Privacy Notice for the Consumer Service

 

• Updated 19 February 2026.
• In this Privacy Notice, we describe what personal data Atria Suomi Oy and Atria Oyj ("Atria" or "we") collect and process when you use our consumer service.
•  

1.             Contact details for register matters

• Atria
• O. Box 900, Atriantie 1, Nurmo
• 60060 ATRIA, Finland
• Telephone: +358 20 472 8111
• Email: tietosuoja@atria.com
•  

2.             What data do we process, and what are the purpose and legal basis for processing personal data?

• When we process consumer feedback and respond to it, we process the following personal data:
• The name and contact details of the person giving feedback, address details, and email address and telephone number, depending on which method of contact you have requested from us
• Information about the product to which the feedback relates, as well as any images you have sent us
• The content of the consumer feedback you have sent and the history of the feedback you have given
• In product liability and compensation cases, additionally your personal identity code, bank account details, and, where applicable, a medical certificate to demonstrate harm caused by an Atria product
• Atria processes the personal data specified above for the following purposes:
• To respond to product complaints and to send compensation vouchers; and
• In product liability and compensation cases, to handle the matter and to disclose the necessary information to the insurance company.
• The email address may be used to send a consumer satisfaction survey intended to develop the consumer service, but responses to the survey are given without identifying information.
• We may also process feedback for statistical purposes, product development, and business development in order to improve our services. For these purposes we anonymise your personal data so that you can no longer be identified.
• The personal data processed in the consumer service is not used for automated decision-making or profiling, nor for electronic direct marketing.
• The processing of personal data for the purposes specified above is based on Atria's legitimate interest, which is based on the relationship between you and Atria that arises when you leave a message with our consumer service via the electronic form or otherwise contact our consumer service. As the person giving feedback, the processing of personal data is necessary in order to handle and respond to the feedback.
• To the extent that Atria processes a medical certificate you have submitted, or health data you have voluntarily provided in your consumer feedback, the basis for processing such data is your explicit consent.
•  

3.             Where do we collect your personal data from?

• We collect your personal data from you directly through Atria's electronic feedback form, and if you have left us a contact request, we also collect data about you either by telephone or by email, depending on which contact channel you have chosen.
•  

4.             Who can process your data, and do we disclose it to third parties?

• Atria uses third-party service providers in the processing of the personal data it collects, such as companies providing IT, consulting, and marketing services. These partners may act as processors of personal data in accordance with our instructions, in which case we bind them by contract not to use your data for their own purposes. In certain situations, these partners may also act as separate, independent controllers in respect of the personal data needed to provide the service.
• In special exceptional situations, Atria may be required to disclose personal data to third parties where applicable law or regulation, or another authority's order, so requires.
• Atria may also disclose personal data in connection with a possible company acquisition or business transfer, where Atria or its business operations, or part thereof, are sold to the recipient of the data.
•  

5.             Do we transfer personal data outside the EU or EEA?

• We transfer personal data outside the EU or EEA where this is necessary to achieve the purposes of the processing of personal data or for the technical maintenance of the data. Where personal data is processed outside the EU or EEA, we ensure that the conditions for the transfer of data set out in the EU General Data Protection Regulation are met. In doing so, Atria ensures, among other things, that the data it collects is transferred only to third countries or parties whose level of data protection the European Commission has found to be adequate, or that the subcontractor has committed to the European Commission's standard contractual clauses for the processing of personal data, and, where necessary, has arranged for sufficient additional technical safeguards.
•  

6.             How do we protect the data?

• All personal data is protected in accordance with Atria's information security policy against unauthorised access and against accidental or unlawful processing of data.
• Information security is a process for safeguarding the confidentiality, integrity, and availability of information. At Atria, information security is managed in accordance with the group's information security policy. The information security policy applies to all information assets and related processes that Atria manages or processes.
• This applies to the processing of data relating to Atria and its personnel, as well as to its partners and customers. The information security of Atria's systems and processes is at a very high level, and they are protected against data breaches and denial-of-service attacks.
• Personal data is maintained on a secure server. Data is collected into databases that are protected by firewalls, passwords, and other technical means. These safeguards include, among other things, password protection, which allows access to the stored data only to Atria's employees and to Atria's partners whom Atria has expressly authorised for this purpose. The register is appropriately protected in accordance with industry standards and by means of technical and organisational security systems. Although Atria does its best to protect the data it collects, it cannot guarantee with absolute certainty that the data is secure while being processed, transmitted, or stored. Atria will announce on its website or through its other services any information security threats that compromise the security of your personal data. Atria may also temporarily close its website in order to protect your personal data.
• Atria's personnel are obliged to keep all personal data strictly confidential.
•  

7.             How long do we retain your data?

• We retain the personal data we process only for as long as is necessary to fulfil the purposes defined in this Privacy Notice. In addition, we may retain certain data for longer to the extent necessary to fulfil obligations imposed by law.
• For product complaints, we retain personal data for the period required by legislation (10 years), in order to fulfil the purposes described in this notice. The retention of the material is based on the accounting, tort liability, and product liability legislation. For other consumer feedback, the retention period for personal data is no more than 1 year.
• We regularly assess the necessity of retaining the data, taking into account applicable legislation. In addition, we take reasonable measures to ensure that no personal data that is incompatible with, outdated, or inaccurate in relation to the purposes of processing is retained on data subjects in the register. We rectify or destroy such data without delay.
•  

8.             What are your rights as a data subject?

• You have the right to request the rectification, completion, or erasure of inaccurate personal data concerning yourself from the register, if the data is inaccurate, unnecessary, incomplete, or outdated in relation to the purpose of processing the personal data. Atria also carries out the above measures on its own initiative. You also have the right, under certain conditions, to request restriction of processing, to object to the processing of personal data, or to request that your personal data be transferred to another system.
• To the extent that processing is based on your consent, you have the right to withdraw or change your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
• For reasons relating to your particular situation, you also have the right to object to processing activities directed at you where the basis for the processing of the data is a legitimate interest. In connection with your request, you must specify the particular situation on the basis of which you object to the processing. We may refuse to comply with a request to object only on grounds provided for by law.
• If you notice any deficiencies or unlawfulness in our processing of personal data, you have the right to lodge a complaint with the data protection authority at tietosuoja@om.fi
• The requests, objections, and withdrawals referred to above may be made by submitting them in writing, signed by you, to tietosuoja@atria.com. The request must include the data subject's name and contact details. To ensure data protection, you must, upon request, be able to prove your identity.
•  

9.             Changes to this Privacy Notice

• We may update this Privacy Notice from time to time, and we will announce any changes on this page. When we amend the notice, we also update the date on which the changes take effect. If the changes are material, we will also announce them on our websites.