Privacy Policy

CMB Ravintolat Oy (hereinafter “Company” or “we”) collects and processes personal data of users of its online services and website. This Privacy Policy applies to personal data obtained from individuals (hereinafter “Users”) through our website, online services, and web applications (hereinafter collectively “Services”). We act as the data controller for this data under the EU General Data Protection Regulation (GDPR).

Certain Services may also be subject to a separate privacy policy. If a specific service has its own privacy policy, we will publish it on our website or otherwise make it available in connection with that service.

Our Privacy Policy outlines what information we process, how we process it, and how data subjects (Users) can exercise their rights (for example, the right to object to processing and the right of access to data).

This Privacy Policy may be updated as necessary when data processing practices change or in other situations. The latest version of the policy can always be found on our website. We will not make significant changes to this Privacy Policy or diminish Users’ rights defined herein without notifying Users.

This Privacy Policy applies solely to data processing carried out by the Company. It does not cover, nor are we responsible for, the privacy practices of third parties. The Company assumes no responsibility for third-party data processing, including instances where our Services contain hyperlinks or other links to third-party websites or services.

Data protection, information security, and online security are essential to us, and we handle personal data carefully and in accordance with applicable laws and regulations.

1. COMPANY CONTACT DETAILS

  • Name: CMB Ravintolat Oy
  • Business ID: FI0942308-5
  • Postal Address: Salomonkatu 17 A, 00100 Helsinki – Finland
  • Email: info@cmbaccounting.fi
  • Website: www.santafelahti.fi

2. PERSONAL DATA PROCESSED AND DATA SOURCES

We collect two types of data from Users:

(i) User Data and (ii) Technical Data.

Although we generally do not use technical data to identify individual persons, we may sometimes identify users solely through technical data or by combining technical data with user data. In these situations, technical data may also be considered personal data as defined by law, and we will process the combined information as personal data.

While a User is utilizing the Services, the Company may collect the following User Data:

  1. First and last name
  2. Email address
  3. Phone number
  4. Name and details of the organization represented by the User
  5. Information provided by the User when rating or giving feedback on our Services
  6. Any personal data voluntarily provided by the User

The User Data collected depends on the Services used and is obtained directly from the Users.

Technical Data includes, for example:

  • User’s IP address
  • Browser type and version
  • Language settings
  • Geographic location via IP address, GPS technology, wireless connection, or Bluetooth
  • Operating system and computer type
  • URLs through which the User enters, navigates within, and exits our Services, including date and time stamps
  • Information regarding which parts of our Services the User has accessed

Cookies

When Users visit our Services, we use various methods, including cookies, to collect and store technical data and other information. Cookies allow us to count total visitors to our Services and monitor usage, helping us develop our Services and better serve Users. We may also use cookies that facilitate usage by remembering usernames, passwords, and preferences. Tracking and analytics cookies may be used to analyze how Users interact with our Services, and unique cookie identifiers may be used for tracking purposes.

When visiting the website for the first time, you can accept or decline the use of analytics cookies. You can change your selection later in the cookie settings.

Google Analytics

We use analytical tools within our Services to gather technical data and reports on usage and to develop our Services. [Information on Google Analytics].

Akismet Spam Protection

We use the Akismet spam protection filter on our internal booking form. Akismet sends the following form data to its service: name, email address, message, as well as the user’s IP address and browser details. Akismet’s functionality and cookies are categorized as strictly necessary functional cookies and cannot be disabled.

3. PURPOSE AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Purpose

The Company processes personal data for several purposes:

  • Providing Services and Fulfilling Contractual Obligations:We process personal data to provide Services to Users and to operate, maintain, and develop our business. For instance, we process data to ensure key functionalities for customers and Users, such as connecting customers and Users with each other. In some cases, processing is necessary to fulfill contractual obligations toward the User—providing core Service features and access. If a User contacts customer service, we use the provided details to answer questions and resolve potential issues.
  • Customer Communication:We may process personal data to communicate with Users about our Services and notify them of Service changes. Data may also be used in research and analysis aimed at improving our Services.
  • Quality Improvement and Monitoring Changes:We may process data regarding Service usage to enhance quality—such as analyzing usage trends. Where possible, this is conducted using aggregated and non-identifiable data.
  • Statistics and Analytics:The Company may collect technical data and other anonymous aggregated data to compile reports and statistics. These are used for sales and marketing purposes. We may also share these statistics and reports with clients and Users. For clarity, these reports contain no personal data.
  • Other Legitimate / Legal Purposes:We process personal data for direct marketing, such as sending newsletters and similar marketing materials. Users can unsubscribe from marketing mailing lists at any time.

In certain parts of the Services, Users may be asked for their consent to process personal data. In such cases, Users may withdraw their consent at any time.

4. DATA TRANSFERS OUTSIDE EUROPE

Data processed on the platform intended for investors and founders is stored within the EU/EEA area.

For our website functionalities, we utilize service providers located in various countries, such as Google Analytics. Consequently, we and our service providers may transfer and process personal data in countries where legislation differs from that of EEA countries or the User’s home country. We take various measures to ensure that Users’ personal data is adequately protected in the countries where it is processed. We ensure sufficient protection for data transferred outside the EEA through inter-company contracts and service provider agreements containing Standard Contractual Clauses (SCCs), or by utilizing other equivalent legal mechanisms.

Further information regarding personal data transfers can be requested via the contact addresses provided in this Privacy Policy.

5. RECIPIENTS

We share personal data only within the Company organization and only to the extent necessary to provide and develop the Services.

We share personal data with third parties only in the following circumstances:

  • Processing is Necessary for Purposes Outlined in this Policy:Situations where third parties must process personal data to provide the Services and where the Company has ensured through organizational and technical safeguards that data is processed solely for the purposes defined herein and in compliance with applicable laws.
  • Legal Reasons:We may share personal data with third parties if we believe in good faith that access to or processing of data is necessary to: (i) comply with applicable law, regulation, and/or court order; (ii) detect, prevent, or otherwise address fraud, security, or technical issues; and/or (iii) protect the interests, property, or safety of the Company, Users, or the public as required or permitted by law. Where possible, we will inform Users of such transfers.
  • Authorized Service Providers:We may share personal data with authorized service providers whose services we use (e.g., data storage, sales, payment processing, marketing, and customer support). Our agreements with service providers require them to limit personal data use and maintain data protection and security practices at least equivalent to this Policy. Note that if you provide personal data directly to a third party (e.g., via a link on our site), processing occurs according to that third party’s policies.
  • Other Legal Reasons (Corporate Transactions):If the Company is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the relevant third party. However, we will continue to ensure the confidentiality of all personal data and notify affected Users as soon as possible if data is transferred or becomes subject to a different privacy policy.
  • Explicit Consent:We may share personal data with third parties outside the Company for reasons other than those listed above if we have the User’s explicit consent.
  • Service Functionalities (Recruitment/Matching):Due to the operational nature of our Services, User personal data may be transferred to the Company’s clients. When a client searches for suitable candidates, they see only the selected User’s current title, location, and areas of expertise. If a User wishes to apply for a specific position or send an application to a specific client, they must consent to transferring their personal data to that client. The User remains anonymous until they explicitly approve the transfer of their identifying and personal data to the specified client. By granting such consent, the User warrants that they have the authority to grant it.

6. RETENTION PERIOD

The Company retains personal data only for as long as permitted by law and as necessary to provide the Services or essential parts thereof. Retention periods depend on the nature of the data and the purpose of processing; thus, maximum retention periods may vary depending on use.

Generally, we retain User personal data for as long as the User remains on our mailing list, registered with our Services, or as long as another valid reason for retention exists. Thereafter, data is retained only for the period required or permitted by law, or as necessary for internal reporting and dispute resolution.

In general, User personal data will be deleted within a reasonable timeframe after the User has ceased using all parts of the Services or requests deletion of their data.

7. USER RIGHTS

  • Right of Access:Users have the right to inspect personal data processed by the Company. Users can contact us, and we will inform them what personal data we have collected and processed about them and for what purposes it is used.
  • Right to Withdraw Consent:If processing is based on consent, the User may withdraw consent at any time. Withdrawal of consent may affect the User’s ability to use our Services.
  • Right to Rectification:Users have the right to have incorrect, inaccurate, incomplete, outdated, or unnecessary personal data stored in our registry corrected or completed.
  • Right to Erasure (“Right to be Forgotten”):Users may request the deletion of their personal data stored in our systems. We will fulfill the request unless we have a legitimate legal ground not to delete the data. We may not be able to immediately erase all backup copies from our servers and systems after active data is deleted, but backup copies will also be erased as quickly as possible.
  • Right to Object to Processing:Users can object to the processing of their personal data if the processing is for purposes other than providing the Services or complying with legal obligations. Users may also object to processing even if they previously consented. Objecting may restrict the User from utilizing all of our Services.Direct Marketing: Users have the right to prohibit us from using their personal data for direct marketing, market research, and profiling. Users can contact us at the addresses provided, use built-in Service functions, or unsubscribe using the link provided in every direct marketing email.
  • Right to Restriction of Processing:Users may request that we restrict the processing of their personal data. However, this may affect their ability to use our Services.
  • Right to Data Portability:Users have the right to receive their personal data from us in a structured, commonly used format and transfer the data to a third-party system independently.

Exercising Your Rights

Users can exercise these rights by sending a request via mail or email to the contact addresses listed above. The message must include: name, address, phone number, and a copy of a valid ID. We may also request additional information to verify the sender’s identity.

We reserve the right to decline requests that are manifestly unfounded, unreasonable, or repetitive.

8. LODGING A COMPLAINT

If a User believes that we have processed their personal data in breach of applicable data protection legislation, they have the right to lodge a complaint with their local supervisory authority (Tietosuojavaltuutetun toimisto in Finland).

9. DATA SECURITY

We are responsible for protecting our platform and data as effectively as possible.

We use all appropriate administrative, organizational, technical, and physical safeguards to prevent unauthorized access to, alteration of, disclosure of, or destruction of stored personal data. These measures include end-to-end TLS encryption for communications and encryption of sensitive user data. We continuously monitor security threats and solutions and incorporate them into our platform and architecture design.

Our safeguards ensure data confidentiality, integrity, and availability. We regularly audit our website, data centers, systems, and other assets to identify potential security vulnerabilities.

If, despite our security measures, a data breach occurs that may compromise Users’ privacy, we will notify affected Users, relevant third parties, and supervisory authorities as soon as possible as required by data protection legislation.

Inquiries regarding this Privacy Policy or data processing:

Email: info@cmbaccounting.fi

    Group reservations

    Please use the form below to submit a group booking inquiry (for parties of more than 8 people) for Malskin Bistro. Booking requests are processed on the following business day. Please note that your reservation is confirmed only after you have received a confirmation from us.

    This form uses Akismet to prevent spam.

      Feedback form

      The form uses Akismet to prevent spam.

      Privacy Overview

      This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.

      Necessary

      We use a mandatory cookie to store the language setting user has selected.

      Analytics

      We use Google Analytics to track the traffic on our page. We only use anonymous data. By enable these cookies, you help us to improve our website.

      Powered by  GDPR Cookie Compliance (opens in a new tab)