Data protection at Kesko

We comply with good personal data processing practices and legislation in all our operations and everywhere we operate. You can rely on us to process your data securely and with care. On this page you will find more information about the processing of personal data and your rights at Kesko and it’s subsidiaries (hereinafter referred together as Kesko). Customers and quality are at the core of everything we do.
 

Why do we process personal data?

 
Kesko's operations are based on data. We collect data to serve you individually in K-Group operations. With sufficient and correct data, we are able to offer personally meaningful benefits and rewards, as well as just the right kind of selections and services.

The processing of personal data is also necessary for the implementation of various contracts concluded with the customer. We need personal data so that we can, for example, collect and deliver your online purchases to the place of your choice.

We also utilize customer data in business management and in developing our products and services. The data is used to manage customer relationships, for marketing purposes and, for example, to develop online services and improve the customer experience.
 

Where do we collect data?

 
As a rule, we use data, such as name, address, e-mail address and other basic data, provided by the customer. We also use data collected from the use of our services, such as online behavior data or purchase data when permitted by the customer. Each data protection notice mentions the sources of data.
 

How is the security of processing ensured?

 
Kesko's system and application development processes include work phases that analyze the data protection requirements applicable to the purposes for which personal data is used. The applicable data protection requirements vary depending on the personal data collected and the purpose for which the data is collected. We design the technical implementation so that it corresponds to the risk level of processing. Based on the level of risk, we select appropriate controls and security practices to manage the risk and achieve compliance.

Kesko regularly trains its personnel on both data protection and information security. We also use technical methods such as firewalls, centralized user access rights management, access control, multifactor authentication, system updates, to mention a few.

If safety is found to have been compromised, the matter will be investigated immediately. If we find that a personal data breach has occurred, we will immediately take the measures required by the General Data Protection Regulation, e.g. if the matter so requires, we will notify the data protection authority and the data subjects.
 

How can you exercise your rights?

 
You may contact the data protection officer or other data protection contact with regard to all issues related to processing of your personal data and to the exercise of your rights under the Data Protection Regulation.

You can find the relevant contact details in the data protection notice connected to the business concerned.

In Finland Kesko's data protection portal is an easy way to approach controllers belonging to the Kesko Group of companies in data protection matters and to exercise your data protection rights. 

In other Kesko countries of operation the data protection notices are available on the webpage of the business. Usually you can find it in the footer of the front page.

You can also make a request for action by letter. Please send it to the contact address mentioned in the data protection notice concerned.

Your rights under the GDPR are:

Right to information about processing
Information on the processing of your personal data in Kesko Group, available as mentioned above.

Right of access
You have the right to access your personal data and the right to receive a copy of it. When you request access to your data, Kesko will inform you whether or not personal data concerning you  is processed and provide a copy of the personal data processed.

Right to rectification
You have the right to have your incomplete personal data completed and also your inaccurate data corrected.

Right to erasure
You have the right to request the removal of your personal data. Your data will be deleted if there is no longer a legal basis for processing.

Right to data portability
You have the right to receive the data you have provided to us in a machine-readable format and to transfer the data from one system to another when the processing is based on your consent or a contract and the processing is carried out in an automated manner.

Right to object
We may process your personal data on the basis of legitimate interest as part of our business operations, having considered that the processing does not infringe the protection of your personal data. You can check the legal basis and related purposes of use of personal data in the data protection notice. When processing is based on legitimate interests , you have the right to object to the processing of your personal data by referring to your personal reasons.

You may also object to the processing of your personal data for direct marketing purposes at any time.

Right to restriction of processing
You may have the right to restrict the processing of your personal data. Once processing has been restricted, the controller will not, as a rule, process your data other than in any other way except storing the data. This right exists, for example, if you contest the accuracy of your personal data, if the processing is unlawful, or if you have objected to the processing of your personal data and are waiting for a response to your request.
 

Information about cookies and similar technologies

 
Kesko uses cookies and other similar technologies and tracking identifiers in its services, such as its websites and mobile applications. We use cookies to ensure that the service works as desired, that the choices you make will be taken into account, that the content is interesting to you and that our advertising displayed elsewhere on the Internet is relevant to you. Insofar as the use of cookies is not necessary for the operation of the website and the provision of services, we will ask for your consent to the use of cookies. You can withdraw your consent at any time via the "Cookie Settings" link at out cookie consent tool.

More information on the cookie practices of Kesko's Finnish operations can be found at the data protection portal.
 

Loyal customer systems and data protection

 
In Finland we have a loyal customer system called Plussa. You can view and update your data while logged in to the Plussa.fi/Oma Plussa service or by calling K-Plussa customer service. On your personal pages in Oma Plussa, you can update, among other things, your phone number and email address and manage your electronic marketing permissions. In Oma Plussa, you can track your purchases, points and accumulated Plussa money, as well as your personal benefits. There you can also order parallel cards, report your card as lost or order a new card to replace a damaged one.

Plussa Customer Service: https://plussa.fi/customer-service/k-plussa-customer-service

In other countries of operation you can find information about possibly available local loyal customer system at the web pages of the business concerned.