This is Venus Ceramics Ltd.'s data protection information document in accordance with the EU General Data Protection Regulation (EU 679/2016 Articles 12-22, 30 and 34).
Prepared on 19.5.2026. Last modified on 19.5.2026.

1. Data controller
Venus Ceramics Ltd (3599569-3), Asemakatu 16 lh 1, 90100 Oulu
studio@venuksenkeramiikka.fi

2. Contact person(s) responsible for the register
Siru-Säde Liljeqvist, studio@venuksenkeramiikka.fi, 0505553764.

3. Name of the register
Venus Ceramics Ltd's Gymcontrol electronic online store and customer management system.

4. Legal basis and purpose of processing personal data
Gymcontrol is an electronic working environment used to provide and organize services.

Personal data is used:
1. To identify the user

2. To manage access rights

3. To transmit information targeted to the user

The data is not used for automated decision-making or profiling.

5. Data content
1. Personal data
2. Contact information
3. Obtained passports

6. Regular data sources
The data stored in the register is obtained from the users.

7. Regular data transfers and data transfers outside the EU or EEA
The data is not regularly transferred to other parties.

8. Principles of data protection
The register is handled with care and the data processed using information systems is protected appropriately. When register data is stored on Internet servers, the physical and digital security of their equipment is appropriately taken care of. The registrar ensures that the stored data, as well as the access rights to the Gymcontrol service and other information critical to the security of personal data, are handled confidentially and only by employees whose job description requires it.

9. Right to inspect and right to demand correction of information
Every person in the register has the right to check their data stored in the register and to demand correction of any incorrect information or completion of incomplete information. If a person wishes to check the data stored about them or to request a correction, the request must be sent in writing to the controller (or another procedure specified by the controller. The controller may, if necessary, ask the requester to prove their identity. The controller will respond to the customer within the time period set out in the EU Data Protection Regulation (generally within one month).

10. Other rights related to the processing of personal data
A person in the register has the right to request that personal data concerning them be deleted from the register ("right to be forgotten"). Data subjects also have other rights under the EU General Data Protection Regulation, such as the restriction of the processing of personal data in certain situations. Requests must be sent in writing to the controller. The controller may, if necessary, ask the requester to prove their identity. The controller will respond to the customer within the time period set out in the EU Data Protection Regulation (generally within one month).