Register Description Personal Data Act (523/99) Section 10

1. Data Controller Name: Kansalliskustannus Oy / Verkkouutiset Business ID: 2304017-9 Postal address: Kaisaniemenkatu 4, 00100 Helsinki

2. Person in charge of register matters Name: Kasperi Summanen Postal address: Kaisaniemenkatu 4, 00100 Helsinki Email: [email protected]

3. Name of the register Verkkouutiset customer register

4. Purpose of processing personal data Customer personal data may be processed for the following purposes:

• managing and developing the customer relationship,
• delivering the service,
• verifying customer transactions,
• developing customer service and business operations,
• marketing,
• analysis and statistical purposes,
• opinion and market research, and
• other similar purposes.

5. Data content of the register The register may contain the following data:

• contact information, such as name, address, phone numbers, email addresses,
• registration information, such as username, screen name, password, and other possible unique identifiers,
• age, gender, title or profession, and native language,
• information related to the customer relationship, such as billing and payment information, product and order information, customer feedback and contacts, raffle and competition entry data, and cancellation information,
• data related to the execution of communication and data concerning the use of services, such as browsing and search data,
• profiling and interest data potentially provided by the customer,
• personal identity code for reliable identification regarding paid services and services requiring a high level of data security,
• possible permissions and consents,
• possible direct marketing opt-outs,
• other possible data collected with the customer’s consent.

6. Regular sources of information Data concerning the customer is regularly obtained:

• from the customer directly by phone, via the internet, by email, or by other similar means,
• through cookies or other similar technologies,
• from the Population Register Centre (VRK) / Population Information System, Posti’s address information system, telephone companies’ contact registers, and other similar private and public registers.

7. Regular data disclosures and data transfer outside the EU or the European Economic Area Data is not regularly transferred or disclosed. Data is not regularly transferred or disclosed outside the EU or the European Economic Area.

8. Rights of the data subject

Right of access and rectification The data subject has the right to check the data stored in the register concerning themselves. Contacts regarding the right of access must be made in writing and signed, and sent to the address mentioned in section 1. If there are errors in the registered data, the data subject can submit a request for the correction of the error to the person in charge of register matters mentioned in section 2.

Right of prohibition The data subject has the right to prohibit the data controller from processing data concerning themselves for the purposes of direct advertising, distance selling, and other direct marketing, as well as market and opinion research, personal registers, and genealogical research. In matters concerning prohibition and rectification, the data subject can contact the address mentioned in section 1.

9. Principles of register protection

Manual material There is no manual material.

Electronically stored data Only those employees who have the right to process customer data on behalf of their work are entitled to use the system containing customer data. Each user has their own username and password for the system. The data is collected in databases that are protected by firewalls, passwords, and other technical measures.