580 Helsinki
Business ID 2130185-7
2. Contact Person Responsible for the Register
Heli Helskyaho, heli.helskyaho@miracleoy.fi , +358 503838152
3. Legal Basis and Purpose of Processing Personal Data
Legal bases for processing personal data in accordance with the GDPR:
- Contract: Managing customer relationships and providing services when the data subject is a party to a contract.
- Legitimate Interest: Communication and maintaining cooperation with partners, as well as processing the contact details of individuals who have provided their information themselves (for example, in the form of a business card).
- Consent: Marketing communications based on the data subject’s voluntary, specific, informed, and unambiguous consent. Consent is obtained and documented (for example, via email or a web form) and can be revoked at any time.
Purposes of processing data:
- Customer communication
- Maintaining and managing customer relationships
- Maintaining partner relationships
- Marketing (based on consent or legitimate interest)
Personal data is not used for automated decision-making or profiling.
4. Register Content and Data Subject Categories
The register contains information regarding the following groups of individuals:
- Customers and their representatives
- Potential customers who have been contacted by the company or who have contacted the company themselves
- Representatives of partners
- Other individuals who have provided their contact details to the company (e.g., via business cards or online forms)
Personal data stored in the register may include e.g.:
- Name
- Company/organization and position
- Contact details (phone number, email address, physical address)
- Information related to customer relations, cooperation, or marketing communications
The register is used to manage customer and partner relationships as well as for marketing.
5. Regular Data Sources
Data is primarily obtained directly from the data subjects, for example:
- Upon entering into a contract
- During customer meetings (e.g., business cards)
- Via online forms and other electronic communications
- In connection with customer and marketing communications
6. Regular Disclosures and Transfers of Data
Data is not regularly disclosed to third parties.
Data may, however, be transferred to service providers (e.g., IT and communication service suppliers) processing personal data on behalf of the controller. In such cases, contractual measures ensure that data is handled in compliance with data protection legislation.
Data will not be transferred outside the EU or EEA without ensuring an adequate level of data protection.
7. Data Retention Period
Personal data is retained only as long as necessary to manage customer relationships, partner relations, or marketing communications. Customer data is additionally retained for as long as required for invoicing and accounting obligations, but only for the period required by law.
Data subjects may request the erasure of their data from the marketing register at any time.
8. Rights of the Data Subject
Data subjects have the right to:
- Access and inspect their personal data
- Request the rectification of inaccurate or incomplete data
- Request the erasure of their data
- Restrict or object to the processing of their data
- Withdraw consent at any time (e.g., marketing communications)
- File a complaint with a supervisory authority if they consider that personal data has been processed in violation of data protection regulations (Office of the Data Protection Ombudsman, www.tietosuoja.fi)