Updated February 18, 2019
Last updated: February 18, 2020
1. Name and Contact Details of the Data Controller
Name: Arkkeo Oy
Business ID: 2367934-3
Correspondence address: Kutomotie 16, 00380 Helsinki
Contact person: Frans Ekman
2. Name of Personal Data Register
Arkkeo Customer Register
3. Purpose of Use and Legal Basis for the Processing of Personal Data
Personal data are processed for the purposes of the administration, maintenance and improvement of Arkkeo's services, including potential direct marketing. Personal data are also processed on the basis purchases for the purposes of analysing the actions taken by customers in the Arkkeo application and for customer profiling. The profiling carried out by Arkkeo has no legal effects on the customer or any other corresponding material effects.
Providing personal data is a requirement for Arkkeo to be able to provide the service to the customer. The processing of personal data is based on the implementation of the agreement between Arkkeo and the customer as well as on Arkkeo's legitimate interest to maintain and develop its service and customer relationships. Arkkeo may also process data to carry out and improve the marketing of services.
In order to implement the service, customer personal data are also disclosed to Arkkeo’s business partners, i.e. to the merchants that have registered in the service. The disclosure of purchase information to merchants registered in Arkkeo's service is based on the implementation of the agreement. The disclosures of personal data are described in more detail below in section 5.
4. Contents and Sources of Information of the Register
For example, the following data are collected on customers: email address, first name, last name, gender, date of birth, telephone number, country of residence, city, picture, user ID, password, Arkkeo service identifier, payment card data, bank account number, purchase information (including place and time of purchase, goods and services purchased and sum of purchase), data on purchase targets met and the related rebates, customer actions in the Arkkeo application (e.g. time and frequency of use of the application, IP address), and profiling data based on the customer's purchases.
Personal data is obtained directly from the customer when the customer registers as a user of Arkkeo's services or otherwise becomes a customer of Arkkeo and when the customer uses Arkkeo services.
5. Cookies and use of data in advertisement
Arkkeo and its partners use technologies such as cookies in our App and on our site for content personalization, advertisement targeting and traffic analysis.
Arkkeo uses Facebook, Google and Instagram as advertisement channels and shares certain application usage data with these partners in order to optimize and track efficiency of advertisement campaigns. Customers can read about these partners’ data policies and prevent or restrict usage of their data at the corresponding partner’s site:
Information about Facebook and Instagram ads:
Facebook and Instagram ad settings:
Information about Google ads:
Google ad settings:
6. Regular Disclosure of Personal Data and Transfer of Personal Data Outside the EU and EEA
The customer's data are disclosed to companies registered in the service, i.e. merchants, from whom the customer has made purchases. [The customer can see the merchants who have received data in the Arkkeo application’s purchase history.] Merchants use the customer's personal data to implement the agreement, among other things, to manage loyal customer benefits as well as marketing and customer relationship development.
Otherwise, personal data are disclosed to third parties only if the customer has given their advance consent or if Arkkeo is obligated to disclose personal data under applicable mandatory legislation.
Furthermore, Arkkeo may disclose anonymised data to its business partners and corporate customers. Permanently anonymised data cannot be connected to a particular person.
Arkkeo outsources certain measures relating to the processing of personal data to its reliable service providers, who process personal data on Arkkeo’s behalf in accordance with Arkkeo’s instructions. Arkkeo may also transfer personal data to service providers operating outside the EU and the EEA, for example, as part of the outsourcing of data storage. Countries outside the EU and EEA may not necessarily guarantee the same level of personal data protection as the EU. In such situations, Arkkeo ensures a sufficient level of personal data protection by applying protective measures provided for in data protection legislation to the transfer of personal data, such as the European Commission’s standard contractual clauses or the EU's and USA's Privacy Shield system. More information on the protective measures employed in the transfer of personal data are available on the European Commission's website.
7. Storage Period of Personal Data
Arkkeo deletes or anonymises unnecessary personal data.
Access to personal data is only granted if necessary for the processing of data. Access to data is controlled through access rights. Personal data are disclosed to third parties only for limited purposes based on agreement.
Personal data are only stored as long as the customer is a user of the Service. The customer must be at least 13 years old to use the Arkkeo service or at least of an age that the legislation of the customer’s country of residence does not require the consent of the customer’s parent or guardian to use the Arkkeo services. If the legislation of the customer’s country of residence requires their parent’s or guardian’s consent to use the Arkkeo application, the customer must obtain this consent.
9. Customer Rights
Right to access
The customer is entitled to review their personal data stored in Arkkeo’s customer register and to receive a copy of said data.
Right to rectify
Asiakkaalla on myös oikeus vaatia henkilötietojensa korjaamista tai poistamista, jos tiedot ovat virheellisiä, tarpeettomia, puutteellisia tai vanhentuneita.
Right to object
The customer also has the right to object to the processing of their personal data on the grounds relating to their particular situation to the extent that the processing is based on the legitimate interest of Arkkeo or a third party. When objecting to the processing, the customer must provide Arkkeo with the grounds for the objection.
Right to object to direct marketing
The customer may at any time prohibit Arkkeo from using the customer's personal data for direct marketing and profiling related to direct marketing. Following such prohibition, the Arkkeo service will function in other respects.
Right to data portability
If certain requirements are met, the customer is entitled to receive their personal data from Arkkeo in a generally used, machine-readable form, as well as the right to transfer their data to another data controller. This right only concerns such personal data provided by the customer to Arkkeo that Arkkeo processes based on the consent of the customer or in order to implement the agreement between Arkkeo and the customer.
Right to restriction of processing
The customer is also entitled to demand that the processing of their personal data be restricted, for example, when the customer has contested the accuracy of their personal data and the consideration of the customer's request and the review of the accuracy of the personal data is pending.
Right to withdraw consent
The customer is entitled to withdraw consent for the processing of their personal data at any time. The withdrawal of the consent does not affect the legality of the processing of personal data carried out based on the consent and before the withdrawal.
Right to file a complaint
If necessary, the customer is also entitled to file a complaint to the supervisory authority in relation to the processing of personal data. The supervisory authority in Finland is the Office of the Data Protection Ombudsman.
How to use your rights
Requests relating to the aforementioned rights must be sent by email to or to the following postal address: