Data Protection Notice, Kesko’s web browsing register

This notice applies to personal data processing in the web browsing register

1. Who is responsible for personal data processing related to the web browsing register?

Kesko Corporation, Helsinki
Business ID 0109862-8
PO BOX 1, FI-00016 KESKO

With regard to this service, you can contact us

By email:

By mail:
Data protection/Web browsing
Kesko Corporation
FI-00016 KESKO

2. What data do we process?
We process, for example, the following data, collected with the help of cookies or corresponding technology:

Identifiers such as K-Plussa card number or email address

3. For what purposes will your personal data be processed?

We utilise data collected from K Group’s online services using cookies or corresponding technologies to develop K Group’s business operations and customer service, and for marketing, analytics and statistical purposes and other such purposes. If we can link, for example, a Plussa card number or some other piece of customer data from the K-Plussa customer register or the K ID register to an online identifier, we will aim to link the online identifier to customer data collected offline.


If we cannot identify you during your visit, the information will not be recorded in our systems as your data.

Your data will be processed based on the consent you have given for monitoring cookies on your terminal device or in your browser settings.


4. Storage period

We store web browsing data for 51 months at the most, after which all personal data will be removed from our register.


The controller shall store personal data for as long as it is accountable to do so under law.


5. Right to withdraw consent

We inform visitors of the use and purpose of use of online identifiers in our online services.

By accepting the use of online identifiers on your data terminal or in your browser settings, you give consent to the collection of the identifiers.

You can stop the collection of online identifiers by disabling them on your terminal device.

Search online for detailed instructions on how to disable and enable online identifiers or cookies in your browser.

6. What other rights do you have?

Checking the data
When you request access to your data, Kesko will inform you on whether it is processing personal data on you or not, and will provide you with a copy of the personal data being processed.

Correcting the data
You have the right to have incomplete personal data on you completed and inaccurate data corrected.

Removing the data
You have the right to request for your personal data to be removed from the register. Your data will be removed if there are no longer legal grounds for processing them.

Transferring the data
You have the right to obtain the personal data you yourself have provided to us in a machine-readable format and transmit the data from one system to another if the processing is based on consent or contract and if the processing is carried out by automated means.

Objecting the processing of the data
We may process your personal data on the basis of a legitimate interest as part of our business operations if we have determined that the processing does not infringe your personal data protection. In such cases, you have the right to object the processing of your personal data for personal reasons.

Restricting the processing of the data
You may have the right to restrict the processing of your personal data. Once the processing has been restricted, the controller as a rule will not process your data in any other way except for storing the data. This right exists, for example, if you contest the accuracy of your personal data, if the processing is unlawful, or if you have objected to the processing of your personal data and are waiting for a response to your request.

7. How do you exercise your rights?
Kesko has a data protection portal at www.kesko.fi/tietosuoja. In the portal, you can submit a request by strong identification using your online banking codes. We will primarily use the portal to answer requests received through the portal, unless you specifically request a different delivery method.

If you do not want to or cannot use the portal's services, you can also send a request to us with a personally signed letter to the above address. Mark the envelope with "data protection". We will respond to this type of request by letter. If the response contains your personal data, we will deliver the letter by personal registered post. Only the person marked as the recipient can acknowledge receipt of the letter. This allows us to ensure the correct recipient of the letter and the confidentiality of the data.

Alternatively, you can contact the email address stated above.

8. Information on recipients of personal data
Kesko as the controller will process personal data itself, but will also use various service providers. Kesko strives to use the best, reliable partners and is responsible for the actions of the service providers it has selected with regard to the processing of personal data. Such service providers may vary, but include:

Personal data is deemed to be transferred outside the EU/EEC in connection with the provision of information technology services when the information can be accessed from India. An agreement based on EU standard contractual clauses has been made with the service provider regarding the transfer. The standard contractual clauses can be viewed at http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.

Data from the register will be disclosed for marketing purposes to companies belonging to Kesko Group.

Some authorities also have a legal right of access to the data, for example, the police, customs, border guard and tax authorities.

9. Appeal directions
If you consider that we do not process your personal data in accordance with the EU General Data Protection Regulation, you can file a complaint with the supervisory authority. In Finland, this authority is the Data Protection Ombudsman.

10. Necessary data for the web browsing register
We monitor web browsing in order to be able to improve user experience in our online services and target marketing pertinent to your interests.

If you wish, you can prohibit web browsing monitoring by disabling online identifiers on your terminal device.

11. Information on automated decision-making, including profiling
Profiling means any form of processing of personal data consisting of the use of the data to evaluate certain aspects relating to your person. We profile customers e.g. for the purposes of targeted marketing and the development of our online service user experience.

Based on customers’ web browsing behaviour or the purchase data of an identified person, we categorise customers into customer segments considered to be interested in certain types of products or services. In our view, the profiling does not produce legal effects as referred to in the regulation or other notable effects for the target of the profiling.

12. Use of data for other purposes
We do not use data for purposes other than those stated in this document. If other needs arise later, we will inform you of those needs and of the grounds for processing. If necessary, we will request consent from you to process personal data for other purposes.

13. Data obtained from other sources than you
If you have been identified against the Plussa or K ID register, we will utilise the data in said customer registers in order to provide, for example, targeted marketing that suits your interests.

14. The data protection officer
You can contact Kesko's data protection officer if your request concerns personal data processing or the exercise of your rights under the EU General Data Protection Regulation in the operations of Kesko or its subsidiaries.

You can contact Kesko Corporation's data protection officer by email at tietosuojavastaava@kesko.fi.