This is the register and data protection policy of the meridiancare.fi website in accordance with the Personal Data Act (Sections 10 and 24) and the EU General Data Protection Regulation (GDPR). Prepared on 1.9.2019.

Controller

Name: Meridian Care
Business ID: 2783289-4
Address: Biologinkatu 8 F 23, 00790 Helsinki
Phone: 044 272 8105

Contact person responsible for the register

Chantal Hellevig, tel. 044 272 8105.

Name of the register

Meridian Care’s (meridiancare.fi) customer and marketing register.

Legal basis and purpose of the processing of personal data

The legal basis for processing personal data under the EU General Data Protection Regulation is.

  • the person’s consent (documented, voluntary, individualised, informed and unambiguous)
  • a contract to which the data subject is a party
  • the legitimate interest of the controller.

The purpose of processing personal data is to contact customers, maintain customer relations and marketing. We also collect information about the use of our website in order to improve and develop our services. We collect information about visitors to our website so that we can target them with advertising about products, services and offers that may be of interest to them through various communication channels.

Data content of the register

The data stored in the register includes: the name of the person, contact information (phone number, e-mail address, address), information about the services ordered and changes thereto, billing information, other information related to the customer relationship and the services ordered. The data is kept only for as long as necessary.

Regular sources of information

The information stored in the register is obtained from the customer through, for example, messages sent via online forms, email, telephone, social media services, contracts, customer meetings and other situations where the customer discloses their information.

Regular disclosures and transfers of data outside the EU or EEA

Data is not regularly disclosed to other parties. Data may be published to the extent agreed with the customer. Data may also be transferred outside the EU or EEA by the controller. Access to personal data will not be granted beyond what is necessary for the provision of the services. Any transfer of personal data outside the European Union or the European Economic Area is always based on and carried out in accordance with the applicable legislation on the processing of personal data.

Principles for the protection of the register

The register is processed with due care and the data processed by the information systems are adequately protected. Where the data are stored on Internet servers, the physical and digital security of their hardware shall be adequately ensured. The controller shall ensure that stored data, as well as access rights to servers and other information critical to the security of personal data, are treated confidentially and only by employees whose job description includes this.

Right of inspection and right to request correction of information

Every person in the register has the right to check the information stored in the register and to request that any inaccurate or incomplete information be corrected or completed. If a person wishes to check or request a correction of the data stored about him or her, the request must be sent in writing to the controller. The controller may, if necessary, ask the applicant to prove his or her identity. The controller will reply to the customer within the time limit laid down in the EU General Data Protection Regulation (as a general rule, within one month).

Other rights related to the processing of personal data

 A person in the register has the right to request the erasure of personal data concerning him or her from the register (“right to be forgotten”). Data subjects also have other rights under the EU General Data Protection Regulation, such as the restriction of processing of personal data in certain circumstances. Requests should be sent in writing to the controller. The controller may, if necessary, ask the applicant to prove his or her identity. The controller will respond to the customer within the time limits set by the EU GDPR (as a general rule, within one month).

Latest change 9.8.2023