To front page
To front page

S Group's co-op member and customer register

The controller of S Group’s co-op member and customer register is SOK Corporation.

Introduction to the Privacy Notice

1. The personal data processed

  • We process your personal data if your belong to any of the following customer groups:
    • Co-op members: persons who are or have been members of a cooperative
    • Members of a co-op member household: persons who belong to or have belonged to a co-op member household but are not necessarily members of the cooperative themselves.
    • Other customers: persons who are not co-op members or part of a co-op member household but have subscribed to some of the services provided based on S Group’s co-op member and customer register, such as the S User Account or an electronic newsletter, or who have performed transactions in the online store.
    You can see which personal data we process by customer group in the table below. After the table, there is a more detailed breakdown of the personal data.

Processed personal data categorized by customer group

  • Processed personal data categorized by customer group

    Co-op member Member of a co-op member householdOther customer
    Basic data xxx
    Contact us xxx
    Gender xx
    Employee information xx
    Cooperatives’ membership information x
    Invoicing Bonus partners xx
    Information about the co-op member household xx
    Deposit account for benefits payable in cash x
    S-Etukortti card xx
    Credentials xxx
    Customer groups xxx
    Customer categorisation and profiling information xxx
    Subscriptions, services used and data concerning the use of services xxx
    Authorisations and prohibitions, i.e., your consents and objections to personal data processing xxx
    Data on paid benefits and received discounts xxx
    Detailed purchase data xxx
    Customer’s digital footprint xxx
    Information regarding customer belonging to a target group xxx
    Online shopping information xxx
    Information about the Raflaamo service xxx
    Hotel reservations xxx
    Terminal device location data, if you have permitted the processing of location data in online or mobile services xxx
    Customer feedback xxx
    Information about product reviews xxx
    Survey responses based on consent xxx

  • Detailed breakdown of the personal data

    Information used for the provision of co-op member benefits:
    • basic information
    • contact information
    • cooperative’s membership information
    • co-op member household information
    • deposit account for benefits payable in cash
    • S-Etukortti card
    • invoicing Bonus partners
    • data on paid benefits and received discounts
    Basic information:
    • first and last name, social security code, date of birth, language
    • non-disclosure for personal safety reasons and expiration date of the non-disclosure
    • starting date and validity period of customer relationship
    • information of prohibitions and updates from the Population Information System and service providers
    Contact information:
    • permanent postal address, temporary postal address, domicile, mobile phone, other phone number, email
    • product safety email address, if provided
    Gender information:
    • Information about the customer’s gender as indicated by the customer themselves, or information that the customer has not indicated their gender
    Employee information:
    • information about S Group employee discount entitlement
    Cooperatives’ membership information:
    • membership cooperative, member identification number, member status, starting and ending date of membership, place of affiliation
    • status of co-op contribution, paid co-op contribution, date of completing co-op contribution and payment transactions
    • information on interest paid on the contribution, information on the return of the surplus paid
    Invoicing Bonus partners:
    • registrations at Bonus partner companies, validity periods
    Information about the co-op member household:
    • main member of the co-op member household, persons belonging to the same co-op member household as the main member
    Deposit account for benefits payable in cash:
    • account number, validity period and account type for the payment account for benefits
    S-Etukortti cards, S-Bank Private Visa cards:
    • card number, card type, validity period, reason for cancellation
    • information on to which co-op member household the Bonus purchases are connected
    • information on the membership of which cooperative the card subscription is based
    • information on a card being added to Apple Wallet
    User identification:
    • S User Account, customer code
    Customer groups:
    • customer groupings of the customer (such as groupings connected to the use of digital services, main Sokos store and customer class, grocery store and ABC store segment)
    • information about the customer’s participation in support groups of associations or other groups
    • Information about whether the customer is eligible for the membership fee benefit
    Customer categorisation and profiling information:
    • categories and profiles linked to the customer
    • student status
    Subscriptions, services in use and information concerning the use of services:
    • information on services subscribed to / in use (e.g. S User Account, S-mobiili, ABC-mobiili)
    • information entered by the customer, data produced by the use of services
    • car registration number provided by the customer, if the customer has ordered a monthly wash in the ABC-mobiili application
    • information of the data controller’s communication with the customer aimed at maintaining the customer relationship
    Authorisations and prohibitions, i.e., your consents and objections to personal data processing:
    • email marketing permit, mobile device marketing permit (mobile phones)
    • permission to target advertising in channels outside S Group and S Bank (Google, Meta, others)
    • authorisations and prohibitions, such as notification permits, administered in S-mobiili and ABC-mobiili mobile apps.
    • cookie choices
    • direct marketing ban, phone marketing ban, Puhelin-Robinson phone ban, Posti-Robinson mail ban, prohibition of surveys
    • prohibition on separate direct mail, prohibition to send notifications
    • prohibition of processing product-level purchase data, prohibition of analytics and customer grouping
    Data on paid benefits and data on received discounts:
    • number of the S-Etukortti card used for purchases entitling one to co-op member benefits or the member/customer number, date of purchase, time, place of purchase, manner in which the card was used, purchase data in the receipt sum level
    • paid Bonus, Tankkausbonus refuelling bonus and payment method benefits
    • co-op price benefits received, personnel discounts received
    • online warranty receipts and online receipts
    Detailed purchase data:
    • information about purchases at the product level
    Customer’s digital footprint:
    • website user data and mobile service user data
    • information of the identified use of digital services (e.g., online and mobile services)
    Information regarding customer belonging to a target group:
    • information regarding customer belonging to a target group for electronic direct marketing messages or mobile services
    Online shopping information:
    • data concerning shopping carts, as well as order and delivery information such as order numbers, payment information, delivery methods and destinations; however, more detailed additional information about deliveries from online grocery stores, such as door codes or instructions on arrival, is only available in the order and delivery register of the co-operative that delivers the order
    • coordinates for the delivery address
    • information provided by the user about their preferences
    • delivery addresses saved in the service
    • products marked as favourites by the customer
    • contact history and phone call recordings concerning online store service, orders and deliveries
    Information about the Raflaamo service:
    • table reservations
    • orders for pickup
    • provided information about preferences, such as favourite restaurant
    Information about the Raflaamo service is stored in the S Group register of co-op members and customers only if the user has logged into the service with a S user account. Hotel reservations:
    • information about room reservations in S Group hotels
    Terminal device location data:
    • Terminal device location data, if you have permitted the processing of location data in online or mobile services. Location data is not stored in any register.
    Customer feedback:
    • feedback provided on a feedback form and the feedback functionality in the S-mobiili app.
    Information about product reviews:
    • information about product reviews in S Group online stores
    Survey responses based on consent:
    • responses given in a survey when the respondent has given their explicit consent to the processing of responses as personal data

2. Bases for the processing of personal data, purposes of use and storage periods

  • 2.1. Basis for processing S Group’s co-op member scheme requires us to process the personal data of co-op members and other people belonging to co-op member households. Personal data is required for purposes such as the provision of services and benefits in the co-op member scheme, managing customer relationships and maintaining the membership lists of cooperatives. Customer data allows us to also offer S Group’s customers relevant services and benefits that meet their individual needs as closely as possible, as well as produce targeted and personalised content and advertising. 2.2. Storage periodSome of our services, such as S User Accounts and online stores, can also be used without co-op membership or belonging to a co-op member household. The data of such customers is processed for purposes such as the provision of the online store service or other digital service used by the customer, processing customer feedback and other management of customer relationships. We also utilise customer data in the planning and development of S Group’s business operations. For this purpose, we may use personal data for purposes such as analysis and profiling, or to carry out surveys or market studies. We may also process personal data for marketing purposes of our partners and organisations that belong to S Group at any given time. The term “S Group” refers to the cooperatives and the SOK Group together with its subsidiaries and associated companies. The term “partner”, meanwhile, refers to companies that grant Bonus and/or benefits to co-op members, for example, and companies that cooperate with S Group, implement joint marketing or buy media visibility from S Group. The storage periods of data vary based on the purpose for their use. The storage of an individual data item in the register lasts until the end of the longest storage period set for said data item, but the data may be used for each purpose only for the time indicated in the table below. Certain data related to the management of customer relationships are stored for the entire duration of the co-op membership or membership in a co-op member household. Meanwhile, detailed purchase data is stored for a maximum period consisting of the year of the purchase and the ten years following it. Personal data is generally erased within six months of the termination of a customer relationship. However, we store some data for a longer period of time. This includes data related to membership in a cooperative and data related to the payment of membership fees. This information is stored for a period consisting of the year of the monetary transaction and six years following it. A customer relationship may end due to resignation or termination, or when the customer leaves a co-op member household. Data related to the S User Account is deleted when the customer relationship ends. S User Account customer relationship is considered to end when the customer requests the account to be deleted. 2.3. Purpose of use The tables below provide more detailed information regarding what purposes the personal data in the register are used for, and how long the data is stored.

Basis for processing

  • Contract

    When joining as a co-op member or joining a co-op member household, you must accept the rules of the co-op membership scheme. Co-op members must also accept the bylaws of the co-op when joining. Customers using our digital services must accept the terms and conditions of the services, such as the S User Account, Kerää ja skannaa service or online stores. The provision of the co-op membership scheme and digital services requires us to process our customers’ personal data for the purposes indicated below.
    Purpose of useData processedProcessing period
    Member administration of the cooperative - Basic data - Contact information - Cooperatives’ membership information - Deposit account for benefits payable in cash End of the calendar year during which the co-op membership was terminated + 6 years
    Organisation of elections - Basic data - Contact information - Cooperatives’ membership information - Permissions and prohibitions Throughout the validity of the membership
    Information on interest paid on the membership fee, information on the return of the surplus paid - Basic data - Cooperatives’ membership information - Deposit account for benefits payable in cash End of the calendar year of the last payment transaction after the co-op membership was terminated + 6 years
    Calculation and payment of co-op member benefits such as Bonus, payment method-related benefit and Refuelling Bonus - Information used for the provision of co-op member benefits - Purchase data 5 years
    Provision of services and benefits (such as S-mobiili, ABC-mobiili, S User Account, Raflaamo, online stores) - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Detailed purchase data - Subscriptions, services used and data concerning the use of services - Information about the Raflaamo service - Permissions and prohibitions - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data Throughout the customer relationship + 6 years after the termination of the customer relationship. For S User Account agreements, throughout the validity of the agreement. Detailed purchase data: year of the purchase + 10 years
    Co-op member and customer communication - Basic data - Contact information - Purchase data Throughout the customer relationship + 6 years after the termination of the customer relationship. For S User Account agreements, throughout the validity of the agreement.
    Targeted advertising, mail - Basic data - Contact information Validity of the co-op membership agreement + 6 months after the termination of the agreement
    Maintenance of user data for digital services - S User Account data - Basic data - Contact information (confirmations) - Permissions and prohibitions - Customer’s digital footprint Throughout the validity of the S User Account agreement
    Defence against legal claims - Data required to defend against claims The data is stored until the matter has been settled
    Provision of the Kerää ja skannaa service using a handheld scanner and the S-ostoslista shopping list app - First name - S-Etukortti card’s technical identifier - Detailed purchase data - Level of trust - Information about rescannings - Scan history 2 years

    Consent

    Consent is a key basis for processing that offers you the opportunity to tell us that you want your personal data to be processed for a specific purpose. We separately request consent for each of the purposes of use listed below. Providing consent always requires you to take action, such as checking a box regarding providing consent. You can cancel consent regarding the processing of your personal data at any time.
    Purpose of use Data processed Processing period
    Direct marketing using electronic means (e-mail or SMS, for example) - Information regarding customer belonging to a target group - Contact information - Permissions and prohibitions 2 years from the expiry of consent
    Targeting of advertising in channels outside S Group and S-Bank- Information regarding customer belonging to a target group - Contact information - Permissions and prohibitions2 years from the expiry of consent
    Sending notifications regarding mobile services - Information regarding customer belonging to a target group - Permissions and prohibitions - Subscriptions, services used and data concerning the use of services 2 years from the expiry of consent
    Targeting marketing and advertising on the basis of mobile device IDs - Permissions and prohibitions - Subscriptions, services used and data concerning the use of services - Customer’s digital footprint 2 years from the expiry of consent
    Management of a customer relationship - Basic data - S User Account - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data Throughout the customer relationship + 6 years after the termination of the customer relationship. For S User Account agreements, throughout the validity of the agreement. Detailed purchase data: year of the purchase + 10 years.
    Disclosing data for partners, for example, to get Bonus or other co-op member benefits - Basic data - Cooperatives’ membership information - Personnel and discount entitlement data - Permissions and prohibitions Throughout the validity of the co-op membership agreement
    Disclosing data to third parties outside S Group or for external purposes, such as scientific research - Basic data - Cooperatives’ membership information - Personnel and discount entitlement data - Detailed purchase data Throughout the customer relationship + 6 years after the termination of the customer relationship. Detailed purchase data: year of the purchase + 10 years
    Processing of digital footprint data based on cookie choices - Customer’s digital footprint Two years. However, no longer than the validity period of the S User Account agreement.
    Combining responses provided to studies and surveys with the customer’s data - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Detailed purchase data 2 years
    Provision of features based on location data in online and mobile services, such as store locator functionality and mobile scanning- Terminal device location data, if you have permitted the processing of location data in online or mobile servicesLocation data will not be saved.
    Maintenance of student status - Email address of university Throughout the validity of the student status. The university email address provided by the customer is immediately deleted as soon as the student status has been confirmed.

    Legitimate interest

    We process personal data on the basis of legitimate interest, for example, to develop the S Group's business and product range, conduct research, target advertising, and calculate customer profiles. We have assessed the legitimate interest on the basis that S Group’s operations are cooperative in nature and S Group is owned by its co-op members. Co-op membership of S Group is optional and the membership scheme is open to anyone. The purpose of S Group's operations is to provide customer-oriented, meaningful and cost-effective services and benefits to co-op members, and thus promote financial wellbeing of co-op members. The analysing of purchasing behaviour and the calculation of customer profiles, as well as related direct marketing and content targeting, opinion polls and market surveys are key ways to achieve this goal. We ensure that the processing based on a legitimate interest is correctly proportioned to your interests and in compliance with your reasonable expectations. When analysing customer data, for example to calculate customer groupings and profiles and to target advertising, we analyse large data sets and view our customers as large groups. The analysis never focuses on the data of individual customers. We use customer data stored in our register, such as basic customer information, purchase data, and digital footprints collected from online stores, mobile applications, and other digital services, to calculate customer groupings and customer profiles. The calculation is based on various calculation methods and logics, which may be based on simple rules or more complex mathematical models. We use customer grouping to predict our customers' needs, purchasing behavior, or characteristics related to their stage of life so that we can offer each customer group the content and services they need, improve our service selection, and reduce waste. You can check your own customer groupings in your S-user account.We also personalise our services to ensure the best possible customer experience. We may use the AI to personalise our services and to analyse customer feedback. Search results in services such as online stores or self-service machines may be based on recommendations provided by an AI model. The AI model analyses your purchase history and provides search results in the online store for products that, based on this analysis, you are likely to be searching for. With the help of AI, the search results become more relevant to you, enabling you to collect the right products into your shopping cart more quickly.You have the right to object to the processing of your personal data based on legitimate interests by setting various prohibitions on your data. For example, you can prohibit the processing of detailed purchase information, analytics and customer profiling, or opinion polls and market surveys. If, for example, you do not want AI-based search results, other personalized content, or targeted advertising, you can set a prohibition on analytics and customer grouping. With this prohibition, we will also not use your data for the development of the S Group's business. You can manage your data and restrict their use in S-mobiili’s “Me” section or by signing in to your S User Account in any of S Group’s online services or by contacting customer service.
    Purpose of use Data processed Processing period
    S Group’s customer-oriented planning and development of business operations - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - S-Etukortti cards - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Gender information - Customer categorisation and profiling information Year of entry + 10 years
    Conducting surveys and market research. Depending on the survey, the answers provided can be linked to customer data. - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Gender information - Customer categorisation and profiling information 2 years
    Forming customer categories and profiles for developing business operations, and for conducting and targeting advertising and marketing - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - S-Etukortti cards - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Gender information - Hotel reservationsYear of entry + 10 years
    Implementation of an electronic receipt archive - Image of the receipt Electronic cash receipt: 10 years from the purchase transaction Warranty receipt: 10 years from the purchase transaction or upon request by the customer
    Production of the My purchases function- Detailed purchase dataYear of entry + 10 years
    Processing of customer feedback - Basic data - Contact information - Content of feedback or review 2 years
    Direct marketing by telephone - Basic data - Permissions and prohibitions Year of entry + 7 years
    Targeting and personalisation of content in digital channels. We may also use AI to personalise content. - Basic data - Permissions and prohibitions - Detailed purchase data - Gender information - Customer categorisation and profiling data - Customer’s digital footprint Year of entry + 10 years
    Conducting and targeting marketing in S Group’s digital channels - Basic data - Permissions and prohibitions - Detailed purchase data - Customer groups - Gender information - Customer categorisation and profiling data - Customer’s digital footprint - Hotel reservationsYear of entry + 10 years
    Provision of marketing services to S Group’s partners - Basic data - Permissions and prohibitions - Detailed purchase data - Gender information - Customer categorisation and profiling data - Customer’s digital footprint Year of entry + 10 years
    Realisation of prize draws based on customer relationship or the use of S-Etukortti card- Basic data - Contact information - Customer categorisation and profiling data 6 months
    Profiling and inspections made in the Kerää ja skannaa service (including mobile service)- First name - S-Etukortti card - Scanned products - Level of trust - Information about rescannings - scan history2 years
    Identification and investigation of suspected misconduct, and monitoring of compliance with S Group’s membership scheme - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data 2 years
    Provision of customer service and quality assurance - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Online store phone call recordings 2 years
    Provision of personnel discounts - Basic data - Contact information - Personnel and discount entitlement data - Co-op member household information Throughout the S Group employee’s employment relationship, and two years after its termination
    Handling of product requests - Form data provided by customer - Telephone number 30 days
    Processing of product reviews and publication in S Group online stores - Information about product reviews - Online shopping information - S User Account 10 years
    Defending against legal claims - Data required to defend against claims The data is stored until the matter has been settled
    Monitoring and collection of receivables - Basic data - Contact information - Online shopping information Throughout the collection process

    Statutory obligation

    Compliance with our statutory obligations requires the processing of your personal data for the purposes indicated below.
    Purpose of use Data processed Processing period
    Member administration of the cooperative - Basic data - Contact information - Cooperatives’ membership information - Deposit account for benefits payable in cash - Customer groups End of the calendar year of the last payment transaction after the co-op membership was terminated + 6 years
    Submitting the necessary information to the Tax Administration in accordance with fiscal legislation. - Basic data - Cooperatives’ membership information End of the calendar year of the last payment transaction after the co-op membership was terminated + 6 years
    Statutory information requests by authorities, and responses to such requests - All information related to statutory requests by authorities 2 years
    Maintaining information about non-disclosures for personal safety reasons- Non-disclosure for personal safety reasons and expiration date of the non-disclosure Expiration date of the non-disclosure
    Product recalls and other communications related to product safety- Basic data - Contact information - Detailed purchase dataYear of entry + 10 years
    Provision and storage of accounting - Membership fee and other data recorded in accounting Until the end of the calendar year + 6 years

3. Rights of the data subject

  • You have the following rights:
    • Right to access your data
    • Right to rectification of your data
    • Right to erasure of your data (for example, when the processing is based on consent or there is no basis for retaining the data)
    • Right to restrict processing (denying the authenticity of data or illegitimate processing)
    • The right to object to the use of your personal data in direct marketing or other processing based on a legitimate interest
    • Right to withdraw your consent
    • Right to transfer data to another system (in case of automatic processing)

Rights

  • Get to know your data

    To see the data about you stored in S Group’s co-op member and customer register, log in to your S User Account at https://s-kayttajatili.fi/en. If you do not have an S User Account, or if you wish to review data related to the Collect and Scan service, the S-Ostoslista shopping list app, online store customer service chat conversations and call recordings, or responses to research surveys, you can submit a registry extract request at rekisteriotepyynto.s-kanava.fi. Strong authentication is required to complete the form.You can also update your personal data through your S User Account, the S-mobiili app, the co-op member service (found at almost all Prisma and Sokos stores), by sending a message through our feedback form (select co-op membership, the S-Etukortti card and Bonus as the subject), or by calling S Group’s co-op member service, tel. +358 10 76 5858. We will receive information about any address and name changes directly from the Population Information System if you have submitted a notification of the change there and you have not submitted a prohibition on the updating of customer register data or any other prohibition preventing the update in the Population Information System.

  • Manage the processing of your data

    You can control how S Group processes your information by giving and withdrawing permissions and by activating prohibitions through your S User Account and the S-mobiili app. You can find permissions and prohibitions related to the processing of personal information in your S user account (https://s-kayttajatili.fi/en) and under the communication and privacy settings in the S-mobiili application. You can, for example prohibit the forming of an electronic receipt archive, analyses and customer groupings or processing of your exact purchase information. If you prohibit the processing of your exact purchase information, we will not process your purchase information in any more detail than the final sum of the Bonus you earn. This prevents the production of the My Purchases service in the S User Account and the S-mobiili app, for example, as well as the targeting of marketing and the personalization of content based on your purchase information.We only use your data for online direct marketing and targeting in S Group’s external channels if you have given us your permission to do so. If you want to receive online direct marketing, you can choose the channels through which you want to receive it. For example, if you want to receive S Group benefits and tips in your email but not on your mobile device, you can make the corresponding selections in the communication preferences of your S User Account and the S-mobiili app. If you want the S Group advertisements you see on social media and elsewhere outside S Group’s channels to be as interesting as possible for you, you can give your permission to target advertising in S Group’s external channels in the communication preferences. If you wish, you can also prohibit traditional addressed direct mail and telemarketing in the communication preferences. If you want to receive marketing but want to choose the channels used for it, you can allow us to send marketing messages by email and mobile device, for example, or prohibit traditional addressed direct mail, telephone marketing or targeting in channels other than S Group’s own channels. You can also prohibit polls and market surveys if you do not wish to receive any research surveys from us. In addition to your S User Account and S-mobiili communication settings, you can withdraw your consent to email marketing through a link in the email you received.You can also give and withdraw permissions concerning your personal data and set up prohibitions by contacting our customer service. To exercise your rights or to get more information on how your personal data is processed, you can also contact the data controller by sending an email to tietosuoja.asiakkuus@sok.fi. You also have the right to file a complaint with a supervisory authority if you are of the opinion that we are in breach of the applicable data protection legislation when we process your personal data.

4. Data sources

  • We obtain data from the agreement you sign when you join S Group’s co-op membership scheme, and from you personally during the customer relationship by phone, websites, email or other similar methods or based on your use of services. Updates of name, address and mobile phone data, as well as information about death, can also be received from authorities or companies providing updating services. Information on Robinson marketing prohibitions for telemarketing/direct marketing by post comes from Suomen Asiakkuusmarkkinointiliitto ry. Information of employment in the S Group and information of the right to receive the personnel discount come from S Group’s employee registers. We obtain data on your use of the S-Etukortti card and any transactions you perform when identified online from those organisations that belong to S Group's co-op member scheme and from partners that grant the S Group Bonus. In addition, we might obtain information from organisations belonging to S Group and partners belonging to the co-op membership scheme that utilise the S-Etukortti card or other credentials to verify your identity in their services. We receive information about reservations at S Group hotels from the customer register for the S Group travel and hospitality services. Information about reservation can, for example, be used for targeting marketing of S Group services near the hotel that might interest you. You can prohibit the use of reservation information in the S Group co-op member and customer register by prohibiting analyses and customer grouping under your information in the S-mobiili application or by logging into your S user account in any S Group online service. We obtain limited personal data also on SOK and S-Bank’s shared customers from our joint register. For more information, see section 10 of this notice.

5. Recipients of personal data

  • We disclose information to the Tax Administration about any interest paid to co-op members on their co-op contribution and return on capital paid to resigned members. We can also disclose information within the limits allowed and required by valid legislation, such as when answering authorities’ requests for information. We disclose information about your online groceries purchases to a co-operative in order for them to deliver your order. We may also disclose your contact details and personal identity code to the co-operative if the information is necessary for the billing or collection of an unpaid online store order.We may also disclose customer contact details and information about S-Etukortti cards to the co-operative for customer service purposes, as well as to identify, investigate and deal with suspected abuse of the co-operative’s rules, the rules of the membership scheme, or the rules of the staff discount scheme and related suspected criminal offences.We disclose the delivery information of your order to Posti or other similar operators such as PostNord to deliver products you have purchased. The disclosure of the information is based on the agreement concluded as part of the product purchase. With your consent, we disclose information about your co-op membership to a partner that grants S Group Bonus.If you have given your consent to the targeting of advertising in channels outside S Group and S Bank, we may disclose a pseudonymised, i.e. encrypted, customer identifier to media partners for targeting advertising. Where applicable, we serve as a joint controller with the media partner. You can find more information about the processing of personal data for targeted advertising in external channels at Targeting advertising in S Group and S Bank’s external channels.With your consent, we may disclose your data to third parties outside S Group or for external purposes, such as scientific research. Your personal data associated with customer feedback is received by S Group’s internal customer service teams, as well as product specialists participating in the processing of your feedback. Your demographic data and data about you belonging to a customer group can also be processed with other data in SOK’s customer registers in order to develop business operations in analytics and reporting for each customer group. This data can also be used for improving the quality of customer service and targeting marketing, for example when you book a room in one of S Group's Sokos Hotels.In some situations, we use subcontractors, who process customer information by our orders and on our behalf. The subcontractors we use carry out services on our behalf, such as IT services, IT system maintenance services, customer communications, marketing and customer research campaigns, payment services and delivery services for our online stores. The subcontractors are granted access to such customer information that they need to produce the agreed services for us. When it comes to providers of payment services for online stores, the necessary information may also include the cardholder’s name and contact details. Payment service providers may also process this data for their own purposes, such as complying with their legal obligations.We disclose limited personal data also on SOK and S-Bank’s shared customers to our joint register. For more information, see section 10 of this notice.

6. Transfer of personal data to third countries or international organisations and data protection safeguards used

  • We use subcontractors to process personal data and the data is transferred in a limited way outside the European Union (EU) or the European Economic Area (EEA) for the purposes of service provision, technical administration and support. We can perform these types of transfers if the European Commission has decided that the target country or organisation has a sufficient level of data protection or we can otherwise ensure a sufficient level of protection of the personal data in accordance with applicable legislation, such as by using standard contractual clauses approved by the European Commission. You can read more about the standard contractual clauses approved by the European Commission here. We require our subcontractors to agree to follow the data protection and information security requirements of legislation and SOK.

7. Impact of the processing of personal data and a general description of technical and organisational security measures

  • We diligently protect your personal data by employing the appropriate data protection and information security measures. Our system providers process your personal data at secure server facilities. Access to personal data is restricted, and the personnel are subject to a confidentiality obligation. S Group protects your personal data by means of, for example, preventive risk management and security planning, protection measures for data communications, and by using secure hardware facilities, access control and security systems. After initial processing, hard copies containing personal data are stored in locked and fire-safe storage facilities. The granting and monitoring of user rights is a well-managed process. We regularly provide training for our personnel who participate in the processing of personal data, and ensure that our partners’ personnel also understand the confidential nature of personal data and the importance of secure processing. We select our subcontractors with care. We continuously update our internal practices and guidelines. If, despite all of our safeguards, your personal data ends up the wrong hands, we will immediately begin investigating the incident and aim to prevent any damage caused. We will inform the relevant authorities and you of the data security breach in accordance with legislative requirements.

8. Effects of not providing personal data on an agreement

  • In order to become a co-op member and to join the S Group co-op member scheme, the customer must provide the necessary information so that the agreement can be concluded (name, address, social security code given by the Finnish civil registrant). If the necessary personal data is not provided, the agreement cannot be concluded. In order to become a member of a co-op member household and to join the S Group co-op member scheme, the customer must provide the necessary information so that the agreement can be concluded (name, address, social security code given by the Finnish civil registrant or date of birth). Providing the information required for concluding the relevant service agreement is a prerequisite for the provision of the services based on the register data. The information required for concluding a service agreement varies depending on the service.

9. Significant information related to automated decision-making or profiling

  • We do not perform automatic profiling or automatic decision-making on the basis of the data in the register that would result in legal effects concerning you. If you are using theKerää ja skannaa service, automatic decision-making is performed in the service on the basis of the use of the service and the scanner. The results of such analyses may lead to you being directed to have your products verified at the cash counter.

10. Data protection concerning the joint data register and controller role for shared customer data of SOK and S-Bank

  • 10.1. Purpose and data subjects of the joint register Suomen Osuuskauppojen Keskuskunta (SOK) as a data controller and S-Bank Plc as a data controller are the joint controllers of data described in this section 12 of the notice. In this description, we will define the data subjects and what kind of information is processed in the register. We will also explain how the roles of joint data controllers have been determined in relation to the data subjects. This section supplements the privacy policies of the SOK and S-Bank customer registers. Natural persons covered by the joint register:
    • Customers with a co-op membership and S-Bank membership that are active simultaneously.
    • Customers who have become a co-op member in the “Become a co-op member” online service.
    • Customers added to the co-op member household in the Child’s Banking service.
    • Customers who have an agreement on the deployment of S-mobiili.
    S Group and S-Bank have a shared task of providing their customers with benefits and services. The purpose of the joint register is to enable the production and development of these benefits and services so that you as a data subject can get the most out of both your shopping and banking memberships. With the joint register, we can also develop S Group’s and S-Bank’s shared mobile app (S-mobiili) and provide an even better service. We also use the joint register to ensure that you can maintain your customer information as easily as possible and manage consent matters included in the joint register. As the data controller, we will use the data included in the joint register for the shared purposes described below. The data will also be used for purposes determined separately in the privacy policies of S Group’s co-op member and customer register and S-Bank’s customer register. These are the shared data that S-Bank and SOK process for joint purposes.

Data areas included in the joint register

  • 10.2. Data areas included in the joint register

    Data Purpose of use Storage period in the joint register *) Legal basis
    Basic personal data (name, social security number, date of birth, language, date of death) Maintaining and updating data for the provision of co-op member and employee benefits. For as long as the customer is included in the joint register, as described in section 1. Contract
    Contact information (permanent and temporary postal address, mobile phone number, other phone number, email address) Maintaining and updating data for the provision of co-op member and employee benefits. For as long as the customer is included in the joint register. Agreement
    Information about becoming a customer in the digital channel (Become a co-op member online service)Providing the Become a co-op member online service.6 months from becoming a co-op member.Agreement
    Information about becoming a customer via a digital channel in the Child’s Banking serviceEnabling the addition of a minor to the co-op member household as part of the service for opening S-Bank’s services and products 6 months from using the serviceAgreement
    Information about the joining benefit offered by S-Bank Reporting and generating mutual interest.As long as the customer is in the joint register. However, up to 18 months from joiningLegitimate interest
    Employee information (information on belonging to the personnel, information of right to employee discounts) Maintaining and updating data for the provision of employee benefits. For as long as the customer is included in the joint register. Legitimate interest
    Co-op member household which the customer belongs to, information about the customer's role in the co-op member household, validity period of the co-op member household, member/customer number) Maintaining and updating data for the provision of co-op member and employee benefits. Maintaining and updating data in order to improve customer experience and develop our businessFor as long as the customer is included in the joint register. Agreement Legitimate interest
    Deposit account for benefits payable in cash (valid account number for the payment of benefits) Maintaining and updating data for the provision of co-op member and employee benefits. For as long as the customer is included in the joint register. Agreement
    S-Etukortti Visa (card type, card validity, information on which cooperative’s membership was used to order the card) Creation of an S-Etukortti Visa card with the customer’s details. Managing settlements on matters related to the production of co-op member benefits. For as long as the customer is included in the joint register. Agreement
    Consent and prohibitions (direct marketing prohibition, email marketing permission, mobile marketing permission, permission to target in third-party channels (Google, Meta, others), telemarketing prohibition, survey prohibition, prohibition information of the Robinson prohibition service offered by Suomen Asiakkuusmarkkinointiliitto ry, advertising mail prohibition, customer communication prohibition, and non-disclosure for personal safety reasons) Maintaining and updating data. For as long as the customer is included in the joint register. Legitimate interest
    Information on the activation of the S-mobiili app Provision of the S-mobiili service. Throughout the validity period of the S-mobiili agreement. Agreement
    Advertising identifier obtained from the mobile device to identify it Maintaining and updating information. For as long as the consent is valid. Consent
    Consents concerning S-mobiili (use of location data, reception of notifications and for the collection of digital footprint data) Maintaining and updating information. Targeting marketing, content and announcements. Improving the customer experience and business. For as long as the consent is valid. However, no longer than the validity period of the S-mobiili agreement. Legitimate interest
    Customer feedback on S-mobiili given in S-mobiili Development of the S-mobiili mobile app and replying to feedback. Two years. Legitimate interest
    S-mobiili’s digital footprint (processing in the joint register and disclosure to the customer registers of S-Bank and SOK) Improving the customer experience, allocating customers into groups based on their use of S-mobiili, targeting of marketing communications and improving S-mobiili. 37 months. However, only for as long as the consent or the S-mobile agreement remains valid.Consent
    Customer’s choice of user interface for S-mobiili Personalisation of the S-mobiili user interface. For the validity of the chosen option. However, no longer than the validity period of the S-mobiili agreement. Agreement
    Information on which benefits the customer has marked as favourite and if they have removed a benefit from favourites Personalisation of the S-mobiili user interface. Improving the customer experience, targeting content and developing S-mobiili. For the validity of the chosen option. However, no longer than the validity period of the S-mobiili agreement. Agreement
    Allocating customers into groups based on their use of S-mobiili Recommending and personalising benefits and services. Personalisation of the S-mobiili user interface. Improving the customer experience, targeting content and developing S-mobiili. Five years. However, no longer than the validity period of the S-mobiili agreement. Legitimate interest
    Information regarding mobile payment service activation Maintaining and updating data for the provision of co-op member and employee benefits. For as long as the customer is included in the joint register and the service is in use. Agreement.
    Information regarding mobile S-Etukortti activation Maintaining and updating data for the provision of co-op member and employee benefits. For as long as the customer is included in the joint register and the service is in use. Agreement.
    Some personal data may be retained in S Group's co-op member and customer register and in S-Bank's customer register after removal from the joint register, in accordance with the purposes of use and processing criteria of the registers. The retention periods are described in the privacy statements of the registers.

Recipients and recipient groups of personal data

  • 10.3. Recipients and recipient groups of personal data We disclose personal data from the joint register to S Group’s co-op member and customer register and S-Bank’s customer register in accordance with the table above. The purpose of use of these data is to maintain basic information, develop S-mobiili and customer analytics. We may disclose register data to third parties in accordance with the privacy policies of the registers. We ensure that the transfer of data is lawful if transferring customer data to countries outside the EU/EEA is necessary for technical aspects related to the processing of personal data. 10.4. Data subject’s rights in the joint register As a data subject, you can approach either data controller to exercise your rights related to the joint register data. We recommend contacting the data controller that is relevant to the rights you wish to enforce. In store customer matters, you can turn to SOK, and in banking matters, to S-Bank. If you think the processing of personal data is unlawful, you have the right to lodge a complaint or contact the Office of the Data Protection Ombudsman acting as the supervisory authority. You can prohibit the processing of personal data for advertising and analytics by using your right to opt out or by revoking your previously given consent. As a result, the contents of S-mobiili may be less personalised and we will not be able to provide you with targeted announcements or advertising in the best way possible. 10.5. Contact information of the parties to the joint register
    • SOK’s Data Protection Officer: tietosuojavastaava@sok.fi
    • S-Bank’s Data Protection Officer: tietosuojavastaava@s-pankki.fi

11. Contact person for the register

  • SOK Corporation P.O. Box 1, FI-00088 S-RYHMÄ, Finland S Group’s co-op member service: +358 10 76 5858 Street address: Fleminginkatu 34, FI-00510 Helsinki, Finland Business ID 0116323–1 Contact person for the register If you need more information about the processing of personal data, you can contact us by email at the address: tietosuoja.asiakkuus@sok.fi Contact details of the data protection officer tietosuojavastaava@sok.fi

12. Updates to the privacy statement