Data and privacy policy

Stockmann plc (Business ID: 0114162-2)
Aleksanterinkatu 52 B / PO Box 220
FI-00101 Helsinki
Tel. +358 (0)9 1211
Email: info@stockmann.com

When you use the Stockmann website and the services there, we may ask you for personal information for the following purposes:

• press releases and stock exchange releases
• mailing of printed annual report
• providing investor services
• analysis of website traffic

The legal grounds for processing personal data is the implementation of agreements. Data is used to complete service orders placed by data subjects.

The data of analysts who follow Stockmann is used on grounds of consent. Photographs and videos are processed on grounds of legitimate interest.

The personal data of the following groups is processed:, stakeholders, including release and annual report subscribers; shareholders and analysts following Stockmann.

Processed personal data groups:

• name and address
• e-mail address
• shareholder’s name, company
• language
• photographs and videos in Stockmann’s communications channels

Processed data is obtained from the data subjects through the website or other form of disclosure.

Not applicable.

• Euroclear Finland Oy; shareholders
• Cision Finland Oy; press releases and stock exchange releases
• Eurolandcom AB; principal shareholders
• Google LLC (Analytics); analysis of website traffic

Data is not transferred outside the EU or EEA.

Collected data will only be stored to the extent and for a period of time that is necessary for the original or compatible purposes for which the personal data was collected.

The recipient data of stock exchange and press releases is processes until the subscription is cancelled.

Data processed on grounds of consent is removed when the consent is withdrawn.

Based on its legitimate interest, the controller may store the data for as long as it is necessary for safeguarding the legitimate interest. In such cases storage times will be based on limitation periods and expiry times.

Right to receive information
The data subject is entitled to obtain information with regard to what data is collected and for what purposes, what the legal basis is for processing the data and to whom data is disclosed.

Right of access
The data subject is entitled to review what data has been stored about them in the data file, how the data is used and for what purposes. If requested, the controller must provide a copy of the personal data undergoing processing. The provision of a copy must not adversely affect the rights and freedoms of others.

Right of rectification
The data subject has the right to demand that the controller rectify, without undue delay, any inaccurate and erroneous personal data concerning them. If the data subject contests the accuracy of the personal data, they are entitled to demand that the controller restrict their processing of the data for a period enabling the controller to verify the accuracy of the personal data.

Taking the purpose of use of the data into account, the data subject has the right to have incomplete personal data completed. The data subject is primarily responsible for notifying the controller of any changes or deficiencies related to their personal data. The controller is responsible for immediately rectifying any errors it detects.

The will inform each recipient to whom personal data has been disclosed of any rectifications of and additions to personal data, unless this proves impossible or requires unreasonable effort.

The data subject has the right to have the controller erase, without undue delay, their personal data, provided that one of the following applies:

• The personal data is no longer needed for the purposes for which it was collected or otherwise processed
• The data subject withdraws their consent and there is no other legal basis for the processing
• The personal data has been processed unlawfully
• The personal data must be erased to meet a statutory obligation arising from EU or national legislation.

The data does not need to be erased, even when requested to do so, if the controller has the right to process the data to establish, exercise or defend a legal claim.

The controller must inform each recipient to whom personal data has been disclosed of the erasure of the personal data, unless this proves impossible or requires unreasonable effort.

The data subject has the right to restrict the controller’s processing of personal data under the following circumstances:

• The processing is unlawful, in which case the controller is generally obligated to erase the data, but the data subject opposes the erasure of the personal data and requests the restriction of its use (erasure) instead
• The controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defence of a legal claim

If the data subject has demanded that the processing be restricted, the personal data may only be processed with consent from the data subject (excluding data storage); to establish, exercise or defend a legal claim or protect the rights of another natural or legal person; or for reasons of important public interest of the EU or of a Member State.

The controller must inform each recipient to whom personal data has been disclosed of the restriction of processing personal data, unless this proves impossible or requires unreasonable effort.

The data subject has the right to withdraw their consent to the processing of personal data at any time. A withdrawal of consent will not affect the lawfulness of the processing carried out based on the consent before its withdrawal.

The right to object does not exist to the extent that the processing of personal data is based on an agreement and is necessary for its execution or that the processing is necessary to meet a statutory obligation.

The data subject has the right to object to the processing of their personal data when the processing is based on the controller’s legitimate interest.

In cases where the processing is based on consent or an agreement:

• The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and the right to transfer the data to another controller.
• The data subject has the right to have the data transferred directly to another controller when this is technically possible and is not unreasonable for the controller. The implementation of this right must not adversely affect the rights and freedoms of others.

Requests to exercise data subjects’ rights may be sent to info@stockmann.com.

If the response includes personal data, the data will be submitted encrypted in electronic format or by means of a registered letter. The letter can only be signed as having been received by its intended recipient. This is to ensure the confidentiality of the data of the actual recipient.

In matters concerning the processing of personal data or the exercising of rights based on the EU General Data Protection Regulation in relation to Stockmann’s functions, please contact Stockmann’s data protection officer. The data protection officer can be reached via email at tietosuoja@stockmann.com or by calling +358 (0)9 1221 and requesting the operator to connect to the data protection officer.

The data subject has the right to file a complaint with the supervisory authorities if they deem that the processing of the personal data concerning them is in violation of the applicable data protection regulations. In Finland, the Office of the Data Protection Ombudsman serves as the nationalsupervisory authority.

Office of the Data Protection Ombudsman
Visiting address: Ratapihantie 9, 6th floor
FI-00520 Helsinki

Postal address: PO Box 800
FI-00521 Helsinki

Tel. (switchboard): +358 29 56 66700
Fax: + 358 9 56 66735
Email: tietosuoja@om.fi