PRIVACY NOTICE FOR THE CUSTOMER AND STAKEHOLDER REGISTER
1. Data Controller
Lammin Betoni Oy (company registration number 0150601-1)
Address: Paarmamäentie 8, 16900 Lammi, Finland
Telephone: +358 207 530 400
Email address: info@lammi.fi
2. Name of the register
Customer and Stakeholder Register
3. Purposes and legal bases for the processing of personal data
The data controller processes personal data in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (2016/679) and the Finnish Data Protection Act (1050/2018).
The purposes of processing personal data are:
- managing customer relationships, customer service and other collaborative relationships
- exercising the rights and fulfilling the obligations of the customer or other stakeholder and the data controller
- processing the personal data of stakeholders (suppliers, subcontractors, other partners) for collaboration and business purposes
- processing personal data for purposes relating to the data controller’s products and services, such as the development, provision, delivery and marketing of products and services
- website visitor tracking and analytics, including the identification of website visitors and the monitoring of their behaviour for the purposes of targeted marketing and service development (e.g. Google Analytics (GA4), Meta Pixel and company-specific visitor identification)
The legal bases for the processing of personal data are, depending on the purpose of the processing, the data controller’s legal obligations, a contract, a data subject’s consent and the data controller’s legitimate interests.
The data controller’s legitimate interests constitute a basis for processing where there is a relevant connection between the data subject and the data controller. Such a relevant connection arises, for example, when the data subject contacts the data controller on their own initiative, or when the data controller processes the data subject’s personal data in connection with, for example, business or collaborative activities between the data subject’s employer and the data controller.
Furthermore, on the basis of a legitimate interest, the data controller may record in the customer register the details of potential customers and their contact persons and representatives whom the data controller can reasonably expect to be interested in purchasing the services or products offered by the data controller.
The data controller may send electronic direct marketing to data subjects who have given their voluntary consent to electronic direct marketing. Consent may be withdrawn easily and at any time. Furthermore, in accordance with applicable data protection legislation, electronic direct marketing may also be sent to recipients where the data controller has reasonable grounds to believe that the products or services being marketed have a material connection to the potential customer’s area of responsibility or job duties.
Consent to direct marketing may be withdrawn by notifying the data controller or by clicking the opt-out option (“Remove from mailing list” or “Unsubscribe” function), whereupon the data subject’s details will be removed from the data controller’s electronic direct marketing subscriber list.
4. Categories of personal data processed
The register contains information on the following individuals:
- The data controller’s customers, as well as their representatives and contact persons
- Representatives and contact persons of the data controller’s subcontractors and suppliers
- Potential customers, subcontractors and suppliers, as well as their representatives and contact persons
- Other parties involved in the data controller’s customer’s construction project (such as contractors, designers, site managers and possible retailers)
- Other individuals belonging to stakeholder groups
The following data, necessary for each of the aforementioned purposes, is processed in relation to the data subject, such as:
- Name
- Email address
- Telephone number
- Home/billing address
- Address details of the construction site(s)
- Company name, business registration number, contact person(s) and position(s)
- Order details, contract and quotation details, invoicing and payment details
- Customer feedback and contact details
- Information based on customer and partnership relationships, such as contact history, feedback and follow-up details
- Additional information provided by the data subject
- IP address and device details
- Website usage data and cookie data
- Newsletter open and click data
- Data collected by analytics and tracking tools (e.g. Google Analytics, Meta Pixel)
5. Regular sources of data for the register
Personal data is generally obtained from the following sources:
- Directly from the data subject themselves for the purposes of managing the customer relationship
- Directly from the data subject themselves in the context of another collaborative relationship
- From public or generally available sources (such as the internet, social media and trade register)
- From a representative of the data subject’s employer or another party with whom the data controller has a customer, business, collaborative or contractual relationship
- Information relating to companies is checked from the Suomen Asiakastieto Oy register or similar registers in the course of business; these reports may also contain information about company representatives
- Contact details obtained from third parties (such as rakentaja.fi / Schibsted Suomi Oy and PRKK) with the data subject’s consent, for example in connection with requests for brochures
6. Entities processing personal data and recipients
In the technical implementation of its services, the data controller uses reliable service providers who process personal data on the data controller’s behalf pursuant to a data processing agreement between the data controller and each service provider, as required by applicable data protection legislation. Service providers process personal data for which the data controller is responsible in accordance with the data processing agreement and any documented instructions provided by the data controller. Key categories of recipients processing personal data include:
- CRM system and customer relationship management
- marketing automation and email marketing systems
- website platform and associated analytics services
- accountancy firm and bookkeeping services
- IT service providers and cloud services
- transport and logistics companies
Where separately agreed with the data subject on a case-by-case basis, or in situations otherwise permitted by data protection legislation, the data controller may also disclose personal data to another data controller or a third party.
Furthermore, provided the requirements of data protection legislation are met, the data subject’s contact details may, in individual cases, be disclosed to the data controller’s partners, for example when the data controller organises a joint customer event or training session with a partner. The partner in question is responsible for the processing of personal data for its own behalf.
Personal data may be transferred outside the European Union or the European Economic Area in accordance with data protection legislation and within the limits set by it. The data controller ensures an adequate level of data protection in accordance with the requirements of applicable data protection legislation, including in situations where personal data is transferred outside the European Union or the European Economic Area by complying with the adequacy decisions issued by the European Commission and, where necessary, by using the standard contractual clauses approved by the European Commission for the transfer of personal data, together with the necessary supplementary safeguards.
7. Cookies
The data controller’s website uses cookies to improve the user experience. Some cookies are essential for the website to function. Under the law, the data controller may store cookies on the data subject’s device if this is necessary for the website to function. The data subject’s consent is required for the use of all other cookies. The data controller’s website features a cookie consent form and provides further information on its cookie policy.
The data subject can make choices on the website regarding the purposes for which cookies are collected. In accordance with the data subject’s choices, the data controller may also use cookies to personalise the website, analyse visitor numbers, for marketing purposes and to support social media features. Some cookies are set by third parties.
8. Retention period for personal data
| Purpose of processing | Retention period / basis for determination |
| Management of the customer relationship | For the duration of the customer relationship and for a maximum of 6 years after its termination |
| Accounting and invoicing data | 6 years from the end of the financial year in which the transaction was recorded |
| Contracts and related information | For the duration of the contractual relationship and for a maximum of 10 years after its termination |
| Marketing register | Until the data subject withdraws their consent |
| Prospective customers | For a maximum of 2 years from the most recent contact, unless the relevant contact continues |
| Requests for quotations | 2 years from the date of the request for quotation, unless the request leads to a contract |
The data controller processes and retains personal data only for as long as required by law or as necessary for the pre-defined purpose of the personal data. Retention periods for personal data are generally determined as follows:
Personal data that is no longer needed, and for which the data controller no longer has a legitimate basis or obligation to retain or process, is deleted at regular intervals in accordance with the data controller’s own data protection policies.
9. Rights of the data subject
Data subjects have rights under the EU General Data Protection Regulation.
| Right | Description |
| Right of access to personal data | The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them is being processed. If personal data is being processed, the data subject has the right to access that data. |
| Right to request rectification, erasure or restriction of processing | The data subject has the right to request that the data controller rectifies any inaccurate data concerning them, as well as to erase any personal data concerning them or to request the restriction of processing on the grounds laid down by law. |
| Right to object | The data subject has the right to object to the processing of their personal data on grounds relating to their particular situation, where the controller is processing personal data on the basis of a legitimate interest.
Where personal data is processed for direct marketing purposes, the data subject has the right at any time to object to the processing of their personal data for such marketing, including profiling where it is related to such direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, such data may no longer be processed for that purpose. |
| Right to data portability | The data subject has the right to receive the personal data concerning them, which they have provided to the data controller, in a commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from the controller, where the processing is based on consent or a contract and is carried out by automated means. The data subject has the right to have their personal data transferred directly from one data controller to another, where technically feasible. |
| Right to withdraw consent | Where a data subject’s personal data is processed on the basis of their consent, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out on the basis of consent prior to its withdrawal. |
| Right to lodge a complaint with a supervisory authority | In Finland, the supervisory authority is the Office of the Data Protection Ombudsman, whose contact details and guidance can be found at www.tietosuoja.fi. |
Exercising your rights
You may exercise your rights as a data subject, as set out above, by contacting the data controller by telephone or by sending an email using the contact details provided at the beginning of this privacy notice. You may also submit your request electronically. We will respond to your request without undue delay and, in any event, within one month of receiving it. If, due to the complexity or number of requests, it is necessary to extend this deadline, we will inform you of this within one month of receiving the original request. If necessary, we will provide further instructions or ask additional questions in response to your request.
Please note that before we can process your request, we have the right and the obligation to verify your identity; we must therefore be able to identify you adequately.
If your request is manifestly unfounded or excessive, we may either charge a reasonable fee based on administrative costs for processing the request or refuse to carry out the requested action.
10. Profiling and targeted marketing
The data controller uses profiling for targeted marketing. Profiling is based on choices made by the data subject (for example, whether the data subject owns a plot of land) and on the data subject’s behaviour when using the data controller’s services. The purpose of profiling is to target the data subject with marketing relating to products and services that are relevant to them. The data controller does not make decisions based on automated processing, as referred to in Article 22 of the EU General Data Protection Regulation, which would have legal effects or other similarly significant effects on the data subject.
11. General description of the data controller’s appropriate technical and organisational security measures
Access to the personal data register is granted only to those representatives of the data controller who are bound by a duty of confidentiality under legislation or an employment contract and who have a legitimate need to process the data contained in the personal data register in order to carry out their duties.
The data controller has issued binding written guidelines and regulations to its employees and service providers regarding the processing of personal data and data protection, which they have undertaken to comply with.
The security of information systems has been appropriately organised, for example through encryption and technical restrictions.
The data controller reviews its personal data processing activities and the systems and equipment used in them at regular intervals and, for example, assesses the risks involved in personal data processing, such as when introducing new technology.
12. Amendments to the Privacy Notice
The data controller may, where necessary, make changes to this privacy notice.
This privacy notice was last updated on 14 September 2026.
Any enquiries relating to this matter can be sent to: info@lammi.fi