Privacy Policy

Updated March 8, 2021

Arkkeo's Privacy Policy​

Last updated: March 8, 2021

1. Arkkeo' contact details


Name: Arkkeo Oy 
Business ID: 2367934-3 
Correspondence address: Kutomotie 16, 00380 Helsinki 
E-mail address: 
Arkkeo has appointed a data protection officer who you can reach through the above contact details.


2. Name of Personal Data Register


Arkkeo Customer Register

3. Purpose of Use and Legal Basis for the Processing of Personal Data


Personal data are processed for the purposes of the administration, maintenance, and improvement of Arkkeo's services, including potential direct marketing. Personal data are also processed on the basis of purchases and location for the purposes of analysing the actions taken by customers in the Arkkeo application and for customer profiling. The profiling carried out by Arkkeo has no legal effects on the customer or any other corresponding material effects.


Providing personal data is a requirement for Arkkeo to be able to provide the service to the customer. The processing of personal data is based on the implementation of the agreement between Arkkeo and the customer as well as on Arkkeo's legitimate interest to maintain and develop its service and customer relationships. Arkkeo may also process data to carry out and improve the marketing of services.


In order to implement the service, customer personal data are also disclosed to Arkkeo’s business partners, i.e. to the merchants that have registered in the service. The disclosure of purchase information to merchants registered in Arkkeo's service is based on the implementation of the agreement. The disclosures of personal data are described in more detail below in section 6.

4. Contents and Sources of Information of the Register

For example, the following data are collected on customers: email address, first name, last name, gender, date of birth, telephone number, country of residence, city, picture, user ID, password, Arkkeo service identifier, location data (if you consent to the processing of your GPS data), payment card data, bank account number, purchase information (including place and time of purchase, goods, and services purchased and the sum of purchase), data on purchase targets met and the related rebates, information about the device, operating system, and software version used, customer actions in the Arkkeo application (e.g. time and frequency of use of the application, IP address), and profiling data based on the customer's purchases, and marketing opt-ins and opt-outs. 


Personal data is obtained directly from the customer when the customer registers as a user of Arkkeo's services or otherwise becomes a customer of Arkkeo and when the customer uses Arkkeo services.

5. Cookies and use of data in the advertisement

Arkkeo and its partners use technologies such as cookies in our App and on our site for content personalization, advertisement targeting, and traffic analysis.


Arkkeo uses Facebook, Google, and Instagram as advertisement channels and shares certain application usage data with these partners in order to optimize and track the efficiency of advertisement campaigns. Customers can read about these partners’ data policies and prevent or restrict usage of their data at the corresponding partner’s site:


Information about Facebook and Instagram ads:


Facebook and Instagram ad settings:


Information about Google ads:


Google ad settings:

6. Regular Disclosure of Personal Data and Transfer of Personal Data Outside the EU and EEA


The customer's data are disclosed to companies registered in the service, i.e. merchants, from whom the customer has made purchases. [The customer can see the merchants who have received data in the Arkkeo application’s purchase history.] Merchants use the customer's personal data to implement the agreement, among other things, to manage loyal customer benefits as well as marketing and customer relationship development.


Otherwise, personal data are disclosed to third parties only if the customer has given their advance consent or if Arkkeo is obligated to disclose personal data under applicable mandatory legislation.


Furthermore, Arkkeo may disclose anonymised data to its business partners and corporate customers. Permanently anonymised data cannot be connected to a particular person.


Arkkeo outsources certain measures relating to the processing of personal data to its reliable service providers, who process personal data on Arkkeo’s behalf in accordance with Arkkeo’s instructions. Arkkeo may also transfer personal data to service providers operating outside the EU and the EEA, for example, as part of the outsourcing of data storage. Countries outside the EU and EEA may not necessarily guarantee the same level of personal data protection as the EU. In such situations, Arkkeo ensures a sufficient level of personal data protection by applying protective measures provided for in data protection legislation to the transfer of personal data, such as the European Commission’s standard contractual clauses or the EU's and USA's Privacy Shield system. More information on the protective measures employed in the transfer of personal data is available on the European Commission's website.

7. Storage Period of Personal Data


Arkkeo primarily stores personal data for the duration of the customer relationship. After the end of the customer relationship, Arkkeo will store the customer’s personal data to the extent that the personal data are needed to carry out the purposes defined in this privacy policy, to guarantee the legal protection of Arkkeo or the customer or to comply with Arkkeo's statutory obligations.


Arkkeo deletes or anonymises unnecessary personal data.

8. Privacy Policy


We use administrative, organizational, and technical safeguards to protect the personal data we collect and process. Access to personal data is only granted if necessary for the processing of data. Access to data is controlled through access rights. Personal data are disclosed to third parties only for limited purposes based on agreement.


Personal data are only stored as long as the customer is a user of the Service. The customer must be at least 13 years old to use the Arkkeo service or at least of an age that the legislation of the customer’s country of residence does not require the consent of the customer’s parent or guardian to use the Arkkeo services. If the legislation of the customer’s country of residence requires their parent’s or guardian’s consent to use the Arkkeo application, the customer must obtain this consent.


9. Customer Rights


Right to access


The customer is entitled to review their personal data stored in Arkkeo’s customer register and to receive a copy of said data.


Right to rectify


The customer also has the right to delete, to have incorrect, incomplete, unnecessary, or outdated personal data we have stored corrected or completed by contacting us.


Right to object


The customer also has the right to object to the processing of their personal data on the grounds relating to their particular situation to the extent that the processing is based on the legitimate interest of Arkkeo or a third party. When objecting to the processing, the customer must provide Arkkeo with the grounds for the objection.


Right to object to direct marketing


The customer may at any time prohibit Arkkeo from using the customer's personal data for direct marketing and profiling related to direct marketing. Following such prohibition, the Arkkeo service will function in other respects.


Right to data portability


If certain requirements are met, the customer is entitled to receive their personal data from Arkkeo in a generally used, machine-readable form, as well as the right to transfer their data to another data controller. This right only concerns such personal data provided by the customer to Arkkeo that Arkkeo processes based on the consent of the customer or in order to implement the agreement between Arkkeo and the customer.


Right to restriction of processing


The customer is also entitled to demand that the processing of their personal data be restricted, for example, when the customer has contested the accuracy of their personal data and the consideration of the customer's request and the review of the accuracy of the personal data is pending.


Right to withdraw consent


The customer is entitled to withdraw consent for the processing of their personal data at any time. The withdrawal of the consent does not affect the legality of the processing of personal data carried out based on the consent and before the withdrawal.


Right to file a complaint


If necessary, the customer is also entitled to file a complaint to the supervisory authority in relation to the processing of personal data. The supervisory authority in Finland is the Office of the Data Protection Ombudsman.


How to use your rights


Requests relating to the aforementioned rights must be sent by email to or to the following postal address:


Arkkeo Oy
Kutomotie 16
00380 Helsinki

10. Changes in this Privacy Policy 


Arkkeo Oy has the right to make changes to this privacy policy and the related data. Should we make amendments to this privacy policy, we will place the amended policy on our website, with an indication of the amendment date. If the amendments are significant, we may also inform you about this by other means, for example by sending an email. We recommend that you review this privacy policy from time to time to ensure you are aware of any amendments made.