CUSTOMER REGISTER PRIVACY STATEMENT

13/10/2021

In all its activities, Norlandia Päiväkodit is committed to acting in accordance with laws and regulations.This privacy policy for the customer register describes how Norlandia Päiväkodit processes and protects personal data of its customers in accordance with the new EU General Data Protection Regulation (GDPR).

1. Controller and contact person

Controller: Norlandia Päiväkodit group: Norlandia Suomi Oy, Norlandia Päiväkodit Oy,

Niiwester Oy, Kettulan Päiväkoti Oy, Kettulan Päiväkoti Ulvila Oy, Norlandia Päiväkodit Jyvässeutu Oy, Tähtipäiväkodit Oy (all together: "Norlandia Päiväkodit")

Address: Lars Sonckin kaari 12, 02600 Espoo

Phone: 010 836 7200

Contact person: Tii-Marika Mäkinen

Email: tii-marika.makinen@norlandia.com

2. Registered

The register processes the personal data of Norlandia Päiväkoti customers (guardians) and these children (together "Registered").

3. Register name

Norlandia Päiväkotien asiakasrekisteri, Norlandia customer register.

4. Basis and purpose of processing personal data

The information stored in the register is used for the customer relationship between the Registrar and the Registered to take care of. This is considered to include e.g. the following tasks:

- reception and processing of daycare applications;

- implementation of child care or other services provided to the customer

- customer communication;

- customer satisfaction surveys;

- invoicing;

- monitoring of the child according to the early childhood education plan with reports;

- other various tasks related to customer service

5. Personal data to be processed

The register contains information that is necessary for customer care. These include e.g.

- the customer's first and last name, social security number, home address, telephone number, e-mail address, profession;

- the child's first and last name, social security number, home address, maintenance information;

- information needed for invoicing, such as child care grants from the municipality or Kela;

- information necessary for daily care, such as information about food allergies or

about medication;

- information generated in daily activities, such as the child's photos describing the course of the day, stories and narratives;

- other information required by the early childhood education plan

6. Regular sources of information

Personal data is mainly collected from the Registered person himself, but also from the municipality and Kela. Part of the information is generated during treatment either by the child, guardians or daycare staff.

7. Regular transfers and transfers of data

Personal data can also be transferred to other service providers, such as e.g. the technical staff who performs the maintenance of the personal register. However Norlandia Päiväkodit strives to ensure the service provider's data security and personal data protection is on an adequate level.

Information is also regularly disclosed to operators in the municipality to the extent that

cooperation with early childhood education, counseling, school or other entities is required.

8. Transfers of personal data within the European Union or outside the European Economic Area

Personal data will not be transferred outside the EU or the European Economic Area (EEA).

9. Protection of personal data and storage period

Electronically processed personal data is stored in systems to which access is limited only to those persons who need the information in question to perform their duties. Access to the system is required always using a username and password.

Manually processed data is stored in separate rooms and access to this data is also limited

according to the data usage needs.

All information is stored only as long as it is necessary to fulfill the contract or for other purposes based need, or other legal basis or requirement. After this, the data is deleted and destroyed in a secure manner.

10. Rights of the data subject

In principle, the registered person has the right, in accordance with the applicable data protection legislation, whenever to:

- receive information about the processing of their personal data;

- get access to their own data and check their personal data;

- demand the correction and completion of inaccurate and incorrect personal data;

- demand the deletion of their personal data;

- withdraw his consent and object to the processing of his personal data to the extent that the processing of personal data is based on the data subject's consent;

- objects to the processing of his personal data related to his personal special situation based on the extent to which the basis for processing personal data is a legitimate interest;

- get your personal data in a machine-readable format and transfer that data to another person to the controller, provided that the data subject has himself provided the personal data in question to the company, the company processes the personal data in question based on the consent of the registered person and the processing is performed automatically; and

- demand the restriction of the processing of their personal data.

The registrant must submit a request regarding the exercise of the above-mentioned right

in accordance with the Contact-section of the privacy statement. The company can ask the registrant to specify the request in writing and to verify the identity of the registered person before processing the request. The company may refuse to fulfill the request on the basis stipulated in the applicable law.

11. The right to appeal to the supervisory authority

Every Registered Person has the right to file a complaint with or against the relevant supervisory authority, to the supervisory authority of the Member State of the European Union, where the Registrant's place of residence or workplace is located, if the Registrant considers that his personal data has not been processed appropriately in accordance with data protection legislation.

Contacts

Requests regarding the exercise of the registrant's rights, questions about this privacy statement and other contacts should be made by e-mail to Tii-Marika Mäkinen, at

tii-marika.makinen@norlandia.com. The registered person can also contact personally or in writing to the address below:

Norlandia Päiväkodit Oy

Tii-Marika Mäkinen

Lars Sonck's arc 12

02600 Espoo