Instru optiikka Oy (business ID 1789727-2, “Instru” or “we”) obtains and processes personal data of its current, previous and potential suppliers and such suppliers’ employees and representatives (each natural person individually a “data subject”). With this privacy notice, we want to promote transparency and demonstrate how the personal data is processed as part of business operations with our suppliers. Should you have any questions in regards of the processing of supplier personal data, please contact
  1. Processing of personal data
    The personal data is mainly obtained from or agreed with the data subject. We may also process personal data obtained from the company that the data subject is representing, the authorities and our other cooperation partners, such as our subcontractors, and from the publicly accessible sources, such as internet pages and trade register. The personal data comprises:
    • identification information such as name, the company that the data subject is representing and his/her title;
    • contact details such as work place address, phone number and e-mail address;
    • user information of data systems provided by Instru; and
    • personal data generated in connection with the supplier’s supply, such as information relating to communications, information included in purchase orders, billing information, information required for deliveries, and information required to set up joint campaigns or other cooperation with the supplier.

  2. The legal basis for and purposes of processing

    We process the abovementioned personal data based on its necessity for the purposes of our legitimate interests, which arise when the data subject is our supplier at a service of such supplier, or for compliance with a legal obligation to which we are subject.

    The personal data are processed to acquire products and services from our suppliers, to investigate and negotiate with potential suppliers, to draw up, enforce and maintain supply agreements, to produce any activities related to such agreements.

    Where appropriate, we may also use the information to provide our suppliers with special offers to our stores and invite them to events. Should any communications be delivered by electronic means and considered as a direct marketing, we shall ask the data subject’s consent.
  3. Transfers and location of data
    As part of our business operations we may transfer personal data to our group companies and franchising companies.

    Personal data is located in the European Union or the European Economic Area, unless the supplier itself is established outside the EU, in which case the personal data is transferred to the country concerned. Such transfers are conducted under standard data protection clauses, copy of which is delivered to the data subject on request.
  4. Retention of personal data
    We retain personal data as long as it is necessary for implementation for the concerned supply agreement or consideration of potential supply agreement, for other legitimate purposes related to such supply agreements, such as archiving of the agreements, or for compliance with law.

    When the retention of personal data is no longer necessary, it shall be erased or anonymised securely.
  5. Rights of the data subjects
    As a data subject you have a right to request from us:
    • access to your own personal data;
    • rectification or erasure of your personal data;
    • restriction of processing concerning you;
    • to object to processing; and
    • right to data portability, which means that you may receive your personal data you have provided to us in a structured, commonly used and machine-readable format and transmit such data to another controller.

    Where the processing is based on consent, as a data subject you have the right to withdraw your consent at any time. Please note that a withdrawal of your consent will not affect the lawfulness of the consent-based processing taking place before your withdrawal of consent.

    Any request shall be made to the point of contact provided above.

    We will do our best to implement your request. However, sometimes we must refuse your request, in which case we shall inform you of the basis of such refusal.

    In case you consider that our processing of personal data does not meet the requirements of the GDPR or other applicable legislation, you may contact the Finnish Data Protection Authority to confirm the appropriateness of the processing of your personal data.