Privacy Policy

Privacy Policy

1.Data Controller

Bon Group Oy
Business ID: FI33130469
Address: Klubitie 12, 73310 Tahkovuori
Email: info@bongroup.fi

2.Data Protection Officer

Ville Puustinen
Address: Klubitie 12, 73310 Tahkovuori
Email: ville.puustinen@bongroup.fi

3.Purpose of Personal Data Processing

We process personal data for the following purposes:

Maintaining and managing customer relationships (legal basis: contract and legal obligation)
Providing and delivering services (legal basis: contract)
Customer service and support (legal basis: contract)
Information and marketing (legal basis: consent or legitimate interest)
Developing and improving services (legal basis: legitimate interest)
Website and service analytics (legal basis: consent)
Customer data may be collected and combined from different sources, such as loyalty systems (e.g. Cluby), website forms and event systems.
The data is used in customer relationship management (CRM), customer segmentation and targeted communication.

4.Personal Data Processed

We may process the following personal data:

Name, address, email address, phone number
Date of birth and payment information
Customer photos, usernames and passwords
Reservations, purchase history and customer interactions
Customer behaviour and engagement data (e.g. use of benefits, transaction history, preferences)
Other information provided by the customer

5.Retention Period for Personal Data

Personal data is retained for the duration of the customer relationship and for a maximum of two (2) years after it has ended.

The end of the customer relationship may be defined, for example, as a situation where the customer has been inactive or has left a loyalty program.

Accounting data is retained for at least six (6) years in accordance with applicable legislation. Marketing consents are retained until they are withdrawn.

6.Disclosure and Transfers of Data

Within the group: Personal data may be shared between Bon Group companies for customer service and marketing purposes.

Service providers: Personal data may be processed by trusted partners, such as payment service providers, marketing platforms and IT service providers.

Cross-marketing (e.g. Cluby):
If marketing is carried out in the name of Bon Group, Cluby acts as a data processor on behalf of Bon Group. If Cluby uses the data for its own purposes, it acts as an independent data controller and is responsible for its own privacy notice.

Bon Group may transfer customer data collected through the Cluby system to its own customer relationship management systems (e.g. CRM), where the data is used for customer relationship management, marketing and service development.

7. Transfers Outside the EU/EEA
Personal data may be transferred outside the EU/EEA if we use service providers whose systems are located outside this area (e.g. cloud services).

Such transfers are carried out in accordance with GDPR using appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission.

8.Data Security

We implement appropriate technical and organisational measures to protect personal data, including access control, encryption and staff training.

9.Data Subject's Rights

You have the following rights: