Privacy Policy
Privacy notice for shipment recipients
This privacy notice explains how Logitrail Oy ("Data Processor" or "Logitrail") processes the personal data of a merchant's ("Data Controller") customers and users of its electronic services ("Data Subject"), and how you can influence that processing. Logitrail complies with applicable data protection legislation.
This notice supplements the Data Controller's own privacy notice.
Data processor
Logitrail Oy (Business ID 2575223-3)
Ojakatu 3
21200 Raisio, Finland
e-mail: asiakaspalvelu@logitrail.com
Personal data we collect
We process personal data only to the extent necessary to fulfil the purposes described in this notice. The personal data collected, and the extent of its processing, varies depending on the relationship between the Data Controller and the Data Subject, the permissions given, and the privacy settings of the Data Subject's browser.
Shipment data
Data is collected from the Data Subject when they place orders or reservations, or otherwise request delivery of products, through a web service, email, phone, or in person. The necessary data is collected from the categories listed below as needed; some of it may be optional.
- basic information, such as name
- contact details, such as postal address, email address, phone number
- consent and opt-out data, such as marketing permission or a data publication ban
- order source data, e.g. how the order was placed
- order contents and products, including any changes and cancellations
- preferred payment and delivery method, and payment completion data
- other order-handling data, such as billing details or processing history
- delivery-related details such as company name, door code, and other delivery notes
- data related to any shipping complaints
- data related to any customer returns
- any other additional information provided by the Data Subject
In certain situations, data may be provided on behalf of the Data Subject by a person they have authorised, such as a contact person representing their organisation.
Web service usage data
Usage data is collected when the Data Subject uses the electronic services Logitrail provides to the Data Controller — for example, a delivery method selection used in the Data Controller's web service. Data collected includes, for example:
- data collected from the device or application used, such as browser version, device type, screen size, and IP address
- data on web service usage, such as page loads, time spent in the service, and navigation within it
- data related to customer service development, such as feedback given through the web service
Web service users may be identified, for example, by social plugins or an identifier included in an email message.
Purpose of use and legal basis
Logitrail uses the personal data collected for various actions necessary for managing the Data Controller's customer relationship, such as delivering ordered products or services and providing customer service and other support. The data collected may also be used for the Data Controller's customer communications and relationship management. Processing is based on the contract between the Data Subject and the Data Controller for the delivery of a product or service (such as an online store order), and on the legitimate interest of processing data as a consequence of an action that establishes a customer or employment relationship (such as placing an order).
Sharing and disclosure of personal data
The Data Controller and Logitrail have agreed on the processing of personal data as described in this notice and applicable data protection legislation. Logitrail acts as a data processor, solely on behalf of the Data Controller. Logitrail does not disclose data to third parties unless specifically instructed to do so in writing by the Data Controller. An exception applies to certain web-service usage data, disclosure of which a web-service user can prevent as described in the Cookie Policy.
Logitrail may use other third-party services to process personal data. In such cases, Logitrail ensures lawful processing of personal data through contractual arrangements and written instructions to the third party. Logitrail provides data from third-party services (so-called Sub-processors) to the Data Controller when necessary.
Logitrail may also disclose personal data to third parties where applicable law requires it, or where it is necessary to protect the rights or safety of the Data Controller, Logitrail, or the Data Subject.
Transfers of personal data outside the EU/EEA
As a rule, Logitrail does not transfer personal data outside the EU/EEA, nor is personal data otherwise processed outside the EU/EEA. If data is exceptionally transferred outside the EU/EEA, it is processed as required by this notice and applicable law.
Collection and use of location data
As a rule, Logitrail does not collect or use precise location data of Data Subjects. When electronic services are used, however, the user's IP address is recorded, which can generally be associated with a geographic location at the municipality level. In addition, when a shipment is picked up, for example, tracking data is recorded that can be associated with a specific location, such as the pickup point's location.
Retention of personal data
Logitrail retains personal data only as long as necessary to fulfil the purpose for which it was collected. Applicable accounting law or other mandatory legislation may, however, require the Data Controller or Logitrail to retain data for longer. In such cases, the retention periods set by legislation are followed.
Data accumulated from the use of electronic services is retained for approximately 12 months in a form from which an individual user can be identified.
Detailed customer and order data related to a specific shipment and the Data Subject is retained for at most 12 months after the shipment is archived. A shipment is considered archived once it has been picked up by the Data Subject or a person they have authorised, or once a customer return has been recorded for it.
Data subject rights and ways to exercise them
The Data Subject has the right to access their own personal data, and the right to check and correct personal data concerning them. The Data Subject also has the right to request the erasure of personal data concerning them, to the extent possible under other legislation. The Data Subject also has the right to transfer their personal data to another Data Controller.
The Data Subject has the right to prohibit direct marketing and to object to the processing of their personal data for direct marketing purposes.
Requests to exercise these rights should be addressed to the Data Controller.
Security
Logitrail ensures the secure processing of personal data through appropriate physical and technical security measures, to protect data from loss, destruction, misuse, and unauthorised access or disclosure. Logitrail aims for secure processing of personal data by, for example, restricting access to personal data and ensuring that employees and subcontractors use personal data in accordance with given instructions, agreements, and legislation.
Privacy notice for users
This privacy notice explains how Logitrail Oy ("Data Processor" or "Logitrail") processes the personal data of users of the Logitrail service ("User"), and how you can influence that processing.
Data controller
Logitrail Oy (Business ID 2575223-3)
Ojakatu 3
21200 Raisio, Finland
e-mail: asiakaspalvelu@logitrail.com
Personal data we collect
We process the following personal data:
- basic information, such as name and role within the merchant's organisation
- contact details, such as email address, phone number, and postal address
- identification and security data, such as usernames and similar data that let us identify the User
- access-right data, such as rights granted to the User to act as a representative of the merchant
- consent and permission data, such as consents the User has given regarding contact methods
- log data, such as actions the User has taken within the services
- data related to managing the customer relationship, such as data on the User's contacts with Logitrail
- data related to security and misuse prevention
- historical data, such as data on the User's past and other merchants
We process personal data only to the extent necessary to fulfil the purposes described in this notice. The personal data collected, and the extent of its processing, varies depending on the relationships between Logitrail, the User, and the merchant, the permissions given, and the User's browser privacy settings.
Data is also collected when the User uses the electronic services Logitrail provides. Data collected includes, for example:
- data collected from the device or application used, such as browser version, device type, screen size, and IP address
- data on service usage, such as page loads, time spent in the service, and navigation within it
Purpose of use and legal basis
Logitrail uses personal data primarily for actions necessary to perform and carry out the contract between the merchant and Logitrail, such as delivering ordered products or services, providing customer service and other support, and maintaining information security. The data collected may also be used for customer communications and relationship management.
Processing of personal data is based on the legitimate interest of processing data to perform the contract between the merchant and Logitrail, and/or on the Data Subject's consent, given when accepting an invitation to set up a user account with Logitrail.
Sharing and disclosure of personal data
As a rule, Logitrail does not share or disclose personal data to third parties. For a justified reason, some personal data may be disclosed to merchants with whom the User has been, or will be, in an employment relationship or a comparable relationship, such as an internship or volunteer role. Data is disclosed only to the extent necessary to perform the contract between the merchant and Logitrail, or as otherwise related to the activity between the relevant merchant and the User.
When web services are used, some usage-related data may be disclosed to third parties. The User can prevent this disclosure through their own browser settings if they wish. Logitrail may use third-party services to process personal data. In such cases, Logitrail ensures lawful processing of personal data through contractual arrangements and written instructions to the third party.
Logitrail may also disclose personal data to third parties where applicable law requires it, or where it is necessary to protect the rights or safety of Logitrail, the User, or the merchant.
Transfers of personal data outside the EU/EEA
As a rule, neither the Data Controller nor Logitrail transfers personal data outside the EU/EEA, nor is personal data otherwise processed outside the EU/EEA. If data is exceptionally transferred outside the EU/EEA, it is processed as required by this notice and applicable law.
Collection and use of location data
As a rule, Logitrail does not collect or use precise location data of Users. An exception applies to situations where location data is specifically requested from the User. In such cases, the location data may only be used immediately after being requested.
When web services are used, the user's IP address is recorded, which can generally be associated with a geographic location at the municipality level. In some situations, data is also recorded and processed that can be indirectly associated with a specific location, such as the location of a customer service or sales point.
Retention of personal data
Logitrail retains personal data only as long as necessary to fulfil the purpose for which it was collected. Applicable accounting law or other mandatory legislation may, however, require Logitrail to retain data for longer. In such cases, the retention periods set by legislation are followed.
Data accumulated from the use of web services is retained for approximately 12 months in a form from which an individual user can be identified.
Data subject rights and ways to exercise them
The User has the right to access their own personal data, and the right to check and correct personal data concerning them. The User also has the right to request the erasure of personal data concerning them, to the extent possible under other legislation. The User also has the right to transfer their personal data to another data controller.
The User has the right to prohibit direct marketing and to object to the processing of their personal data for direct marketing purposes. As a rule, the User can exercise the above rights independently while authenticated in Logitrail's web services. Where rights cannot be exercised independently, the User should contact Logitrail Oy's customer service.
Security
Logitrail ensures the secure processing of personal data through appropriate physical and technical security measures, to protect data from loss, destruction, misuse, and unauthorised access or disclosure. Logitrail aims for secure processing of personal data by, for example, restricting access to personal data and ensuring that employees and subcontractors use personal data in accordance with given instructions, agreements, and legislation.