Privacy Policy

Summary of Information

General

Your privacy is extremely important to us at Busbus. We want you to feel confident when providing your personal data for us to process. As the data controller, we ensure that your personal data is always protected in accordance with applicable legislation.

Scope

This privacy policy applies to all processing of personal data that Busbus conducts in the course of its operations in relation to you as a private customer.

Collected Personal Data

The personal data we collect about you comes mainly from the agreements you enter into with us and from your use of our services. This may include, for example, contact details, demographic data, order and payment information, and information on how you use our services.

We use cookies on our website to improve the user experience. Cookies may contain personal data. You can read more about the use of cookies in our full Cookie Policy.

Use and Sharing of Personal Data

Busbus processes your personal data to provide you with the best possible products and services. Your personal data is used for the following purposes:

  • Management and performance of contracts

  • Marketing of Busbus’s and its partners’ services, including targeted direct marketing

  • Development of methods and business operations

  • Administration in connection with acquisitions, restructurings, etc.

  • Protecting our legitimate interests in dispute situations.

We do not use your personal data for other purposes. We retain data only for as long as necessary.

In some cases, we may share your personal data with IT service providers or our partner companies that handle our product and service offering. We do not sell your personal data to anyone.

Your Rights

You have the right to obtain information about what personal data we process and how, and to manage your data as described in this policy. In certain cases, you have the right to obtain your data, or to have it rectified, deleted or transferred, and to restrict its use. You also have the right to object to certain types of processing of your personal data and to withdraw your consent to its use. If you believe that we have processed your personal data incorrectly, you can contact the Office of the Data Protection Ombudsman. For more information about your rights, please read the full privacy policy.

Contact Details

If you have any questions about this privacy policy or the processing of personal data, or if you wish to exercise your rights, please contact:

Postal address:
Niittykatu 10 A 23, 02200, Espoo

Email: sales@busbus.fi
Phone: +358 41 318 8884
Website: www.busbus.fi

1. General

1.1 Busbus Oy, Business ID 2975714-6 (“Busbus”) respects and safeguards your personal privacy. We want you to feel confident when providing your personal data for us to process. With this privacy policy (the “Privacy Policy”), we want to explain how we ensure that your personal data is processed in accordance with applicable legislation.

1.2 We process your personal data in order to provide you with our products and services. This Privacy Policy applies to all our private customers.

2. Data Controller

2.1 Busbus is the data controller for the personal data processed and is responsible for ensuring that processing is carried out in accordance with applicable legislation. Our contact details can be found at the end of this Privacy Policy.

3. How We Use Your Personal Data

3.1 Busbus processes your personal data to provide you with products and services in the best possible way. Your personal data is therefore used for the following purposes:

  • Management and performance of contracts

  • Marketing of Busbus’s and its partners’ services, including targeted direct marketing

  • Development of methods and business operations

  • Administration in connection with acquisitions, restructurings, etc.

  • Protecting our legitimate interests in dispute situations.

You can find more information below about, among other things, why we process your personal data, what personal data we store for these purposes, and how long the data is retained.

3.1.1 We use your personal data to provide our services and customer service, to process payments, and to enable logging into the website.

Purpose:
Management and performance of contracts and protecting legitimate interests in dispute situations.

Personal data:
Contact details such as name, phone number, email address.
Order and payment information such as order history and payment details.
Demographic data such as postal address.

What we do:
We use your personal data to provide, manage, and customise our services and products, to enable logging into online services, and to provide customer service.

Legal basis:
Performance of a contract. Sensitive personal data is processed only with your explicit consent.

Retention period:
Personal data is retained for up to 12 months from the most recent activity.

Your rights:
You have the right to object to processing that we carry out based on a balancing of interests. You can read more about your rights in section 9.

3.1.2 We market our own services and those of our partners and create tailored advertising for you.

Purpose:
Marketing of Busbus’s and its partners’ services, including targeted direct marketing.

Personal data:
Contact details such as name, phone number, and email address.
Browsing data such as which pages of our website you visited and how long you spent there.
Order and payment information such as order history and payment details.
Demographic data such as postal address.

What we do:
We process your personal data for marketing and market segmentation. By market segmentation we mean classifying the customer base using demographic criteria such as postal address to send direct marketing and non-personalised information about offers, services, news, and competitions. If you wish to receive targeted offers and information about news and competitions—for example, offers for particularly favourable charter services—we need your consent. We then analyse, for example, in which months you use our different services and how often. The analysis also covers your browsing habits on our website, your purchase and payment history, your name, and your postal address so that we can provide you with appropriate information.

Legal basis:
Balancing of interests, as we consider our interest in sending general and segmented marketing material to outweigh your interest in protecting your personal data (marketing by post, phone, and social media, as well as marketing via email, text messages, MMS, and other automated systems, if the requirements of consumer protection law are met). Consent.

Retention period:
Customers: Personal data is retained and processed for the duration of the contract and for up to 12 months after its termination. This requires that you have not objected to direct marketing during this period.
Others: We are entitled to retain your personal data for marketing purposes for 3 months from when we obtained your contact details. This naturally requires that you have not objected to direct marketing.

Your rights:
You always have the right to require us to stop using your personal data for direct marketing. You also have the right to withdraw your consent at any time if we require your consent to process your personal data. If you withdraw your consent, you will no longer receive targeted information and offers. More information about your rights can be found in section 9.

3.1.3 We analyse statistics and assessments in order to develop and improve our services and products.

Purpose:
Development of methods and business operations.

Personal data:
Contact details such as name, phone number, and email address.
Purchasing habits such as information on how you use our services and purchasing patterns (for example, in which months you most frequently use our services).
Order and payment information such as order history and payment details.
Demographic data such as postal address.
Browsing data and page history such as which pages (ours and others) you visited and how long you spent there.

What we do:
We use your personal data in connection with our market and customer analyses. The analyses mainly consist of statistics and the results of performed market segmentations and customer satisfaction surveys. We use the results of our analyses as a basis for improvements, corrective measures, or for developing new services, processes, or ways of working to meet our customers’ expectations and wishes. For example, we may use personal data to improve our customer service, to offer new package solutions, or to adapt our website to our customers’ preferences. We want to make it clear, however, that we always strive to anonymise or pseudonymise your personal data as far as possible for this purpose.

Legal basis:
Balancing of interests, as we consider our interest in analysing the use of our products and services to improve, replace, or develop services to outweigh your interest in protecting your personal data.

Retention period:
We retain and use your personal data for this purpose for the duration of the contract and for up to 12 months after its termination.

Your rights:
You have the right to object to the processing of your personal data when we conduct a balancing of interests. If you object to such processing, we will only continue to process your personal data where there is a compelling reason that outweighs your own interest. Read more about your rights in section 9.

3.1.4 We use your personal data in connection with business acquisitions and restructurings.

Purpose:
Administration in connection with acquisitions, restructurings, etc.

Personal data:
Contact details such as name, phone number, and email address.
Order and payment information such as order history and payment transaction data.

What we do:
If our company undergoes a restructuring, for example by being divided into several business areas, or if an external part is incorporated into the company or our customer database, we will transfer our customers’ personal data to the acquiring company. In such cases, the company will continue to process your personal data for the same purposes provided in this Privacy Policy unless otherwise stated at the time of transfer.

Legal basis:
Balancing of interests, as we consider our interest in enabling a business acquisition or restructuring to outweigh your interest in protecting your personal data. This requires that the acquiring company conducts business similar to ours.

Retention period:
If our company ceases to exist as a result of a merger, liquidation, or bankruptcy, or if our customer database is transferred to an acquiring company, we will delete your personal data unless we need it to comply with legal obligations. If our company merges with the acquiring company in connection with an acquisition or is divided in connection with a restructuring, we will continue to retain and process personal data under the terms of this Privacy Policy unless otherwise stated at the time of transfer.

Your rights:
You can find more information about your rights in section 9.

3.1.5 We use your personal data, for example in a payment-related dispute, to establish, defend, or exercise a legal claim.

Purpose:
Protecting our legitimate interests in dispute situations.

Personal data:
Contact details such as name, phone number, and email address.
Order and payment information such as order history and payment transaction data.
Demographic data such as postal address.

What we do:
In a payment-related dispute, for example, we have the right to use your personal data to establish, defend, or exercise a legal claim.

Legal basis:
In dispute situations, we have the right to use your personal data based on a balancing of interests, as we consider our interest in establishing, defending, or exercising a legal claim to outweigh your interest.

Retention period:
Data is retained for as long as necessary to establish, defend, or exercise a legal claim, for example in a payment-related dispute.

Your rights:
You can find more information about your rights in section 9.

5. Where Personal Data Comes From

4.1 Personal data about you originates from various sources. Contact details, demographic data, browsing history, and order and payment information are provided when ordering services or using our services.

4.2 You must provide certain personal data to Busbus so that we can enter into an agreement and provide services to you. If you do not provide the information we need for our operations, we unfortunately cannot enter into an agreement with you or provide services to you.

5. Automated Decision-Making

5.1 We do not use automated processes for decisions that significantly affect you.

6. How Long Is Personal Data Retained?

6.1 We retain your personal data only for as long as necessary for the purposes for which the data was collected in accordance with this Privacy Policy. When we no longer need your personal data, we delete it from our systems, databases, and backups. The tables above under section 3 provide information on how long we retain personal data for each purpose.

6.2 There may also be other reasons for retaining personal data, such as compliance with legal requirements, protection of our legitimate interests, or other important public interests.

7. To Whom Do We Disclose Personal Data?

7.1 Busbus may share your personal data with third parties such as IT service providers or our partner companies that handle our service offering. In certain cases, we may disclose personal data at the request of authorities or to other parties in courts or in connection with business acquisition procedures or similar situations.

7.2 We do not sell your personal data to other parties.

8. Where Is Personal Data Processed?

8.1 Busbus always strives to process personal data within the EU/EEA. In certain cases, we may disclose personal data to countries outside the EU/EEA. If personal data is transferred to a country outside the EU/EEA, we ensure that the transfer and processing are carried out securely and in compliance with the law.

8.2 For transfers of personal data to the United States, we use only partners that operate under the Privacy Shield framework.

9. Your Rights

9.1 Our Responsibility for Your Rights

9.1.1 As the data controller, Busbus is responsible for ensuring that your personal data is used in accordance with the law and that your rights are fulfilled. You can contact us at any time if you wish to exercise your rights. Our contact details are at the end of this Privacy Policy.

9.1.2 Busbus is obliged to respond to requests related to the exercise of your rights within one month of receiving them. If the request is complex or if numerous requests have been submitted, we have the right to extend the response time by two months. If we consider that we cannot fulfil your request, we are obliged to inform you of the reason for this within one month of receiving the request. At the same time, we will inform you of your right to lodge a complaint with the supervisory authority.

9.1.3 All information, communications, and measures we take are free of charge for you. If a request related to your rights is clearly unfounded or unreasonable, we have the right to charge an administrative fee for providing the information to you or performing the requested action, or to refuse the request entirely.

9.2 Right to Access, Rectify, Erase, or Restrict

9.2.1 You have the right to ask Busbus to:

a) share personal data with you. This means you have the right to obtain a register extract showing how we use your personal data. You also have the right to receive a copy of the personal data we process free of charge. If you want more copies, we have the right to charge an administrative fee. If you make the request electronically, for example by email, we will provide the information in a commonly used electronic format.
b) rectify your personal data. We will rectify, anonymise, delete, or supplement personal data that we find to be incorrect, incomplete, or misleading at your request or on our own initiative. You also have the right to supplement the data if something essential is missing.
c) delete your personal data. You have the right to request that we delete your personal data if there is no longer a legitimate reason for processing it. Personal data will be deleted if
(i) the personal data is no longer needed for the purpose for which it was collected
(ii) we use personal data based on your consent and you withdraw the consent
(iii) you object to processing carried out after a balancing of interests and we have no compelling reasons for processing that outweigh your interests and rights
(iv) we have processed personal data in a way that is not permitted
(v) we are legally obliged to delete the personal data
(vi) the data subject is a child and we collected the personal data in connection with the provision of information society services.

If there are applicable legal requirements or other compelling reasons, we may not be able to delete your personal data immediately. In that case, we will stop using your personal data for purposes other than those required by law or necessary for other compelling reasons.

d) restrict the processing of personal data. This means that we temporarily limit the use of your personal data. You have the right to ask us to restrict the use of your personal data when
(i) you consider your personal data to be incorrect or you have requested rectification under section 9.2.1(b) while we verify the accuracy of the data
(ii) there is no legal basis for processing the personal data but you do not want the data to be deleted
(iii) we as the data controller no longer need the personal data for our own purposes, but you need it yourself to establish, exercise, or defend a legal claim
(iv) you have objected to the use of personal data under section 9.3.1 and are awaiting a decision on whether our compelling interests outweigh your own.

9.2.2 Busbus will take all necessary steps to inform all parties who have received personal data in accordance with section 7 whether we have rectified or deleted the data or restricted access to it after the data subject’s request. Upon request, we will inform you which parties we have disclosed personal data to.

9.3 Right to Object to Processing

9.3.1 You have the right to object to the processing of your personal data that we carry out based on a balancing of interests or public interest (see section 3). If you object to such processing, we will only continue to process your personal data where there is a compelling reason that outweighs your own interest.

9.3.2 If you do not want Busbus to use your personal data for direct marketing, you have the right to object to processing for that purpose by contacting us. Once we have received notice of your objection, we will stop processing your personal data for such marketing purposes.

9.4 Right to Withdraw Consent

9.4.1 If we use your given consent as the legal basis for processing personal data (see section 3), you may withdraw your consent at any time by contacting us. Our contact details are at the end of this Privacy Policy. If you withdraw your consent, you may not be able to use our services in the way we intend.

9.5 Right to Data Portability

9.6 You have the right to data portability. You have the right to receive some of your data in a structured, commonly used, and machine-readable format and to transfer this data to another controller. You have the right to data portability only when the processing of personal data is automated and based on your consent or on a contract between us.

9.7 Right to Lodge a Complaint with a Supervisory Authority

9.8 You have the right to lodge a complaint regarding our processing of personal data with the Office of the Data Protection Ombudsman.

10. Protection of Personal Data

You should always be able to provide your personal data to us with confidence. Busbus has therefore implemented appropriate security measures to protect your personal data from unauthorised use as well as improper alteration and deletion. If a security incident occurs that could significantly affect you or your personal data—for example, if there is a risk of fraud or identity theft—we will contact you and inform you what you can do to reduce the risk.

11. Cookies

Busbus uses cookies on its website and in its services to improve the user experience. Among other things, we use cookies to simplify and customise our online services. More information about the use of cookies and related choices is provided in our Cookie Policy.

12. Changes to This Privacy Policy

Busbus reserves the right to make changes to this Privacy Policy at any time. When we make changes that are not purely linguistic or editorial, we will clearly inform you about the changes and what they mean well in advance of their entry into force. If we need your consent to fulfil our commitments and you do not accept the amended terms, you have the right to terminate the agreement you have with us before the terms enter into force.

13. Contact Details

Please contact us if you have any questions about this Privacy Policy, the use of personal data, or if you wish to exercise your rights.

13.1 Busbus Oy, Business ID 2975714-6.

Postal address: Niittykatu 10 A 23, 02200, Espoo
Email: sales@busbus.fi
Phone: +358 41 318 8884
Website: www.busbus.fi