Privacy Policy
Information on personal data processing according to the General Data Protection Regulation (EU) No. 2016/679.

1. Name of the register
Online Store User Register

2. Data controller and contact person of the register
Suomen Rakennusmedia Oy
Heidi Husari, CEO
heidi.husari@rakennusmedia.fi
040 831 2829,  09 129 9249
Eteläranta 10, 00130 Helsinki

3. Purpose of personal data processing
Personal data stored in the Register are processed and used to manage customer relations, to ensure orders for training products, for marketing purposes, customer communication, and other online-service related activities, such as statistics. Only personal data necessary for the operation are collected from online store users.

Our online store uses an AI-based customer service assistant that answers customers’ general questions based on the content of the online store (e.g. instructions and frequently asked questions). The assistant is not connected to customer registers, order information, or other systems, and it does not have access to personal data.

4. Regular sources of data
The data controller records the data provided by the user himself or herself when using the website.

5. Data contained in the register 

The following user data are collected:

• Corporate customer
  • First and last name
  • Business ID
  • Company
  • Country/region
  • Street address, postal code, post office
  • Phone
  • E-mail address

• Private customer
  • First and last name
  • Country/region
  • Street address, postal code, post office
  • Phone
  • E-mail address

• Participant specified by the customer
• First and last name
• E-mail address
• Phone
• Tax number
• Name of the completed training and date of completion

6. Basis of processing
A contractual relationship or preparation thereof is the legal basis for the processing of personal data for the purposes of providing our services, concluding customer contracts, and handling orders and the related obligations. 

Legitimate interests of the data controller or a third party may also serve as the legal basis for the processing of personal data. Customer relationship management, customer communication, processing of personal data related to marketing (including direct marketing) and statistics, as well as handling of complaints and legal processes are based on legitimate interest. When personal data is processed based on legitimate interest, the benefits and potential risks to the data subject are carefully assessed in accordance with the guidelines defined by the Data Protection Ombudsman.

7. Regular disclosure of data
Data provided by a corporate customer or private customer about the participants are transferred to Suomen Rakennusmedia Oy’s register of online training participants for the purposes of training completion.

From the register of training participants, the data are disclosed further to Vastuu Services Oy for maintaining training results in online services of Vastuu Services. From there it can be disclosed further to employers of the registered person and/or those contractual partners of the registered employer who need the data due to checking compliance with occupational safety, legislation or contractual requirements, or quality management (for example, main contractor of the site, main contractor or the employer of the shipyard area). Training results can be disclosed for similar purposes also through partners belonging to partner program of Vastuu Services Oy.

Moreover, from the register of training participants, the data are disclosed further to Zeroni Oy for maintaining training results in the Zeroni access control system.

Necessary information from the register concerning companies and their contact persons is disclosed to RATEKO’s and Suomen Rakennusmedia’s customer and stakeholder register (RATEKOn ja Suomen Rakennusmedian asiakas- ja sidosryhmärekisteri) for justified purposes of use, such as informing about current trainings, in accordance with applicable legislation.

Information essential for providing the service is disclosed from the register to third parties, such as the payment intermediary when paying online, the accountant for bookkeeping purposes, and the collection agency when invoices are overdue and transferred to collection. Details of orders in collection are also transferred to a separate debt collection register maintained by Suomen Rakennusmedia Oy (Suomen Rakennusmedia Oy:n perintärekisteri).

Personal data in the Register are not transferred outside the EU or the EEA.

9. Data storage and protection
We store personal data for as long as is necessary to fulfil the purposes specified in the Privacy Policy and always for the time required by legislation (for example, responsibilities and duties related to accounting obligations or reporting obligations).

Information in collection is retained for the duration necessary for collection actions. For other orders, the retention periods are as follows: We retain personal data related to one-time orders for 1 year, after which the personal data is deleted. We retain personal data related to expired subscriptions for 1 month after the subscription ends, after which the personal data is deleted from the subscription and any related orders. We retain credited, pending, failed, and cancelled orders for 1 month, after which they are deleted. We retain unused online store user accounts for 1.5 years (no orders placed or no logins), after which the user account is deleted. This does not apply to user accounts with an active subscription.

User data are stored in the system in such a way that the data can be deleted and modified in accordance with data protection legislation, if necessary. Upon data storage, the possibility of deleting and modifying the data without losing or changing other data is considered.
We use appropriate technical and organisational safeguards to protect personal data. The right to access personal data is limited only to specifically authorised entities. Entities processing personal data have a duty of confidentiality in case of matters related to the processing of personal data.

Users of the AI-based customer service assistant are requested not to enter personal data or order information into the conversation. The assistant is not intended for the processing of personal data. If, despite this, a user enters personal data into the conversation, the data will be processed as follows:

• The data is processed technically only for the purpose of generating the conversation.
• The data is not used for maintaining customer registers, marketing, or any other purposes.
• The data is not stored permanently nor combined with other data.
• The data is not disclosed to third parties.

The content of chat conversations with the AI-based customer service assistant is not stored permanently and is automatically deleted from the system after a technical retention period. Only statistical data (such as the number of messages) is collected from the conversations, and the statistics do not include personal data.

10. Right of inspection
A data subject has the right to know what data about him or her are processed in the Register. A data subject may request the inspection of his or her personal data from the data controller.

11. Right to request correction of data, right to request deletion or restriction of processing of data
Under circumstances specified in the EU General Data Protection Regulation, a data subject has the right to request the correction, supplementation or deletion of his or her personal data or restriction of processing of the data.

12. Right to object to processing of personal data
A data subject has the right under the EU General Data Protection Regulation to object to processing of his or her personal data for a reason related to his or her particular situation.

13.  The right to withdraw consent
If processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw his or her consent to the processing of his or her personal data. Withdrawal of the consent has no effect on processing carried out prior to the withdrawal.

14. Use of rights
In the above matters, a data subject may turn to the contact person designated by the data controller. Requests concerning the data subject’s rights can be submitted in writing and signed to the address: Suomen Rakennusmedia Oy/asiakaspalvelu, Eteläranta 10, 00130 Helsinki, or by contacting the data controller’s contact person by e-mail. The identity of the person submitting the request can be checked separately before the request is processed. A request will be answered within a reasonable time, in principle, within one month from the submission of the request and verification of the identity. If the request cannot be granted, the refusal will be notified separately.

15. Right of complaint submission to the data protection authority
A data subject has the right under the EU General Data Protection Regulation and the Data Protection Act to submit a complaint to the data protection authority regarding the processing of personal data described in the Privacy Policy. In Finland, the data protection authority is the Data Protection Ombudsman (www.tsv.fi).

Page last updated on: 4.3.2026