REGISTER DESCRIPTION OF KOTKA MARETARIUM OY’S ONLINE STORE PERSONAL DATA REGISTER
Register description in accordance with the Personal Data Act (523/1999).

Controller and its contact details:
Kotka Maretarium Oy (Business ID: 1652254-0)
Sapokankatu 2
48100 Kotka, Finland
info@maretarium.fi, tel. + 358 40 3110 330

1. What information is collected about the customer?

The customer register stores the customer’s first name, surname, street address, postcode, city, country,
email address, telephone number, language used in the transaction. In addition, the company name is
saved from the company customer.
In addition, the online store’s order information stores the information provided by the customer in
connection with the order, such as the product content of the order and the payment method.

2. What is personal data used for?

Personal data is used for managing customer relationships, delivering and processing orders, archiving and
statistical purposes.
The processing of personal data is based on a contract, consent or legitimate interest.
As of 25 May 2018, the processing of personal data has taken into account the requirements set out in the
EU General Data Protection Regulation.

3. How long is personal data stored?

We store personal data for as long as is necessary to carry out the purposes of the register.
In addition, some data may be stored for longer to the extent necessary to meet legal obligations, such as
accounting and consumer trading responsibilities.

4. Disclosure to third parties

We disclose personal data to payment service partners in order to enable the operation of our online store.

5. The Customer has the following rights:

* Right to see the data stored about him
* Right to rectify information stored about him
* Right to erasing data
* Right to lodge a complaint with a supervisory authority

If the customer wants to see, correct or delete the data, they must contact the customer service:
info(a)maretarium.fi. The data can be deleted if the customer does not have unprocessed orders in their
account. No separate reason is required to see, correct, or delete the data. Customer information is verified
through email, address, phone number or old orders before the information is provided, changed or
deleted.

The customer has the right to lodge a complaint with the supervisory authority if the customer considers
that the processing of personal data has violated the customer’s rights under the Data Protection
Regulations. In Finland, the Office of the Data Protection Ombudsman acts as the supervisory authority
(tietosuoja.fi).