Privacy policy

This privacy policy has been drawn up in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) and the Finnish Data Protection Act (1050/2018).

CONTROLLER

Kyröön Kievari Oy / Kyrö Distillery Home (business ID 2625218-5), Oltermannintie 6, 61500 Isokyrö, Finland (hereinafter “Kyrö”). Kyröön Kievari Oy is a wholly owned subsidiary of Rye Rye Oy (Kyrö Distillery Company).

The controller of the cask owner register is Rye Rye Oy / Kyrö Distillery Company (business ID 2502509-5), Oltermannintie 6, 61500 Isokyrö, Finland. Rye Rye Oy processes personal data related to cask sales and cask contracts.

The controller of job applicants’ data is the company whose vacancy you apply for: Kyröön Kievari Oy or Rye Rye Oy.

For data that Rye Rye Oy processes as controller, “Kyrö” in this policy means Rye Rye Oy, and the policy otherwise applies to it in the same way.

Contact person: Jenni Sivula, gdpr@kyrodistillery.com / +358 50 408 6575

PURPOSE OF PROCESSING PERSONAL DATA

Trust and openness are among the most important values of Kyrö Distillery Company. We want you to know that you can trust us and the way we handle your personal data, and in this privacy policy we explain our practices openly. Here you will find information about our company, how we collect and use personal data about you, and how you can exercise your privacy rights.

Kyrö’s personal data register consists of the customers of Kyrö Distillery Company and the visitor centre Kyrö Distillery Home, such as distillery visitors, cask owners, online shop customers, newsletter subscribers, contact persons of business customers and suppliers, potential customers and job applicants. The purpose of the register is to manage and maintain customer relationships, to inform about our activities, and other processing of personal data in accordance with data protection legislation for purposes related to Kyrö’s operations. We use your valuable data to ensure high-quality communication; see section 2 below.

1. WHAT PERSONAL DATA DO WE COLLECT?

We mainly receive the data from the data subjects themselves when they contact our company, register as members, take part in a survey, subscribe to the newsletter, make a purchase in the online shop or in the restaurant against an invoice, and when a customer relationship or partnership begins.

The personal data Kyrö collects mainly falls into the following categories:

1.1 Personal data you provide voluntarily

When you contact us, we keep and store the necessary personal data you have voluntarily given us, for example when using our website. Such data includes your name, date of birth, phone number, email address or other contact details such as your address.

To maintain the customer relationship and for the contract to take effect, we also collect, among other things, the following data: customer number, language of customer communications, customer role (cask owner, online shop customer, distillery restaurant customer, representative of a partner), preferred way of contact (email, phone, post); information you have given us, such as direct marketing prohibitions and consents, additional information and possible contact persons of business customers; information on purchases and on the services the customer has bought (we do not use online shop history for profiling customers); photographs from events.

If you do not provide us with the data needed to manage the customer relationship, we cannot enter into a contract with you or ensure that our services are fully provided.

1.2 Automatically collected personal data, analytics and profiling

We do not use personal data or store data to profile our customers, and we do not use automated processing of the data we receive directly from our customers.

Data used for analytics and for targeting marketing is non-identifiable whenever possible. Non-identified data cannot be linked to a natural person. Otherwise we treat data as personal to the extent that the identifier contains information that can be linked to a customer, such as an IP address. We use Google Analytics for analytics on the use of our website. The data sent to Google is anonymised. Read more about how Google Analytics processes data.

When you visit our distillery or restaurant, our premises have a camera surveillance system for safety reasons. Recordings are used only in a limited way to investigate possible misconduct.

1.3 Personal data obtained from third parties

Kyrö may also collect, store and update personal data from the registers of a controller providing address services.

1.4 Processing of sensitive data

We do not ask for or store sensitive personal data about you, such as data on your health, ethnic origin, religion, political opinions or sexual orientation.

2. HOW WE PROCESS YOUR PERSONAL DATA

At Kyrö we use your personal data for the following purposes:

2.1 To provide our services to you

To serve you as well as possible, we need some of the personal data mentioned above. Our newsletters and announcements are important for your customer relationship, and we promise that the mail you receive from us relates to your customer relationship and is relevant to you. If you have bought one of our services, keeping the appropriate personal data ensures that we can serve you throughout your customer relationship.

2.2 To improve our services

We are constantly looking for new ways to develop, and our customers play a particularly important role in this. We collect feedback and have a dialogue with our customers, collecting personal data in the course of these conversations. Please note, however, that in feedback surveys, for example, personal data is not processed together with the answers, so answers cannot be linked to the respondents. At Kyrö, your address is not used for automatic location but to target marketing messages better and to make sure you receive information about relevant events.

2.3 To inform you about our companies

Our messages keep you up to date on the world of rye. We do not spam or clog your inbox. We also make sure that the messages you receive are timely and that you receive them at the right frequency – not too often and not too rarely.

2.4 Personal data given by email or post

Let’s keep in touch! When you contact us by email or post, we keep the personal data you give us to handle customer service as well as possible. If you send us a job application and CV, we keep your personal data for the recruitment process. We do not analyse recruitment data automatically.

2.5 To meet our legal obligations

For contractual and accounting reasons, we may be legally obliged to keep your personal data. In addition, if you ask us not to contact you any more, we ask for your permission to keep basic details so that we can respect your request.

3. LEGAL BASES FOR PROCESSING PERSONAL DATA

The collection and processing of data are based on the following legal grounds: Contract (Article 6(1)(b) GDPR): so that we can fulfil our obligations under the terms of our contracts (purchases, newsletter subscribers, cask owners).

Legitimate interest (Article 6(1)(f)): our legitimate interest in providing high-quality services and information to you, and our legitimate interest in ensuring the efficiency and lawfulness of our business (where these do not conflict with your rights).

Legal obligation (Article 6(1)(c)): compliance with the laws and obligations that apply to us.

Consent (Article 6(1)(a)): where you have given your consent to the processing of personal data, for example by subscribing to the newsletter. You can withdraw your consent at any time.

4. WHO DOES KYRÖ SHARE YOUR PERSONAL DATA WITH?

We only disclose relevant personal data to selected external partners to manage customer relationships and marketing. A data processing agreement in accordance with the Regulation has been made with every external partner, and the processing is carried out in accordance with the General Data Protection Regulation. External partners do not pass personal data on to subcontractors.

For technical reasons and reasons related to the use of the data, data may be stored on the servers of external service providers used by Kyrö. These external service providers may process the data, and this may also mean processing outside the EU/EEA. Kyrö undertakes to primarily use service providers operating in the EU/EEA and to ensure, through appropriate certificates, that the services it uses comply with the GDPR. If we use a partner outside the EU/EEA, the transfer is based on an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the Commission.

5. HOW DO WE PROTECT YOUR PERSONAL DATA?

Our staff are trained in the General Data Protection Regulation, and this training is part of our induction programme. Our staff have the knowledge and instructions needed to ensure that personal data is processed and stored securely.

Paper records are kept in locked premises that only authorised persons can access. There are instructions for the use of digitally processed personal data, and access to the register is limited so that only those persons who need the data for their work can access and use it. Access to the data requires a password and a username. The data is technically protected by a firewall, and all devices are protected with appropriate measures.

We constantly take care to process your personal data securely, but if we notice that a data breach has occurred, we report it to the data protection authority and to those concerned within 72 hours.

6. TRANSFER OF DATA OUTSIDE THE EU AND EEA

For technical reasons and reasons related to the use of the data, data may be stored on the servers of external service providers that we use. These external service providers may process the data, and this may also mean processing outside the EU/EEA. We undertake to primarily use service providers operating in the EU/EEA and to ensure, through appropriate certificates, that the services we use comply with the GDPR.

7. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We keep the data we collect for as long as it is necessary for the purposes of processing defined in this privacy policy, unless the law requires or permits a longer retention period. After that we delete all the above data in our possession within a reasonable time.

8. YOUR DATA PROTECTION RIGHTS

In all our activities we are committed to carefully processing only appropriate personal data. On request, and once we have verified the identity of the person asking, we will provide all the data we have stored about them.

You have access to all the data we keep about you, as well as information on how your data is used at Kyrö and where it was obtained. You can ask us to correct or complete your data at any time. You can edit your customer details in your customer account. Other data is available on request.

Once we have received the information needed to verify your identity, we will provide your data within one month.

You have the right to restrict the use of your data and to withdraw your consent to its use. You can also prohibit direct marketing, but if you do, you will no longer receive news from us about Kyrö. To make sure your prohibition is respected, we ask for your consent to keep the necessary data.

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you. Kyrö as the controller may then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims. You have the right to ask for your data to be transferred from Kyrö to another controller where the processing is based on a contract or on consent.

If you have any questions about data protection at Kyrö Distillery Company or Kyrö Distillery Home, please contact us and we will do our best to help you and find a solution together. You can contact our data protection contact person Jenni Sivula at GDPR@kyrodistillery.com. You also have the right to lodge a complaint with the supervisory authority, which in Finland is the Office of the Data Protection Ombudsman (tietosuoja.fi).

9. AGE LIMIT

You must be of legal age to use our website. As a responsible operator in the alcohol industry, we never process the personal data of minors.

10. UPDATES TO THIS PRIVACY POLICY

To keep up with possible changes in data protection legislation and with legal, technical and business developments, we reserve the right to amend this privacy policy as necessary. We will inform you by reasonable means if our privacy policy changes significantly.

COOKIE POLICY

As with almost all professional websites, this site uses cookies, which are small files downloaded to your computer to improve your experience. This page describes what information they gather, how we use it and why we sometimes need to store these cookies. We also share how you can prevent these cookies from being stored, although this may downgrade or “break” certain elements of the site’s functionality.

For more general information on cookies, see the Wikipedia article on HTTP cookies.

HOW WE USE COOKIES

We use cookies for a variety of reasons, detailed below. Unfortunately, in most cases there are no industry-standard options for disabling cookies without completely disabling the functionality and features they add to this site. It is recommended that you leave on all cookies if you are not sure whether you need them or not, in case they are used to provide a service that you use.

DISABLING COOKIES

You can prevent the setting of cookies by adjusting the settings on your browser (see your browser’s “help” for how to do this). Be aware that disabling cookies will affect the functionality of this and many other websites that you visit. Disabling cookies will usually also disable certain functionality and features of this site. Therefore it is recommended that you do not disable cookies.

COOKIES WE SET

This site offers newsletter or email subscription services, and cookies may be used to remember whether you are already registered and to show certain content that is only available to subscribers or non-subscribers.

When you submit data through a form such as those found on contact pages or comment forms, cookies may be set to remember your details for future correspondence.

THIRD-PARTY COOKIES

In some special cases we also use cookies provided by trusted third parties. The following section details which third-party cookies you might encounter through this site.

This site uses Google Analytics, one of the most widespread and trusted analytics solutions on the web, to help us understand how you use the site and ways we can improve your experience. These cookies may track things such as how long you spend on the site and the pages you visit, so that we can continue to produce engaging content.

For more information on Google Analytics cookies, see Google’s official page.

We also use social media buttons and/or plugins on this site that allow you to connect with your social network in various ways. For these to work, the following social media sites, including Facebook, will set cookies through our site which may be used to enhance your profile on their site or contribute to the data they hold for the various purposes outlined in their respective privacy policies.

MORE INFORMATION

Hopefully this has clarified things for you. As mentioned above, if there is something you are not sure whether you need or not, it is usually safer to leave cookies enabled in case they interact with one of the features you use on our site. If you are still looking for more information, you can contact us by email.

Email: tech@kyrodistillery.com