S GROUP’S CO-OP MEMBER AND CUSTOMER REGISTER PRIVACY NOTICE (12 Septemper 2024 onwards)  

1. Data controller 

SOK Corporation 
P.O. Box 1, FI-00088 S-RYHMÄ, Finland 
S Group’s co-op member service: +358 10 76 5858 
Street address: Fleminginkatu 34, FI-00510 Helsinki, Finland 
Business ID 0116323–1 

2. Contact details of the data protection officer 

tietosuojavastaava@sok.fi

3. The personal data processed 

We process your personal data if your belong to any of the following customer groups:  

Information used for the provision of co-op member benefits:  

Basic information:  

Contact information:  

Gender information:

Employee information:  

Cooperatives’ membership information:  

Invoicing Bonus partners:  

Information about the co-op member household:  

Deposit account for benefits payable in cash:  

S-Etukortti cards, S-Bank Private Visa cards:  

User identification:  

Customer groups:  

Customer categorisation and profiling information: 

Subscriptions, services in use and information concerning the use of services:  

Authorisations and prohibitions, i.e., your consents and objections to personal data processing:  

Data on paid benefits and data on received discounts:  

Detailed purchase data 

Customer’s digital footprint  

Information regarding customer belonging to a target group 

Online shopping information  

Customer feedback  

Survey responses based on consent  

4. Bases for the processing of personal data, purposes of use and storage periods 

S Group’s co-op member scheme requires us to process the personal data of co-op members and other people belonging to co-op member households. Personal data is required for purposes such as the provision of services and benefits in the co-op member scheme, managing customer relationships and maintaining the membership lists of cooperatives. Customer data allows us to also offer S Group’s customers relevant services and benefits that meet their individual needs as closely as possible, as well as produce targeted and personalised content and advertising. 

Some of our services, such as S User Accounts and online stores, can also be used without co-op membership or belonging to a co-op member household. The data of such customers is processed for purposes such as the provision of the online store service or other digital service used by the customer, processing customer feedback and other management of customer relationships. 

We also utilise customer data in the planning and development of S Group’s business operations. For this purpose, we may use personal data for purposes such as analysis and profiling, or to carry out surveys or market studies. We may also process personal data for marketing purposes of our partners and organisations that belong to S Group at any given time. The term “S Group” refers to the cooperatives and the SOK Group together with its subsidiaries and associated companies. The term “partner”, meanwhile, refers to companies that grant Bonus and/or benefits to co-op members, for example, and companies that cooperate with S Group, implement joint marketing or buy media visibility from S Group. 

The storage periods of data vary based on the purpose for their use. The storage of an individual data item in the register lasts until the end of the longest storage period set for said data item, but the data may be used for each purpose only for the time indicated in the table below. Certain data related to the management of customer relationships are stored for the entire duration of the co-op membership or membership in a co-op member household. Meanwhile, detailed purchase data is stored for a maximum period consisting of the year of the purchase and the ten years following it. 

Personal data is generally erased within six months of the termination of a customer relationship. However, we store some data for a longer period of time. This includes data related to membership in a cooperative and data related to the payment of membership fees. This information is stored for a period consisting of the year of the monetary transaction and six years following it. A customer relationship may end due to resignation or termination, or when the customer leaves a co-op member household. 

Data related to the S User Account is deleted when the customer relationship ends. S User Account customer relationship is considered to end when the customer requests the account to be deleted. 

The tables below provide more detailed information regarding what purposes the personal data in the register are used for, and how long the data is stored. 

4.1 Basis for processing: contract 

When joining as a co-op member or joining a co-op member household, you must accept the rules of the co-op membership scheme. Co-op members must also accept the bylaws of the co-op when joining. Customers using our digital services must accept the terms and conditions of the services, such as the S User Account, Collect and Scan service or online stores.   

4.2 Basis for processing: consent 

4.3 Basis for processing: legitimate interest 

Description of the data controller’s legitimate interest 

We have assessed the legitimate interest on the basis that S Group’s operations are cooperative in nature and S Group is owned by its co-op members. Co-op membership of S Group is optional and the membership scheme is open to anyone. The purpose of S Group's operations is to provide customer-oriented, meaningful and cost-effective services and benefits to co-op members, and thus promote financial wellbeing of co-op members. The analysing of purchasing behaviour and the calculation of customer profiles, as well as related direct marketing and content targeting, opinion polls and market surveys are key ways to achieve this goal. We ensure that the processing based on a legitimate interest is correctly proportioned to your interests and in compliance with your reasonable expectations.  

5. Data sources 

We obtain data from the agreement you sign when you join S Group’s co-op membership scheme, and from you personally during the customer relationship by phone, websites, email or other similar methods or based on your use of services.   

Updates of name, address and mobile phone data, as well as information about death, can also be received from authorities or companies providing updating services. Information on Robinson marketing prohibitions for telemarketing/direct marketing by post comes from Suomen Asiakkuusmarkkinointiliitto ry. Information of employment in the S Group and information of the right to receive the personnel discount come from S Group’s employee registers.  

We obtain data on your use of the S-Etukortti card and any transactions you perform when identified online from those organisations that belong to S Group's co-op member scheme and from partners that grant the S Group Bonus. In addition, we might obtain information from organisations belonging to S Group and partners belonging to the co-op membership scheme that utilise the S-Etukortti card or other credentials to verify your identity in their services.  

We obtain limited personal data also on SOK and S-Bank’s shared customers from our joint register. For more information, see section 12 of this notice.  

6. Recipients of personal data 

We disclose information to the Tax Administration about any interest paid to co-op members on their co-op contribution and return on capital paid to resigned members. We can also disclose information within the limits allowed and required by valid legislation, such as when answering authorities’ requests for information.  

We disclose information about your online groceries purchases to a co-operative in order for them to deliver your order. We may also disclose your contact details and personal identity code to the co-operative if the information is necessary for the billing or collection of an unpaid online store order.

We may also disclose customer contact details and information about S-Etukortti cards to the co-operative for customer service purposes, as well as to identify, investigate and deal with suspected abuse of the co-operative’s rules, the rules of the membership scheme, or the rules of the staff discount scheme and related suspected criminal offences.

We disclose the delivery information of your order to Posti or other similar operators such as PostNord to deliver products you have purchased. The disclosure of the information is based on the agreement concluded as part of the product purchase.  

With your consent, we disclose information about your co-op membership to a partner that grants S Group Bonus.  

With your consent, we may disclose your data to third parties outside S Group or for external purposes, such as scientific research.  

Your personal data associated with customer feedback is received by S Group’s internal customer service teams, as well as product specialists participating in the processing of your feedback.  

Your demographic data and data about you belonging to a customer group can also be processed with other data in SOK’s customer registers in order to develop business operations in analytics and reporting for each customer group. This data can also be used for improving the quality and targeting of customer service, for example, when you book a room in one of S Group's Sokos Hotels.  

In some situations, we use subcontractors, who process customer information by our orders and on our behalf. The subcontractors we use carry out services on our behalf, such as IT services, IT system maintenance services, customer communications, marketing and customer research campaigns, payment services and delivery services for our online stores. The subcontractors are granted access to such customer information that they need to produce the agreed services for us. When it comes to providers of payment services for online stores, the necessary information may also include the cardholder’s name and contact details. 

We disclose limited personal data also on SOK and S-Bank’s shared customers to our joint register. For more information, see section 12 of this notice.  

7. Transfer of personal data to third countries or international organisations and data protection safeguards used 

We use subcontractors to process personal data and the data is transferred in a limited way outside the European Union (EU) or the European Economic Area (EEA) for the purposes of service provision, technical administration and support. We can perform these types of transfers if the European Commission has decided that the target country or organisation has a sufficient level of data protection or we can otherwise ensure a sufficient level of protection of the personal data in accordance with applicable legislation, such as by using standard contractual clauses approved by the European Commission. You can read more about the standard contractual clauses approved by the European Commission here. 

We require our subcontractors to agree to follow the data protection and information security requirements of legislation and SOK.  

8. Rights of the data subject 

You have the following rights:  

To see your personal data that is recorded in S Group’s co-op member and customer register, log in to your S User Account at https://s-kayttajatili.fi/en. You can also update some of your information on the S User Account.  

You can withdraw your consent and object to data processing and direct marketing based on a legitimate interest and thereby control how we use your personal data. To do this, you can grant and withdraw authorizations and prohibitions by logging in to your S User Account at https://s-kayttajatili.fi/en, in the S-mobiili mobile app or by clicking the link in the email message you received.  

To exercise your rights or get more information on how your personal data is processed, you can also contact the controller by sending an email to tietosuoja.asiakkuus@sok.fi.  

You also have the right to file a complaint with a supervisory authority if you are of the opinion that we are in breach of the applicable data protection legislation when we process your personal data.  

9. Effects of not providing personal data on an agreement 

In order to become a co-op member and to join the S Group co-op member scheme, the customer must provide the necessary information so that the agreement can be concluded (name, address, social security code given by the Finnish civil registrant). If the necessary personal data is not provided, the agreement cannot be concluded.  

In order to become a member of a co-op member household and to join the S Group co-op member scheme, the customer must provide the necessary information so that the agreement can be concluded (name, address, social security code given by the Finnish civil registrant or date of birth).   

Providing the information required for concluding the relevant service agreement is a prerequisite for the provision of the services based on the register data. The information required for concluding a service agreement varies depending on the service.   

10. Significant information related to automated decision-making or profiling 

We do not perform such automatic decision-making or profiling on the basis of the data in the register that would result in legal effects concerning the data subject. If you are using the Collect and Scan service, automatic decision-making is performed in the service on the basis of the use of the service and the scanner. The results of such analyses may lead to you being directed to have your products verified at the cash counter.  

11. Impact of the processing of personal data and a general description of technical and organisational security measures 

We diligently protect your personal data by employing the appropriate data protection and information security measures. Our system providers process your personal data at secure server facilities. Access to personal data is restricted, and the personnel are subject to a confidentiality obligation.  

S Group protects your personal data by means of, for example, preventive risk management and security planning, protection measures for data communications, and by using secure hardware facilities, access control and security systems. After initial processing, hard copies containing personal data are stored in locked and fire-safe storage facilities. The granting and monitoring of user rights is a well-managed process. We regularly provide training for our personnel who participate in the processing of personal data, and ensure that our partners’ personnel also understand the confidential nature of personal data and the importance of secure processing. We select our subcontractors with care. We continuously update our internal practices and guidelines.  

If, despite all of our safeguards, your personal data ends up the wrong hands, we will immediately begin investigating the incident and aim to prevent any damage caused. We will inform the relevant authorities and you of the data security breach in accordance with legislative requirements.  

12. Data protection concerning the joint data register and controller role for shared customer data of SOK and S-Bank 

12.1. Purpose and data subjects of the joint register 

Suomen Osuuskauppojen Keskuskunta (SOK) as a data controller and S-Bank Plc as a data controller are the joint controllers of data described in this section 12 of the notice. In this description, we will define the data subjects and what kind of information is processed in the register. We will also explain how the roles of joint data controllers have been determined in relation to the data subjects. This section supplements the privacy policies of the SOK and S-Bank customer registers.   

Natural persons covered by the joint register:   

S Group and S-Bank have a shared task of providing their customers with benefits and services. The purpose of the joint register is to enable the production and development of these benefits and services so that you as a data subject can get the most out of both your shopping and banking memberships. With the joint register, we can also develop S Group’s and S-Bank’s shared mobile app (S-mobiili) and provide an even better service.  

We also use the joint register to ensure that you can maintain your customer information as easily as possible and manage consent matters included in the joint register.  

As the data controller, we will use the data included in the joint register for the shared purposes described below. The data will also be used for purposes determined separately in the privacy policies of S Group’s co-op member and customer register and S-Bank’s customer register.  

12.2. Data areas included in the joint register 

* Personal data will be processed also as part of SOK’s co-op member and customer register and S-Bank’s customer register independently for their own purposes. 

12.3. Recipients and recipient groups of personal data 

We disclose personal data from the joint register to S Group’s co-op member and customer register and S-Bank’s customer register in accordance with the table above. The purpose of use of these data is to maintain basic information, develop S-mobiili and customer analytics. We may disclose register data to third parties in accordance with the privacy policies of the registers.    

We ensure that the transfer of data is lawful if transferring customer data to countries outside the EU/EEA is necessary for technical aspects related to the processing of personal data.  

12.4. Data subject’s rights in the joint register 

As a data subject, you can approach either data controller to exercise your rights related to the joint register data. We recommend contacting the data controller that is relevant to the rights you wish to enforce. In store customer matters, you can turn to SOK, and in banking matters, to S-Bank.   

If you think the processing of personal data is unlawful, you have the right to lodge a complaint or contact the Office of the Data Protection Ombudsman acting as the supervisory authority.  

You can prohibit the processing of personal data for advertising and analytics by using your right to opt out or by revoking your previously given consent. As a result, the contents of S-mobiili may be less personalised and we will not be able to provide you with targeted announcements or advertising in the best way possible.  

12.5. Contact information of the parties to the joint register 

13. Contact person for the register 

If you need more information about the processing of personal data, you can contact us by email at the address: tietosuoja.asiakkuus@sok.fi 

---

Links to other privacy notice language versions: 

SV: Ägarkunds- och kundregister - Dataskyddsbeskrivning
EN: S Group’s co-op member and customer register - Privacy Policy
ET_ S-grupi ühistuliikmete ja klientide register - Andmekaitsetingimused