Skip to contentRuokaboksi

Privacy policy

This Privacy Policy applies to the processing of personal data by Ruokaboksi Finland Oy ("Ruokaboksi") on the platform of the ruokaboksi.fi website. Ruokaboksi is committed to processing the personal data of persons registered on the platform and other visitors to its website in accordance with the applicable data protection legislation. This Privacy Policy will be amended and updated as the Ruokaboksi platform and related services are developed and legislation changes. Regular reference to this Privacy Policy and its updates is recommended.

"Ruokaboksi platform" means the platform provided by Ruokaboksi on the ruokaboksi.fi website. "Service" means Ruokaboksi's Ruokaboksi service, which consists of a weekly delivery of Ruokaboksi to the address provided by the Subscriber, including food items and recipes that enable the Subscriber to prepare meals. In this Privacy Policy, "User" means the person registered on the Ruokaboksi platform and "Subscriber" means the person who subscribes to the Service in accordance with the applicable Ruokaboksi subscription terms.

1. Controller and contact details

Name: Ruokaboksi Finland Oy
Business ID: 2836612-7
Postal address: Vilhonvuorenkatu 11 D 5, 00500 Helsinki, Finland
E-mail address: info@ruokaboksi.fi

This Privacy Policy applies only to the processing of personal data where Ruokaboksi is the controller.

2. Purpose and legal basis for the processing of personal data

Ruokaboksi processes personal data for the following purposes:

To provide the Ruokaboksi Platform and Service and to fulfil contractual obligations:

Ruokaboksi processes personal data in order to provide access to the Ruokaboksi platform and the Service in accordance with a contract between the data subject and Ruokaboksi. Ruokaboksi processes personal data in order to fulfil its contractual obligations towards the data subject, for example to deliver products to the Subscriber. The legal basis for the processing is the performance of the contract.

Customer communication and marketing

Ruokaboksi processes personal data for the purposes of user or customer communications in relation to the Ruokaboksi platform and the Service, and to notify changes to the Ruokaboksi platform and the Service. Personal data is also used for marketing purposes related to the Ruokaboksi Platform and Services. The legal basis for processing is legitimate interest. The processing of personal data on the basis of legitimate interest is necessary for the proper provision of the Ruokaboksi Platform and the Service and for the development of Ruokaboksi's business. The processing of personal data on the basis of legitimate interest takes into account in particular the interests and rights of the data subject in relation to the legitimate interest of Ruokaboksi to process personal data.

Direct electronic marketing

Ruokaboksi will not use personal data for direct marketing purposes without your prior consent (opt-in). If you give your consent to direct marketing, you have the right to withdraw your consent at any time and to prohibit Ruokaboksi from using your personal data for direct marketing purposes by contacting Ruokaboksi using the contact details provided above.

Ruokaboksi’s electronic direct marketing includes, but is not limited to, the following examples: email communication, text messaging, customer contact by telephone, and AI/robotic contact by telephone.

However, Ruokaboksi does not need to ask for your consent for electronic direct marketing if the data has been obtained on the basis of a previous customer relationship and in connection with a previous purchase transaction (soft opt-in). Data obtained on the basis of previous customer relationship will only be used for direct marketing of products or services belonging to the same product group and only for direct marketing by Ruokaboks. Even in such a situation, you have the right to withdraw your consent at any time and to prohibit Ruokaboksi from using your personal data for direct marketing purposes.

Development of the Ruokaboksi platform, improvement of the quality of the Service and analysis of their use

Ruokaboksi processes personal data to manage and maintain its customer relationships and to analyse its operations and customer behaviour in order to develop the Ruokaboksi platform and improve the quality of the Service. The legal basis for the processing is legitimate interest. The processing of personal data on the basis of legitimate interest is necessary for the proper provision of the Service and for the development of Ruokaboksi's business. The processing of personal data on the basis of legitimate interest takes into account in particular the interests and rights of the data subject in relation to the legitimate interest of Ruokaboksi to process personal data.

Fulfilling legal obligations

Ruokaboksi processes personal data in order to fulfil its legal obligations, which include the processing of data for the fulfilment of accounting obligations and, where necessary, the submission of personal data to the relevant authorities. The legal basis for the processing is a legal obligation.

3. Personal data to be collected

Data subject means an identified or identifiable natural person whose personal data are collected, held and processed by the controller. For the purposes of the processing of personal data under this Privacy Policy, the data subjects are the Users of the Ruokaboksi platform, the Subscribers of the Service, the participants of sweepstakes organized by Ruokaboksi who are not Users and Subscribers, and any other visitors to the ruokaboksi.fi website.

Ruokaboksi collects and processes the following personal data:

User data

User Data is the personal data that Ruokaboksi collects from those who register as Users of the Ruokaboksi.fi platform. When registering as a User of the Ruokaboksi platform, the following information is collected:

  • full name
  • telephone number
  • e-mail address
  • postal address

Subscriber information

Subscriber Data is personal data that is collected and processed by Ruokaboksi along with user data in order to provide the Service and ensure customer experience. The Subscriber Data are:

  • payment information (payment instrument number and expiry date). To process payments, Ruokaboksi uses an external payment service provider called Stripe, which acts as a data controller for the processing of payments. You can read Stripe's privacy policy here.
  • subscription history

Participant data for prize draws

If you are not a User of the Ruokaboksi Platform or a Subscriber to the Service, Ruokaboksi collects the following information for the purposes of conducting the sweepstakes it organizes, informing the winners and delivering the prizes:

  • name
  • telephone number
  • e-mail address
  • postal address

Other information

The food box also processes other data. Other data processed include:

  • marketing consents and prohibitions
  • other information you provide when registering or changing information you have previously provided
  • analytical information about the technical devices used to access the Ruokaboksi platform, such as IP address, operating system and browser used. In addition, analytics information is collected about the use of the Ruokaboksi platform, such as the sections of the Ruokaboksi platform visited and the times of visits. The analytics data is not used to identify individuals, but since in some cases it can be combined with other data to identify an individual, either directly or indirectly, it must be treated as personal data in such cases.
  • Posthog analytics and other analytics tools are used on the Ruokaboksi website to improve the website and services.

Cookies

The Ruokaboksi uses cookies set by the ruokaboksi.fi website as well as cookies set by third parties. Cookies are small text files that are stored on computers or devices to help websites perform a number of functions and enhance the user experience. For example, cookies can help track the number of people who visit a website and help us better understand how people use the website.

4. Regular data sources

The personal data we process is collected from you in connection with your registration on the Ruokaboksi Platform or your use of the Ruokaboksi Platform and/or the Service.

5 . Disclosure and transfer of data outside the EU/EEA

Personal data are processed within the organisation of Ruokaboksi by persons who are entitled to process personal data by reason of their position and for the performance of their duties.

Ruokaboksi may use external subcontractors for the provision and implementation of its services and for the processing of personal data. These subcontractors are personal data processors who process personal data on behalf of and in accordance with the instructions of Ruokaboks. In addition, Ruokaboksi ensures that personal data processed by subcontractors is processed in accordance with appropriate confidentiality and data processing agreements and applicable data protection legislation. Subcontractors include IT, marketing and communication service providers.

The Ruokaboksi platform uses external service providers who act as data controllers of the data related to their purposes. Below is a more detailed breakdown of these service providers.

  • Payment processing - Stripe - Privacy Policy
  • Content management of prescription data and prescription images - Sanity - Privacy Policy
  • Login management - Firebase - Privacy policy
  • Cloud services - Google Cloud Platform - Privacy policy
  • Customer data management for customer service and marketing - Custobar - Privacy policy
  • Users of the Ruokaboksi platform can opt out of having their browsing history transmitted to Custobar in the platform settings.

Personal data is primarily stored in the EU/EEA, but processors outside the EU/EEA may have access to personal data when providing their services to Custabar. In cases where such disclosure occurs, Ruokaboksi must ensure that the European Commission has taken a decision on the adequate level of protection of personal data in the country of destination, use standard contractual clauses or other equivalent arrangements approved by the European Commission and comply with other appropriate safeguards for the disclosure or transfer of personal data outside the EU/EEA.

6. Principles for the protection of personal data

Personal data is processed lawfully and collected for specified and explicit purposes. Personal data will not be processed in a way that would be incompatible with the purposes set out in this Privacy Policy. Ruokaboksi will process only adequate and relevant personal data and will limit the processing to what is necessary in relation to the purposes for which the personal data are processed.

The Ruokaboksi uses appropriate technical and organizational means designed to protect the personal data collected and processed.

7. Retention and deletion of personal data

Personal Data will not be kept for longer than is necessary to provide the Ruokaboksi Platform or the Service or any part thereof. The retention period of personal data is always determined by the nature of the personal data and the purpose of the processing. Personal data will be kept for as long as necessary to fulfil the purpose of the processing, after which the personal data will be deleted. Where necessary, the retention period may be extended in order to comply with legal obligations and requirements. Ruokaboksi has the right to delete the data if it becomes clear that you no longer use the Ruokaboksi Platform or the Service.

8. Rights of data subjects

You have the right to be informed whether your personal data is being processed and, if it is, you have the right to access your data. You also have the right to request the rectification or erasure of your data or the restriction of processing in accordance with applicable data protection legislation.

The Canteen will endeavour to comply with your request without undue delay if the personal data you have provided are inaccurate, unnecessary, insufficient or out of date for the purposes of the processing. Requests to exercise your rights should be sent to the address indicated in this Privacy Policy by means of a personally signed or similarly authenticated document.

You have the right to object to the processing of personal data by Ruokaboksi for direct marketing purposes.

If you choose not to provide personal data or object to the processing of personal data, Ruokaboksi may not be able to enter into a contract or perform its contractual obligations with you or to enable you to benefit from all the functions and features of the Ruokaboksi Platform and/or the Service.

If Ruokaboksi processes personal data for a purpose other than that for which the personal data was collected, Ruokaboksi will provide you with information about the purpose in question and any other relevant additional information prior to the processing.

You have the right to lodge a complaint with a supervisory authority about the processing of your personal data if you consider the processing operations to be in breach of the applicable data protection legislation. In Finland, the supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi).