Privacy policy

This policy explains how Mediatrade Oy processes personal data when you use our website and online store, deal with us on behalf of your company or contact us. It is based on the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

1. Controller

Mediatrade Oy
Business ID 0659327-3
Elimäenkatu 9 A, 00510 Helsinki, Finland
Phone +358 20 155 7712
sales@mediatrade.fi

Privacy questions and requests: sales@mediatrade.fi

2. Whose data we process

• online store customers, contact persons of business customers and sub-users of company accounts
• people who send contact, quote, service or project requests
• newsletter subscribers
• website visitors

We sell professional products mainly to businesses. Much of the data we process is therefore business contact information of company representatives.

3. What data we process

Orders and customer account

• name, company, business ID or VAT number
• billing and delivery address, email and phone number
• ordered products, prices, delivery and payment method, order reference and order notes
• account username and password (the password is stored encrypted), company account sub-users and their ordering rights
• contract customer terms such as customer group, discounts and payment terms
• order history, cancellations and returns

Payments

Payments are processed by Paytrail Oyj. We do not see or store your card or online banking credentials; Paytrail only tells us whether the payment succeeded.

EU business customers

We check the VAT number of an EU business customer in the European Commission’s VIES system. We store the result and time of the check, because applying the reverse charge requires the number to be verified.

Contacts and requests

• name, company, email and phone number
• message and the page the form was sent from
• for service requests also address, device, serial number, purchase date and fault description
• for project enquiries also country, project stage and schedule
• for quote requests the contents of the cart

Newsletter

• email address

Website use

• IP address, browser and device information, pages visited and times in server logs
• data collected by cookies and similar technologies to the extent you have consented (section 8)

4. Purposes and legal bases

• Receiving, delivering and invoicing orders, cancellations, returns and warranty matters: contract
• Maintaining customer and company accounts, contract customer prices and terms: contract; for business customers, legitimate interest in managing the customer relationship
• Accounting and taxation, verifying EU business customers’ VAT numbers: legal obligation
• Responding to contact, quote, service and project requests: steps prior to a contract or legitimate interest in responding
• Managing customer relationships and improving our service: legitimate interest
• Newsletter: consent
• Website security, preventing spam and misuse, investigating errors: legitimate interest
• Visitor analytics, measuring and targeting advertising, identifying the company behind a visit: consent

We do not make automated decisions or profiling with legal effects. Company accounts are approved by Mediatrade’s sales staff.

5. Sources of data

We receive data mainly from you or the company you represent when you place an order, create an account or send a form. We verify VAT numbers in VIES. Delivery status comes from carriers and payment status from Paytrail.

6. Recipients and processors

We do not sell personal data. We use the service providers listed below. They process data on our behalf and according to our instructions unless stated otherwise.

• Rackbeat (ERP): orders, customers and contact persons
• Paytrail Oyj (payment service): payment data. Paytrail acts as an independent controller for card payments.
• Posti and DHL Express (carriers): recipient’s name, address, phone and email for delivery and delivery notifications
• Finance company (leasing): if you choose leasing, the order and contact details for the financing decision
• ResaHost (website hosting, maintenance and backups) and its subcontractors RunCloud and WP Umbrella
• Mailgun (emails sent by the website, EU region) and our company email service
• Cloudflare Turnstile (bot protection for forms): IP address and technical browser data
• Adobe Fonts (website fonts): your browser’s IP address when a font is loaded
• Based on your consent: Usercentrics (Cookiebot, consent management), Google (Analytics, Tag Manager and Ads), Meta (Facebook and Instagram advertising), Leadfeeder (identifying visiting companies) and Serviceform (visitor analytics)

We also disclose data to authorities when required by law.

7. Transfers outside the EU and EEA

Some service providers (Google, Meta, Cloudflare and Adobe) are based in or owned by companies in the United States. These transfers rely on the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. DHL Express’s rate and shipment interface runs in Australia; this transfer is safeguarded by standard contractual clauses. Other services process data in the EU or EEA.

8. Cookies

Necessary cookies keep the cart, login, language selection and security working and do not require consent. Analytics and marketing cookies and similar technologies are only used after you consent in the cookie banner. You can change or withdraw your consent at any time from the cookie settings at the bottom of the page. A full list of cookies is in the cookie declaration.

9. Retention

• Order and invoicing data: six years from the end of the year in which the financial period ended, as required by the Finnish Accounting Act
• Customer account: as long as the account is in use. An unused account is deleted three years after the last login unless it is needed for an open order or contract.
• Business customer relationship and contract terms: for the duration of the relationship and thereafter for the accounting retention period
• Contact, quote, service and project requests: 24 months unless they lead to an order or contract
• Newsletter subscription: until you unsubscribe
• Server logs: up to 30 days
• Backups: 7 days
• Cookie consent: 12 months, after which we ask again

10. Security

The website uses an encrypted connection (HTTPS). Administrator accounts are protected with two-factor authentication, and access to data is limited to people who need it in their work. Payment data is handled by Paytrail. Server security updates, backups and monitoring are in place.

11. Your rights

You have the right to

• know what data we process about you and receive a copy
• have inaccurate data corrected
• have data erased when there is no longer a basis for processing it
• restrict processing
• object to processing based on legitimate interest and to direct marketing
• receive the data you provided in a machine-readable format when processing is based on a contract or consent
• withdraw your consent at any time. Withdrawal does not affect the lawfulness of earlier processing.

Send requests to sales@mediatrade.fi. We respond within one month. We may ask you to verify your identity before disclosing data.

You can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) if you believe the processing of your data violates data protection law.

12. Changes

We update this policy when our processing changes. The update date is shown at the top of the policy.