Privacy – Cloubi

Privacy Policy Statement concerning the processing of the clients’, potential clients’, and stakeholders’ personal data

Last updated: 07/11/2022

This Privacy Statement describes how Otava processes the personal data of its customers, potential customers, consumers, stakeholders, participants in product development, users of Otava products and websites, and participants in events in accordance with the General Data Protection Regulation (EU 679/2016, “GDPR”).

User of Otava’s digital learning material: you can find further information on data processing and the controller of digital learning materials here.

1. Data controller

The data controller for your personal data is Otava Publishing Company Ltd (business ID 1564596-0) and the companies belonging to the same Group at any given time (hereafter “Otava” or “we”). Otava is a Finnish company operating in Finland.

In some situations, Otava and the companies belonging to the same group act as joint controllers, and in these instances personal data can be processed within the Group across company boundaries. Further information about Otava Group is available at www.otavakonserni.fi.

As a rule, we serve our customers by area of business. This Privacy Statement is primarily intended for the customers, potential customers and stakeholders of the book business, i.e. Otava Publishing Company Ltd and Otavan Kirjapaino Oy. Otava Publishing Company Ltd also includes Nemo, Moreeni, Like, Karisto, Atena, F-kustannus, Otava Learning, Finn Lectura, and Cloubi.

You can reach all the data controllers in the Otava Group using the following contact information. Your inquiry or request to exercise your rights will be directed to the correct recipient internally.

Address: Uudenmaankatu 10, 00120 Helsinki, Finland

Telephone: +358 (09) 15661

Email: tietosuoja@otava.fi

Otava may also act as a joint controller with some service providers. For more information on these scenarios and service providers, see “Do we transfer your personal data outside the European Union?”

2. Definitions

The definitions used in this Privacy Statement correspond to those used in the GDPR. Below are some examples of what these definitions mean in Otava’s context. In addition, other terms used in this Privacy Statement are defined below.

Customer is an umbrella term for describing all of Otava’s customers. This includes consumers as well as companies and other entities.

Personal data refers to information that is connected or can be connected to a data subject, such as name, address, email, telephone number and contact history.

Pupil and student refer to pupils in comprehensive school and students in upper secondary school, adult education or independent studies.

Potential customers refer to consumers and the representatives of corporate customers or stakeholders with whom Otava seeks to establish a customer relationship.

Data subject refers to a natural person whose personal data Otava processes in its activities. Such persons include, for example, consumer customers, representatives of corporate customers and stakeholders, and persons whose data is processed when they use the Otava website.

Stakeholder representative refers to contact persons of companies and other entities with whom Otava has a co-operation relationship. These include, for example, representatives of companies and other entities as well as authors providing services for Otava. Stakeholder representatives may also include other parties connected to Otava, such as representatives of the media as parties to information activities and public decision-makers related to public relations activities.

Corporate customers refer to representatives of companies and other entities, such as schoolteachers and contact persons for companies.

3. For what purposes do we process your personal data?

Otava processes personal data for the purposes described below. Otava may process your personal data for one or more of the purposes described below at the same time, if Otava has a legal basis for doing so.

Delivery of products and services and maintenance of customer relationship

Otava can use your personal data to provide products and services, provided that you or the company or other entity you represent have, for example, purchased a product from us, used our digital services, subscribed to our newsletter, participated in a promotional prize draw or competition, participated in our training or other events, or participated in interviews, tests or further studies. Otava can utilise your personal data to manage, analyse and improve a customer or stakeholder relationship that was either created directly with you or with a company or other entity you represent.

Development of products and services

Otava can use your personal data to develop its products and services: for example, to develop the selection and content of products and services based on the age of our customers and their interests. Otava may process your personal data for further development of the business based on your feedback, survey responses, participation in testing, and purchasing behaviour.

Procurement

Otava can use your personal data if you or the company you represent provide Otava with services or products.

Acting as an author for Otava and submitting manuscripts

Otava also processes your personal data when you submit a manuscript or other material to Otava or act as an author for Otava.

Customer communications

Otava may use your personal data in its customer communications. Such customer communications may include, for example, sending notifications related to products and services, informing about changes made to services, and requesting feedback on products and services.

Marketing

In some cases, Otava can contact you about new products, services or benefits. Otava can use personal data to tailor its line of products and provide relevant content. This means, for example, that we make recommendations or show tailored content and tailored advertisements in our own and third-party services, such as in digital products and on websites.

4. What is the legal basis for processing personal data?

The legal basis for processing personal data can be one of the following:

Contract

Otava can process your personal data on the basis of a contract when the processing is necessary to implement a contract to which you are a party or for the implementation of pre-contractual measures at your request (e.g. the implementation of an online purchase or a digital service). After the contract relationship has ended, the processing of your information may in some cases be continued further, based on either a statutory obligation of Otava or a legitimate interest of Otava in commercial activities.

Statutory obligation

Otava can process your personal data when the processing is necessary to comply with Otava’s statutory obligation. Such an obligation may be, for example, processing information that is required under the Accounting Act.

Legitimate interest

Otava can also process your data when the processing is necessary to achieve the legitimate interests pursued by Otava or a third party, except when Otava’s interests are overridden by your fundamental rights and freedoms.

Otava has legitimate interests related to business operations, which include:

conducting product development, such as asking for a statement or opinion on its products;
ensuring the secure use of services and products;
providing advice and other customer service to its customers and non-customers;
investigating possible abuses;
promoting the sale of its products and services by means of marketing and sales; or
conducting direct marketing within legal limits.

Consent

Otava may also process your personal data if you have been requested for and have given your consent to the processing of your personal data for one or more specific purposes. Consent serves as a basis for processing, for example, when we want to use cookies and other similar technologies that are not necessary or when you participate in a prize draw or competition.

5. What data types can we process?

Below are descriptions of the data types that Otava may process. Not all the data types described below are collected from all data subjects, i.e. the collected and processed data from the data subject depends on the role of the person in relation to Otava and the kinds of products or services they use. For example, we need less personal data from stakeholder representatives than from the users of our products. The data types are grouped by data subject category, and the relevant data subject categories are indicated in the subheadings.

Basic information of all data subjects

first and last name
contact information (postal address, email address, telephone number)
gender
date of birth
service language
title and/or job description of current and previous positions related to Otava’s activities
direct marketing options

Information of data subjects who have purchased, used, provided feedback and/or complained about the products or services of Otava

name of Otava’s corporate customer, i.e. the name of the company or other entity connected with Otava’s customer relationship in which the data subject currently works or has worked in the past
date and manner of the starting and ending of a customer or similar relationship
campaigns and offers targeted at the customer and their use
content, correspondence and follow-up of feedback and complaints
photo and/or video of the data subject if the data subject uploads a photo or video to Otava’s service, for example, when using digital learning materials
information on how a product is purchased
information on the use of Otava’s digital services and digital content created for the user
communication to the data subject and the related activities
customer service call recordings, emails and online discussions
for the part of teachers
- information on school
- information on which subjects the person teaches
- information on which grades the person teaches
- other teacher-specific information, such as who in a particular school has influence over material selections
- areas of interest indicated by the teacher and categorisation based on them
for the part of consumer customers, credit rating when a product or service is purchased by invoice

Information of data subjects who participated in Otava’s events

event in which the person participates
dietary information (specific categories of information that are deleted immediately after the event)
when necessary, date of birth and the name and date of birth of the travel companion if required by, for example, the tour operator
essential information on the organisation represented and participation in the event

Identification information of users of Otava’s online services

logging identifiers of the data subject
activities and actions in the online service after logging in, such as clicks, roaming and activities in Otava’s services
information on cookies and other similar technologies placed by Otava on the user’s digital devices (such as computers and mobile devices)

Information of data subjects who are Otava’s stakeholders

information on personal identity code, salaries, fees, expenses paid and other possible financial contributions
occupation or education
information on being in the VAT register and preliminary tax withholding register
information on the products or services supplied

Information collected through interviews and other studies and surveys

Information provided by corporate customers, potential corporate customers, pupils and students as well as other persons using Otava’s products and services is processed when such persons participate in studies. The processed information can include at least the following:

background information such as age, education, position, preferences and interests related to Otava products
information related to developing the customer experience, such as
- responses to various studies (e.g. surveys, interviews and observations) that are related to e.g. Otava’s products and services, chat conversations, free-form comments, photos, video clips, or other information provided in connection with a study or survey
- more in-depth information on customer experiences and preferences as a user of a product or service, which may be related to marketing, existing or new trends in the field, or development projects under progress.

6. From which sources can we collect your personal data?

As a rule, we collect your personal data directly from you. Most of the information we process is received at the beginning of and during a customer or stakeholder relationship. We may also collect information through the products or services you register for and use, such as Otava’s digital content. In addition, we may collect information from you through various market research and development projects.

In some situations, such as in connection to stakeholder co-operation, Otava also receives personal data and updates to it from authorities, organisations and companies that provide credit and personal data acquisition and updating services, as well as from public directories and other public sources, such as community websites and social media channels.

Otava may also collect information on the representatives of companies and other entities through recommendations, in which case the main contact person of the company or other entity may also share personal data with Otava about other persons as related to the use of Otava’s products and services.

Otava only processes your credit information in specific situations permitted by law, such as billing or collection.

7. Do we use your personal data for profiling?

Otava does not make automated individual decisions that have legal or significant consequences. Otava or its partners may use your personal data for profiling, i.e. to automatically process your personal data and evaluate certain personal characteristics. We can, for example, combine information about your orders and target marketing to you based on your orders. As a rule, the information required for this purpose is obtained through cookies. In addition, Otava uses Google and Facebook analytic services to help us learn about your online activities. For more information about these providers, see “Do we transfer your personal data outside the European Union?”

We may also combine your data with various market research and development projects based on your responses. Based on your responses and other customer information, we may categorise you into a group that has specific features or is considered to be interested in certain types of products or services. This does not affect the information, services or other products offered by Otava. Using this information, we can assess the expectations and development areas that users have identified in Otava products.

User of Otava’s digital learning material: please refer to the “Do we use your data for profiling?” section in the digital learning material section for more details.

8. Who can we share your personal data with?

As a rule, Otava does not provide, sell or otherwise disclose your personal data to third parties outside the Otava Group. However, your data may be disclosed in the following situations.

Otava shares the kinds of personal data that are necessary for the provision of purchased services with third parties that provide said services for or on behalf of Otava. These services may include, for example, customer service, software services, technical management and analysis of personal data, organising research activities, marketing, and various campaigns. Below are situations in which your personal data can be disclosed to third parties to the extent required by the implementation of the function:

to collect payments for products and services and, for example, to transfer or sell unpaid invoices to third parties providing collection services;
to manage and implement projects with respective partners;
for common or independent direct marketing purposes with carefully considered third parties;
information on persons participating in events to other participants and organisers of said event;
in the context of a merger or other corporate restructuring or in the event of a service being transferred to another service provider; or
by court order or similar to the party concerned.

Protecting your personal data is important to Otava, and therefore, it does not allow the parties concerned to use the data for any purpose other than the provision of the services in question, and requires the parties to protect the user’s personal data in accordance with this Privacy Statement and applicable laws.

9. Do we transfer your personal data outside the European Union?

All Otava Group companies are Finnish and are companies based in Finland. As a rule, we process personal data within the European Union.

However, in some cases, Otava may use resources and servers around the world and co-operate with parties in third countries when offering and designing services. In such cases, Otava may transfer your personal data outside the country in which the services are used, and possibly also to countries outside the EU where the data protection legislation is different. In these cases, Otava ensures that there is a legal basis for the transfer of data in accordance with European data protection law and that the user’s personal data is protected, for example by transferring data on the basis of an equivalence decision, by using standard contractual clauses, and/or by requiring appropriate technical and other data protection measures.

Otava processes personal data obtained through the social media websites described below only for its own purposes, such as communicating about new products, services or offers, implementing competitions and prize draws, receiving feedback, purchasing advertising, measuring the accessibility of pages or advertisements, and customer service. However, these service providers may have their own purposes for which they process your personal data. You can read more about the processing of personal data by these parties in their own privacy policies, which are linked below.

Facebook

Otava uses embedded content and pixels from Facebook (service provided by Meta Platforms Inc.) on its website. To use these, we need your consent, which you can give or withdraw in the Cookie Settings which will be displayed when you visit the Otava website. You can find them later at the bottom of the page. In the book business, such pages include, for example, Otava and Otava Learning. In addition, Otava has fan and community pages on Facebook.

Depending on the processing, Otava acts either as a joint controller with Facebook or as a processor for Otava’s activities. For more information on how Facebook processes your personal data, please see the Facebook Privacy Policy: www.facebook.com/privacy/.

LinkedIn

Otava’s website contains a link to the website of LinkedIn Corporation (hereafter “LinkedIn”). In addition, Otava has its own page on LinkedIn. In the book business, such pages include, for example, Otava.

Depending on the processing, Otava acts either as a joint controller with LinkedIn or as a processor for Otava’s activities. For more information on how LinkedIn processes your personal data, please see the LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

TikTok

Otava also markets its products in the TikTok application provided by TikTok Technology Limited. For more information on how TikTok processes your personal data, please see the TikTok Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

YouTube / Google

On its website, Otava uses embedded content from YouTube, which is owned by Google LLC. In addition, Otava has a community page on YouTube. Depending on the processing, Otava acts either as a joint controller with YouTube or as a processor for Otava’s activities. For more information on how Google processes your personal data, please see the YouTube Privacy Policy: https://support.google.com/youtube/answer/10364219?hl=fi&ref_topic=9257519.

Other links and cookies on the website

Due to the nature of the services we provide, they can also contain links and cookies to sites other than those mentioned above. For example, the Otava.fi website contains links to authors’ own websites, social media channels, and the websites of authorities and partners. We recommend that you review the privacy policy for each site. You can find more information on cookies later in this Privacy Statement or in the website’s Cookie Settings.

10. How long do we process your personal data?

Otava processes your personal data for as long as one of the bases for processing indicated in this Privacy Statement is in force. For example, in some cases, Otava has a legal obligation to process personal data for a longer period. The most common reasons for processing and storage periods are described below.

The required data can be processed as follows:

The personal data of customers and recipients of renumeration may be processed to the extent required by accounting legislation for a period of six (6) years from the time of purchase, renumeration or similar payment.
The identification information of customers and users of Otava’s online services may be processed for a maximum of six (6) years from the end of the customer relationship.
The personal data of corporate customers may be processed for a maximum of six (6) years after the person’s role in the company has changed and they no longer, for example, exercise their profession related to Otava’s business activities or act as a representative of Otava’s corporate customer.
The personal data of a corporate customer registered in Otava’s digital service can be processed for the duration of the customer relationship in the service and for two (2) years after the end of the customer relationship.
Information necessary for the settlement of copyright claims may be processed for the duration of the copyright and related rights and for a maximum of seventy (70) years after the death of the author.
Event participation data can be processed for two (2) years after the event. The contact details of the event’s participants may also be processed after this period if there are other bases for doing so.
Data provided for market research and development projects may be processed for a period of two (2) years following the collection of said data or the end of continuous data collection, such as when a teacher leaves a position.
The personal data of the reviewers of learning material manuscripts may be processed for six (6) years after the submission of the review.
In individual cases, we can also store data for a longer period if the processing of the data is necessary to establish, submit or defend against a legal claim, such as in cases of customer complaints.
User of Otava’s digital learning material: please refer to the How long do we store your data?section in the digital learning material section for more details.

We can use cookies and related data for as long as is indicated in the cookie banner in question.

11. How can you exercise your rights to your personal data?

You can always contact us freely if you have questions about the processing of your personal data. Below you can find information on your rights under the General Data Protection Regulation. Please note that the legal grounds available may vary depending on the legal basis of the processing. If you wish to exercise your rights, you can send a free-form message to the contact channels provided in the section concerning the data controller in this Privacy Statement.

As a rule, we will implement your request within one month. However, in some cases, we may inform you that we need more time to complete your request. In this case, your request will be implemented within three months.

If necessary, we may request additional information from you to clarify and respond to your request. This is the case, for example, if we cannot identify you sufficiently based on your request.

Your rights are:

a) Right to access the personal data collected about you.You have the right to know whether or not your data is being processed and what data we process about you. Once we receive a request for verification from you from which you can be identified, we will provide you with a copy of the personal data that is being processed about you.
b) Right to request the rectification of personal data collected about you. If you notice any errors or omissions in your data, you may submit a request for rectification and tell us how you wish your data to be rectified.
c) Right to request the deletion of personal data collected about you.In certain situations, we have the obligation to delete your data if one of the following criteria is met and no other legislation or official regulation imposes an obligation to store the data:

The personal data is no longer needed for the purposes for which it was processed.
Your data is being processed based on your consent and you withdraw your consent and there is no other legal basis for the processing.
You object to the processing in connection with your specific personal situation and there is no justified reason for the processing.
You object to the processing of your personal data for direct marketing purposes.
Your personal data has been unlawfully processed.
Your personal data must be deleted in order to comply with a legal obligation applicable to Otava under European Union or Finnish law.
Your personal data has been collected in connection with the provision of information society services, such as ordering Otava’s digital information services.

d) Right to request that the processing of your personal data be restricted.You may request Otava to restrict the processing of your personal data. You may request the restriction of the processing of your personal data, and the processing will be restricted when:

you deny the accuracy of your personal data stored by Otava and we confirm the accuracy of it;
the processing is unlawful and you ask to restrict the use of the data instead of deleting it;
Otava no longer needs such personal data for the processing purposes, but you need it to establish, present or defend a legal claim;
you have objected to the processing of your personal data pending verification of whether Otava’s legitimate grounds override your grounds.

e) Right to object to the processing of your personal data.If Otava processes your data based on a legitimate interest, you have the right to object to the processing of personal data about you on the basis of your specific personal situation. In addition, you always have the right to object to the processing of your personal data for direct marketing purposes.
f) Right to transfer the data you have submitted from one system to another.If your personal data is processed automatically and the processing is based on consent or a contract, you have the right to receive the personal data you have submitted to Otava in a structured, commonly used and machine-readable format and, if technically possible, to transfer that data to another controller.
g) Right to withdraw consent.If all or some of your personal data is processed on the basis of your consent here, you have the right to withdraw your consent.
h) Right to lodge a complaint with a supervisory authority.If any disagreement regarding the processing of your personal data cannot be settled in an amicable manner between you and Otava, you have the right to submit the matter to a data protection authority for resolution. In Finland, the data protection authority is the Office of the Data Protection Ombudsman.

12. Are you obligated to provide your personal data to us?

In nearly all situations, Otava must receive and process your personal data in order to fulfil its contractual obligations related to a product or service you have purchased or ordered. Without the necessary personal data, we cannot offer you the products and services that require the processing of your personal data. However, you are not obligated to provide your information, for example, in order to use cookies that are not necessary for the functioning of the website.

13. Which country’s legislation applies to the processing of your personal data?

We are a Finnish group of companies operating in Finland. Finnish legislation and EU legislation directly applicable in Finland, such as the Data Protection Act and the EU Data Protection Regulation, apply to the processing of personal data by Otava.

14. How do we update this Privacy Statement?

We are constantly developing our business, which may cause changes to the processing of personal data. If necessary, we will update the Privacy Statement to reflect our changing practices. The changes can also be based on changes in legislation. We recommend that you review the content of the Privacy Statement regularly.

15. Cookies

The Otava website uses cookies. Cookies are small text files that your browser stores on a terminal device, such as a computer or mobile device, when you visit websites. Cookies refer to all identifiers that are stored on the user’s terminal device. Our site uses essential cookies, functional cookies, analytical cookies and marketing cookies. You can find our current cookies in the Cookie Settings menu at the bottom of the web page.

We use cookies to ensure that we offer as user-friendly and high-quality services as possible. In addition, we use cookies and other analytical tools to collect anonymous statistics on the use of the site to improve its content. The services store information about the page you visit, the duration of your stay on the site, the links you click, and the site you came from, among other things. Cookies can also be used to target our own advertising on third-party websites. These cookies allow us to target our advertisements to users who are most likely to be interested in Otava’s services.

In addition to the cookies set by Otava, the site may also contain third-party cookies, which are often set by the site’s partners. Third parties may use information collected through cookies for their own purposes. Our website uses our partners’ cookies, which may track the user outside Otava’s website and combine the information they collect from other websites about the user. Such partners are described earlier in the section “Do we transfer your personal data outside the European Union?”

Necessary cookies are always turned on, as the site will not work properly without them. We will not request consent for the use of these cookies. For all other cookies, such as functional, analytical and marketing cookies, we request the user’s active consent with the so-called cookie banner. The user may at any time withdraw or change their consent from the Cookie Settings located in the bottom banner of the Otava website. If consent has not been given, cookies that are used for the handling purpose in question are not placed on the user’s terminal. Depending on the cookie, this may prevent the user from seeing all of the content on our website and the website to operate in the most user-friendly way possible.

You can also manage cookies with most browsers if you so wish. You can delete cookies stored on your device through your browser settings. You can read about the properties of different browsers on each service provider’s website. You can find more information about cookies and ways to protect privacy on the internet at www.youronlinechoices.eu.

You can give or withdraw your consent to cookies at the beginning of your visit to the website, or later through the Cookie Settings link at the bottom of the Otava website.