Privacy Policy

1. Data controller 

Three-Campus Sports Academy Ltd and its group companies (the “Controller”) 
Kaarina Karin tie 4 
08360 LOHJA 
Tel: +358 19 31 511 

2. Contact person for the register 

Irina Keinänen, Data Protection Officer 
irina.keinanen@kolmekampusta.fi 
Tel: +358 400 633 989 

3. Name of the register 

Customer and marketing register of the Kisakallio Foundation. 

The register is used to process data on the Controller’s customers and prospective customers, and their representatives, as described below. 

4. Data contained in the register 

The register may contain the following categories of data about the data subject: 

  • Name
  • Email
  • Phone number
  • Job title
  • Company and its address details
  • Publicly available classification data
  • Classification data provided by the data subject
  • Order, billing and delivery details
  • Details of services ordered and any changes to them
  • Data collected through cookies
  • Data collected from social media channels
  • Information about the device used by the data subject, such as device type, browser, IP address and other device data
  • Any other data collected with the data subject’s consent 
     

5. Purpose of and legal basis for processing personal data 

The Controller processes personal data for the following purposes: 

  • To manage and administer the customer relationship
  • For customer communications
  • To exercise the rights and fulfil the obligations of the data subject and the Controller
  • For purposes related to online services
  • For research
  • For marketing the services offered by the Controller and its partners
  • To fulfil the Controller’s statutory obligations
  • The Controller’s legal bases for processing personal data under the EU General Data Protection Regulation are:
  • The data subject’s consent
  • Contracts relating to the customer relationship
  • The Controller’s legitimate interest
  • Legal requirements 

6. Regular sources of data 

Personal data is collected from the following sources: 

  • From the data subjects themselves (for example via the Kisakallio website’s contact forms or social media services)
  • Via the Controller’s website (newsletter subscriptions, downloads of materials, event registrations)
  • Via tracking pixels in the Controller’s newsletters
  • Data collected about the data subject when a contract is concluded
  • Data obtained from customer meetings
  • From the data subject’s use of the service
  • From the Controller’s customer data system
  • Other situations in which the data subject discloses their data to the Controller
  • From public sources, such as company websites, the Trade Register, via Leadfeeder or from social media channels (such as LinkedIn)
  • Through cookies and similar technologies 
     

In addition, the Controller uses Google Ads, Google Analytics and marketing automation services to collect visitor data from the website, so that the Controller can analyse and further improve the site and target relevant marketing to site visitors. The data is stored in the register automatically when a user submits information on the website or uses the www.kolmekampusta.fi service. 

7. Regular disclosures of data 

As a rule, the Controller does not disclose data subjects’ personal data to third parties. Data may be disclosed when required by a competent authority, to fulfil contractual obligations, or to the extent agreed with the data subject. In some situations, data subjects’ data may be disclosed to the Controller’s subcontractors or partners. Such parties process personal data confidentially, on the basis of a separate written agreement and in accordance with the Controller’s written instructions. 

The Controller may disclose statistical or anonymised data that cannot be linked to a data subject. 

8. Transfers of data outside the EU or EEA 

Data may be transferred to and stored on a server located outside the EU or the European Economic Area for processing by the Controller, or by the Controller’s partner on the Controller’s behalf, in accordance with the EU General Data Protection Regulation and the Finnish Data Protection Act. 

Where personal data is transferred outside the EU/EEA, this is always done on a lawful basis: 

  • The European Commission has decided that the recipient country in question ensures an adequate level of data protection;
  • The Controller has put in place appropriate safeguards for the transfer of personal data by using standard data protection clauses approved by the European Commission (a copy of which is available on request);
  • The data subject has given explicit consent to the transfer of personal data; or
  • There is another lawful basis for transferring personal data outside the EU/EEA. 
     

9. Data retention period 

Personal data is kept only for as long as necessary to fulfil the grounds and purposes of processing set out in this privacy policy, or for as long as required by law, such as the Finnish Accounting Act. The Controller regularly reviews the need to retain data in accordance with its internal codes of practice. 

10. Rights of the data subject 

The data subject has the following rights; requests to exercise them should be sent to the address given in section 2. If necessary, the Controller may ask the person making the request to prove their identity. The Controller will respond to the data subject within the time limit set out in the EU General Data Protection Regulation. 

Right of access 

The data subject has the right to access the personal data stored about them at any time. 

Rectification and erasure of data (right to be forgotten) 

At the data subject’s request, the Controller will rectify, erase or complete any personal data that is inaccurate, unnecessary, incomplete or out of date for the purposes of processing. The Controller may also rectify, erase or complete data on its own initiative. 

Right to withdraw consent 

Where personal data has been collected on the basis of consent, the data subject has the right to withdraw their consent to the processing of their personal data. 

Right to data portability 

The data subject has the right to have the personal data they have provided on the basis of consent or for the performance of a contract transferred to another controller, where technically feasible. In that case, the Controller will transfer the data in a commonly used, machine-readable format. The Controller is not responsible for the compatibility of the data format with the recipient’s system. 

Right to restrict and object to processing 

Where the Controller processes personal data on the basis of public interest or legitimate interest, the data subject has the right to object to the processing of their personal data, unless there are compelling grounds for the processing that override the data subject’s rights, or the processing is necessary for the establishment, exercise or defence of legal claims. 

The data subject has the right to object to direct marketing, including profiling carried out for direct marketing purposes. Every direct marketing email sent by the Controller contains a link that the data subject can use to opt out of direct marketing emails. 

The data subject has the right to request restriction of the processing of their data if the personal data is inaccurate, the processing is unlawful or the data is no longer needed. 

Right to lodge a complaint 

The data subject always has the right to lodge a complaint with the competent supervisory authority, or with the supervisory authority of the EU member state where they live or work, if they consider that the Controller has not processed their personal data in accordance with applicable data protection legislation. 

11. Principles of data security 

Personal data is kept confidential. The Controller’s data network and the hardware on which the register is located are protected by a firewall and other necessary technical measures. The Controller ensures that stored data, server access rights and other information critical to the security of personal data are handled confidentially and only by employees whose duties require it. 

12. Cookies 

The Controller uses cookies on its websites to improve the user experience and to target advertising. Cookies are small text files that are sent to the user’s computer at the browser’s request and stored there. 

The cookies used by the Controller relate to its marketing automation system (Liana®Marketing Automation), marketing targeting (Google Ads), analysis and tracking of website visitor data (Hotjar and Leadfeeder) and the social media channels used by the Controller (incl. LinkedIn, YouTube, Twitter, Instagram and Facebook). Among other things, the software records which pages a person visits, how long they stay on the site, how they arrived at the site and which links they click. 

13. Changes to this privacy policy 

The Controller reserves the right to amend this privacy policy by giving notice of the changes on this page.