1. The Controller 

The controller (hereinafter “controller”) is:  

Helsinki Allas Oy (Allas Pool)  

Business ID: 2568884-1  

Address: Katajanokanlaituri 2a, 00160 Helsinki, Finland  

For questions regarding the processing of personal data, please contact: info@allaspool.fi. 

2. The person responsible for the register 

Emilia Alatalo 

Phone: +358 505 169 910 

Email: emilia.alatalo@allaspool.fi 

3. What do we mean by different terms? 

By “data subject” we mean the person whose personal data is processed by the controller in its personal files.  

“Personal data” means any information relating to an identified or identifiable natural person, i.e. the data subject, such as name, address, e-mail, telephone number and transaction history.

“Customer” means consumers and contact persons of companies and other entities (hereinafter “company”) with whom the controller has a customer relationship, or with whom a customer relationship has lasted for three calendar years or less.   

“Potential customers” means consumers and business contacts with whom the controller is seeking to establish a new customer relationship or renew a customer relationship that ended more than three years ago.   

“Stakeholders” means consumers and business contacts with whom the data controller has a working relationship (for example, representatives of businesses providing services to the data controller) or other relationship (for example, social decision-makers in the context of public relations activities). 

4. For what purposes do we process your personal data? 

The controller processes the personal data of data subjects for the following purposes (one or more at the same time):   

Management, analysis and development of customer and stakeholder relations  

The controller may process your personal data for the management, analysis and development of a customer relationship with you directly or with a company you represent.  

Provision of products and services   

The controller may process your personal data for the provision of products and services where you or a company you represent have purchased or used our products and/or services, subscribed to the controller’s newsletter or other digital content, or participated in the controller’s events. Personal data is processed for the purposes of performing the rights and obligations arising from a contract or other commitment between the controller and the customer.  

Customer communications  

The controller may process your personal data in its customer communications, for example, to send you notifications about products and services, to inform you of changes to products and services, and to request feedback on products and services. 

Marketing  

The controller may contact you through direct marketing to tell you about new products, services and benefits of the controller and its partners. The controller may process your personal data to tailor its offerings and provide relevant content. This means, for example, that the controller may provide recommendations or display tailored content and tailored advertisements on its own and third-party services, including targeted online advertising and social media.  

Development of services  

The controller may process your personal data to develop its services, for example to improve its range of products and services to make them more interesting and useful to customers. 

The legal basis for the processing of personal data is the following subparagraphs of Article 6 of the EU General Data Protection Regulation:   

1. processing is necessary for the performance of an agreement to which you are a party or for the performance, at your request, of pre-contractual measures;  
2. processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by your interests requiring the protection of personal data or by your fundamental rights and freedoms;  
3. you have given your consent to the processing of your personal data for one or more specific purposes; and/or  
4. processing is necessary for compliance with a legal obligation of the controller.  

The controller processes your data to perform a contract with you or with a company you represent (e.g. for the provision of swimming, concert and restaurant services).   

The controller has legitimate business interests, such as the right to promote its products and services through marketing and sales, and the controller may use your contact details for direct marketing and sales on the basis of legitimate interests. Other legitimate interests of the controller on the basis of which your personal data may be processed include providing advice and other customer service to non-customers, further developing the business and investigating possible misuse. 

If the processing is not based on a contractual need or legitimate interest, the controller may request your consent for other types of processing of personal data, such as processing of data classified as sensitive and electronic direct marketing to potential consumer customers.  

The controller may also process your personal data where required to do so by law, for example, on the basis of the retention obligation under the Accounting Act. 

5. What types of data can we handle? 

The types of personal data collected by the controller may include, but are not limited to, the following types of data and any changes made to them:  

1. Basic information about all data subjects 

a. First name and surname   

d. Contact info (postal address, email address, telephone numbers) 

c. Language  

d. The communication to the data subject and the activities related to that communication (such as clicking on any personalised links in email marketing)  

e. Direct marketing choices  

f. Information about the use of the controller’s digital services and content created by the data subject on the services (such as content created by the data subject on the controller’s social media accounts)  

g. Information about cookies and other similar activities sent to the data subject’s terminal equipment (such as computers and mobile devices) and the data collected through them, where the data subject is identifiable on the basis of that information  

h. Any recordings of customer service calls and recorded email and online conversations relating to customer service, for example on social media channels 

2. Additional information on business representatives 

a. the name and other relevant identification data of the company represented by the data subject in relation to the controller  

b. title and/or job description 

3. Data subjects who have purchased, used and provided feedback on the controller’s products and/or services  

a. the date and nature of the beginning and end of the customer or similar relationship 

b. the date on which membership commenced and, where applicable, the date on which it ended  

c. the number of visits by the member, monthly pass holder and serial card holder  

d. customer promotions and their use (including payment methods)  

e. interests and other information provided by the customer  

f. the content, correspondence and follow-up of customer feedback and possible complaints  

4. Sensitive personal data  

Where the data subject voluntarily and with his or her own consent provides the controller with sensitive personal data (such as health data in connection with the suspension of membership) 

6. What sources do we use to collect your personal data? 

• The controller obtains much of your personal data from you at the beginning and during the course of your relationship with us and from the software that you use to access our services.   
• Where necessary, the controller receives your personal data from a ticketing partner company, currently Lippupiste Ltd, acting on its behalf, when the data subject purchases tickets for events on the controller’s premises through the partner.  
• The controller also receives personal data and updates thereof from public authorities and organisations that provide services for obtaining and updating personal and credit data, as well as from public directories and other public data sources, such as websites and social media channels. The controller also collects personal data from data subjects for marketing purposes in connection with various activations such as lotteries, competitions, surveys or events (by the controller or their partners).  
• The controller receives personal data from company representatives in addition to their colleagues, i.e. the main contact person of the company may also disclose personal data to the controller about other persons related to the use and marketing of the controller’s services. 

7. With whom can we share your personal data? 

• The controller will not give, sell or otherwise disclose your personal data to any third parties outside the controller, unless otherwise stated below.  
• The controller may share your personal data with third parties providing services to the controller. These services may include, for example, customer service, ticketing, software services, research, marketing and event production. The controller may share your personal data for the purpose of collecting payments and may, for example, transfer or sell unpaid invoices to third parties providing collection services.   
• The protection of your personal data is important to the controller and we will not allow these sub-parties to use your data for any purpose other than to provide the agreed services, and we require them to protect the personal data of data subjects in accordance with this Privacy Policy and applicable law.  
• The controller may share your personal data with other carefully considered partners with whom the controller jointly manages and implements projects, such as events. 
• The controller may share your personal data with carefully considered third parties, for legitimate reasons, for joint or independent direct marketing purposes. Data may be shared for such purposes only where the intended use by the third party is not incompatible with the purposes of use set out in this Privacy Policy. In principle, a very limited amount of information will be shared, mainly the name and contact details of the individual for the purposes of contacting him/her, for the purposes of contacting him/her in the ways permitted by law. 
• The controller may share your personal data in the context of an acquisition or other business reorganisation or when the service is transferred to another service provider. The controller may share your personal data on the order of a court or equivalent. 

8. Do we transfer your personal data outside the EU? 

The controller may use resources and servers located around the world to provide services. The controller may therefore transfer your personal data outside the country where the services are used and possibly also to countries outside the EU with different data protection laws.  

In these cases, the controller will ensure that there is a legal basis for the transfer and that the personal data is protected, for example by using standard contracts and processing agreements approved by the relevant authorities (where applicable), and by requiring compliance with appropriate technical and other data protection measures. 

9. How long do we process your personal data? 

The controller will process your personal data for as long as the controller has any of the grounds for processing described in Section 3 of this Privacy Policy in force, and for a reasonable period thereafter.  

The controller may process personal data of customers for the duration of your customer relationship and until the end of the year following the year in which the relationship ends. Thereafter, the controller may transfer your limited, necessary personal data to a marketing register and process you again as a potential customer.   

The controller may process the personal data of potential customers for the time being until you become a customer or until you request the removal of your data from the controller’s marketing register. How long do we process your personal data? 

The controller will process your personal data for as long as the controller has any of the grounds for processing described in Section 3 of this Privacy Policy in force, and for a reasonable period thereafter. 

The controller may process customers’ personal data for the duration of your customer relationship and until the end of the year following the year in which the relationship ends. After this period, the controller may transfer your limited, necessary personal data to a marketing register and process you again as a potential customer.   

The controller may process the personal data of potential customers for the time being until you become a customer or until you request the removal of your data from the controller’s marketing register. 

10. How can you exercise your rights in relation to your personal data? 

As a registered user, you have various possibilities to influence the processing of your personal data. As a general rule, we will comply with your request within one month. Please contact us at the contact details provided in section 1 of this Privacy Policy to exercise your rights. Your rights include (the extent of these rights depends on the basis on which your personal data are processed, i.e. not all the rights listed below will be available to you in all situations):  

1. The right of access to the personal data collected about you. In practice, this takes the form of a report on the personal data we have collected about you, based on your duly justified and identified request.  

2. The right to request the rectification or erasure of personal data collected about you. If you notice any errors or omissions in your data, you may submit a request for rectification.   

3. The right to request the erasure of personal data collected about you. We are obliged to delete the personal data you have requested from our personal data file if one of the following criteria is met and there is no other legal or regulatory obligation to retain the data: 

a. the personal data are no longer needed for the purposes for which they were processed;  

b. you withdraw your consent and there is no other lawful basis for the processing;  

c. you object to processing in relation to your particular personal situation and there is no legitimate ground for the processing or you object to the processing of your personal data for direct marketing purposes;  

d. your personal data have been processed unlawfully;  

e. your personal data must be erased in order to comply with a legal obligation under European Union law or Finnish law to which the controller is subject; or  

f. your personal data has been collected in connection with the provision of information society services, such as subscriptions to the controller’s digital information services.  

4. The right to request restriction of the processing of personal data collected about you. You may request the controller to restrict the processing of your personal data if:   

a. you contest the accuracy of your personal data held by the controller;  

b. the processing is unlawful and you request restriction of use instead of erasure;  

c. the controller no longer needs the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims;  

d. you have objected to the processing of personal data pending verification of whether the legitimate grounds of the controllers override your grounds.  

5. The right to object to the processing of personal data concerning you. Where the controller processes your data on the basis of a legitimate interest, you have the right to object to the processing of personal data concerning you on grounds relating to your particular personal situation. Anyone on the registers covered by this Privacy Policy has the right to object to the processing of their personal data for direct marketing purposes.  

6. The right to transfer your data from one system to another. If the automated processing of your personal data is based on consent or on a contract, you have the right to receive the personal data you have provided to the Controller in a structured, commonly used and machine-readable format, and the right to transfer those data to another controller.   

7. Right to withdraw consent. If all or part of your personal data is processed in this register on the basis of your consent, you have the right to withdraw your consent.   

8. The right to lodge a complaint with a supervisory authority. If a potential disagreement between you and the controller regarding the processing of your personal data cannot be amicably resolved, you have the right to refer the matter to the Data Protection Authority for a decision by the Office of the Data Protection Ombudsman.  

11. Which country’s legislation applies to the processing of your data? 

Finnish law and EU law directly applicable in Finland, such as the EU General Data Protection Regulation, apply to the personal data files of the controller and the processing of personal data contained therein. 

12. How can we update this Privacy Notice? 

The controller is constantly developing its business operations and this may also mean changes in the processing of personal data. We will update this privacy statement as necessary to reflect changes in our practices. Changes may also be based on changes in legislation. We recommend that you consult the contents of the Privacy Policy regularly.  

If the controller starts processing your personal data for a purpose other than that for which your personal data was originally collected, we will notify you of this and the updated Privacy Policy before such further processing. For any other changes, we will inform you on our website when the Privacy Policy is updated.