S Group's co-op member and customer register
The controller of S Group’s co-op member and customer register is SOK Corporation.
Introduction to the Privacy Notice
This privacy policy for S Group’s co-op member and customer register describes how personal data included in the register is processed and for which purposes the personal data is used. The policy provides more detailed information about your rights as a data subject. You can also learn more about data retention periods, the bases for processing or the recipients of personal data, for example. You can find more detailed contact details of the data controller and updates to the policy at the end of the page.This privacy statement covers the following topics:
- The personal data processed
- Bases for the processing of personal data, purposes of use and storage periods
- Rights of the data subject
- Data sources
- Recipients of personal data
- Transfer of personal data to third countries or international organisations and data protection safeguards used
- Impact of the processing of personal data and a general description of technical and organisational security measures
- Effects of not providing personal data on an agreement
- Significant information related to automated decision-making or profiling
- Data protection concerning the joint data register and controller role for shared customer data of SOK and S-Bank
- Contact person for the register
- Updates to the privacy statement
1. The personal data processed
We process your personal data if your belong to any of the following customer groups:
- Co-op members: persons who are or have been members of a cooperative
- Members of a co-op member household: persons who belong to or have belonged to a co-op member household but are not necessarily members of the cooperative themselves.
- Other customers: persons who are not co-op members or part of a co-op member household but have subscribed to some of the services provided based on S Group’s co-op member and customer register, such as the S User Account or an electronic newsletter, or who have performed transactions in the online store.
Processed personal data categorized by customer group
Processed personal data categorized by customer group
Co-op member Member of a co-op member household Other customer Basic data x x x Contact us x x x Gender x x Employee information x x Cooperatives’ membership information x Invoicing Bonus partners x x Information about the co-op member household x x Deposit account for benefits payable in cash x S-Etukortti card x x Credentials x x x Customer groups x x x Customer categorisation and profiling information x x x Subscriptions, services used and data concerning the use of services x x x Authorisations and prohibitions, i.e., your consents and objections to personal data processing x x x Data on paid benefits and received discounts x x x Detailed purchase data x x x Customer’s digital footprint x x x Information regarding customer belonging to a target group x x x Online shopping information x x x Information about the Raflaamo service x x x Hotel reservations x x x Terminal device location data, if you have permitted the processing of location data in online or mobile services x x x Customer feedback x x x Information about product reviews x x x Survey responses based on consent x x x Detailed breakdown of the personal data
Information used for the provision of co-op member benefits:- basic information
- contact information
- cooperative’s membership information
- co-op member household information
- deposit account for benefits payable in cash
- S-Etukortti card
- invoicing Bonus partners
- data on paid benefits and received discounts
- first and last name, social security code, date of birth, language
- non-disclosure for personal safety reasons and expiration date of the non-disclosure
- starting date and validity period of customer relationship
- information of prohibitions and updates from the Population Information System and service providers
- permanent postal address, temporary postal address, domicile, mobile phone, other phone number, email
- product safety email address, if provided
- Information about the customer’s gender as indicated by the customer themselves, or information that the customer has not indicated their gender
- information about S Group employee discount entitlement
- membership cooperative, member identification number, member status, starting and ending date of membership, place of affiliation
- status of co-op contribution, paid co-op contribution, date of completing co-op contribution and payment transactions
- information on interest paid on the contribution, information on the return of the surplus paid
- registrations at Bonus partner companies, validity periods
- main member of the co-op member household, persons belonging to the same co-op member household as the main member
- account number, validity period and account type for the payment account for benefits
- card number, card type, validity period, reason for cancellation
- information on to which co-op member household the Bonus purchases are connected
- information on the membership of which cooperative the card subscription is based
- information on a card being added to Apple Wallet
- S User Account, customer code
- customer groupings of the customer (such as groupings connected to the use of digital services, main Sokos store and customer class, grocery store and ABC store segment)
- information about the customer’s participation in support groups of associations or other groups
- Information about whether the customer is eligible for the membership fee benefit
- categories and profiles linked to the customer
- student status
- information on services subscribed to / in use (e.g. S User Account, S-mobiili, ABC-mobiili)
- information entered by the customer, data produced by the use of services
- car registration number provided by the customer, if the customer has ordered a monthly wash in the ABC-mobiili application
- information of the data controller’s communication with the customer aimed at maintaining the customer relationship
- email marketing permit, mobile device marketing permit (mobile phones)
- permission to target advertising in channels outside S Group and S Bank (Google, Meta, others)
- authorisations and prohibitions, such as notification permits, administered in S-mobiili and ABC-mobiili mobile apps.
- cookie choices
- direct marketing ban, phone marketing ban, Puhelin-Robinson phone ban, Posti-Robinson mail ban, prohibition of surveys
- prohibition on separate direct mail, prohibition to send notifications
- prohibition of processing product-level purchase data, prohibition of analytics and customer grouping
- number of the S-Etukortti card used for purchases entitling one to co-op member benefits or the member/customer number, date of purchase, time, place of purchase, manner in which the card was used, purchase data in the receipt sum level
- paid Bonus, Tankkausbonus refuelling bonus and payment method benefits
- co-op price benefits received, personnel discounts received
- online warranty receipts and online receipts
- information about purchases at the product level
- website user data and mobile service user data
- information of the identified use of digital services (e.g., online and mobile services)
- information regarding customer belonging to a target group for electronic direct marketing messages or mobile services
- data concerning shopping carts, as well as order and delivery information such as order numbers, payment information, delivery methods and destinations; however, more detailed additional information about deliveries from online grocery stores, such as door codes or instructions on arrival, is only available in the order and delivery register of the co-operative that delivers the order
- coordinates for the delivery address
- information provided by the user about their preferences
- delivery addresses saved in the service
- products marked as favourites by the customer
- contact history and phone call recordings concerning online store service, orders and deliveries
- table reservations
- orders for pickup
- provided information about preferences, such as favourite restaurant
- information about room reservations in S Group hotels
- Terminal device location data, if you have permitted the processing of location data in online or mobile services. Location data is not stored in any register.
- feedback provided on a feedback form and the feedback functionality in the S-mobiili app.
- information about product reviews in S Group online stores
- responses given in a survey when the respondent has given their explicit consent to the processing of responses as personal data
2. Bases for the processing of personal data, purposes of use and storage periods
2.1. Basis for processing S Group’s co-op member scheme requires us to process the personal data of co-op members and other people belonging to co-op member households. Personal data is required for purposes such as the provision of services and benefits in the co-op member scheme, managing customer relationships and maintaining the membership lists of cooperatives. Customer data allows us to also offer S Group’s customers relevant services and benefits that meet their individual needs as closely as possible, as well as produce targeted and personalised content and advertising. 2.2. Storage periodSome of our services, such as S User Accounts and online stores, can also be used without co-op membership or belonging to a co-op member household. The data of such customers is processed for purposes such as the provision of the online store service or other digital service used by the customer, processing customer feedback and other management of customer relationships. We also utilise customer data in the planning and development of S Group’s business operations. For this purpose, we may use personal data for purposes such as analysis and profiling, or to carry out surveys or market studies. We may also process personal data for marketing purposes of our partners and organisations that belong to S Group at any given time. The term “S Group” refers to the cooperatives and the SOK Group together with its subsidiaries and associated companies. The term “partner”, meanwhile, refers to companies that grant Bonus and/or benefits to co-op members, for example, and companies that cooperate with S Group, implement joint marketing or buy media visibility from S Group. The storage periods of data vary based on the purpose for their use. The storage of an individual data item in the register lasts until the end of the longest storage period set for said data item, but the data may be used for each purpose only for the time indicated in the table below. Certain data related to the management of customer relationships are stored for the entire duration of the co-op membership or membership in a co-op member household. Meanwhile, detailed purchase data is stored for a maximum period consisting of the year of the purchase and the ten years following it. Personal data is generally erased within six months of the termination of a customer relationship. However, we store some data for a longer period of time. This includes data related to membership in a cooperative and data related to the payment of membership fees. This information is stored for a period consisting of the year of the monetary transaction and six years following it. A customer relationship may end due to resignation or termination, or when the customer leaves a co-op member household. Data related to the S User Account is deleted when the customer relationship ends. S User Account customer relationship is considered to end when the customer requests the account to be deleted. 2.3. Purpose of use The tables below provide more detailed information regarding what purposes the personal data in the register are used for, and how long the data is stored.
Basis for processing
Contract
Contract
When joining as a co-op member or joining a co-op member household, you must accept the rules of the co-op membership scheme. Co-op members must also accept the bylaws of the co-op when joining. Customers using our digital services must accept the terms and conditions of the services, such as the S User Account, Kerää ja skannaa service or online stores. The provision of the co-op membership scheme and digital services requires us to process our customers’ personal data for the purposes indicated below.
| Purpose of use: | Data processed: | Processing period: |
|---|---|---|
| Member administration of the cooperative | - Basic data - Contact information - Cooperatives’ membership information - Deposit account for benefits payable in cash | End of the calendar year during which the co-op membership was terminated + 6 years |
| Organisation of elections | - Basic data - Contact information - Cooperatives’ membership information - Permissions and prohibitions | Throughout the validity of the membership |
| Information on interest paid on the membership fee, information on the return of the surplus paid | - Basic data - Cooperatives’ membership information - Deposit account for benefits payable in cash | End of the calendar year of the last payment transaction after the co-op membership was terminated + 6 years |
| Calculation and payment of co-op member benefits such as Bonus, payment method-related benefit and Refuelling Bonus | - Information used for the provision of co-op member benefits - Purchase data | 5 years |
| Provision of services and benefits (such as S-mobiili, ABC-mobiili, S User Account, Raflaamo, online stores) | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Detailed purchase data - Subscriptions, services used and data concerning the use of services - Information about the Raflaamo service - Permissions and prohibitions - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data | Throughout the customer relationship + 6 years after the termination of the customer relationship. For S User Account agreements, throughout the validity of the agreement. Detailed purchase data: year of the purchase + 10 years |
| Co-op member and customer communication | - Basic data - Contact information - Purchase data | Throughout the customer relationship + 6 years after the termination of the customer relationship. For S User Account agreements, throughout the validity of the agreement. |
| Targeted advertising, mail | - Basic data - Contact information | Validity of the co-op membership agreement + 6 months after the termination of the agreement |
| Maintenance of user data for digital services | - S User Account data - Basic data - Contact information (confirmations) - Permissions and prohibitions - Customer’s digital footprint | Throughout the validity of the S User Account agreement |
| Defence against legal claims | - Data required to defend against claims | The data is stored until the matter has been settled |
| Provision of the Kerää ja skannaa service using a handheld scanner and the S-ostoslista shopping list app | - First name - S-Etukortti card’s technical identifier - Detailed purchase data - Level of trust - Information about rescannings - Scan history | 2 years |
Consent
Consent
Consent is a key basis for processing that offers you the opportunity to tell us that you want your personal data to be processed for a specific purpose. We separately request consent for each of the purposes of use listed below. Providing consent always requires you to take action, such as checking a box regarding providing consent. You can cancel consent regarding the processing of your personal data at any time.
| Purpose of use: | Data processed: | Processing period: |
| Direct marketing using electronic means (e-mail or SMS, for example) | - Information regarding customer belonging to a target group - Contact information - Permissions and prohibitions | 2 years from the expiry of consent |
| Targeting of advertising in channels outside S Group and S-Bank | - Information regarding customer belonging to a target group - Contact information - Permissions and prohibitions | 2 years from the expiry of consent |
| Sending notifications regarding mobile services | - Information regarding customer belonging to a target group - Permissions and prohibitions - Subscriptions, services used and data concerning the use of services | 2 years from the expiry of consent |
| Targeting marketing and advertising on the basis of mobile device IDs | - Permissions and prohibitions - Subscriptions, services used and data concerning the use of services - Customer’s digital footprint | 2 years from the expiry of consent |
| Management of a customer relationship | - Basic data - S User Account - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data | Throughout the customer relationship + 6 years after the termination of the customer relationship. For S User Account agreements, throughout the validity of the agreement. Detailed purchase data: year of the purchase + 10 years. |
| Disclosing data for partners, for example, to get Bonus or other co-op member benefits | - Basic data - Cooperatives’ membership information - Personnel and discount entitlement data - Permissions and prohibitions | Throughout the validity of the co-op membership agreement |
| Disclosing data to third parties outside S Group or for external purposes, such as scientific research | - Basic data - Cooperatives’ membership information - Personnel and discount entitlement data - Detailed purchase data | Throughout the customer relationship + 6 years after the termination of the customer relationship. Detailed purchase data: year of the purchase + 10 years |
| Processing of digital footprint data based on cookie choices | - Customer’s digital footprint | Two years. However, no longer than the validity period of the S User Account agreement. |
| Combining responses provided to studies and surveys with the customer’s data | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Detailed purchase data | 2 years |
| Provision of features based on location data in online and mobile services, such as store locator functionality and mobile scanning | - Terminal device location data, if you have permitted the processing of location data in online or mobile services | Location data will not be saved. |
| Maintenance of student status | - Email address of university | Throughout the validity of the student status. The university email address provided by the customer is immediately deleted as soon as the student status has been confirmed. |
Legitimate interest
Legitimate interest
Description of the data controller’s legitimate interest We have assessed the legitimate interest on the basis that S Group’s operations are cooperative in nature and S Group is owned by its co-op members. Co-op membership of S Group is optional and the membership scheme is open to anyone. The purpose of S Group's operations is to provide customer-oriented, meaningful and cost-effective services and benefits to co-op members, and thus promote financial wellbeing of co-op members. The analysing of purchasing behaviour and the calculation of customer profiles, as well as related direct marketing and content targeting, opinion polls and market surveys are key ways to achieve this goal. We ensure that the processing based on a legitimate interest is correctly proportioned to your interests and in compliance with your reasonable expectations. You have the right to object to the processing of personal data based on a legitimate interest and refuse to allow S Group to process purchase data (apart from the sum total of your receipts), analytics and customer grouping, opinion polls and market surveys, and direct marketing. You can manage your data and restrict their use in S-mobiili’s “Me” section or by signing in to your S User Account in any of S Group’s online services or by contacting customer service. We may also use the AI we have developed to personalise our services. Search results in services such as online stores or self-service machines may be based on recommendations provided by an AI model. The AI model analyses your purchase history and provides search results in the online store for products that, based on this analysis, you are likely to be searching for and looking to purchase. With the help of AI, the search results become more relevant to you, enabling you to collect the right products into your shopping cart more quickly. If you do not wish to receive search results based on AI or other personalised content, you may set an analytics and customer grouping prohibition in the privacy settings of the S-mobiili app or your S User Account, or by contacting customer service.
| Purpose of use: | Data processed: | Processing period: |
| S Group’s customer-oriented planning and development of business operations | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - S-Etukortti cards - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Gender information - Customer categorisation and profiling information | Year of entry + 10 years |
| Conducting surveys and market research | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Gender information - Customer categorisation and profiling information | 2 years |
| Forming customer categories and profiles for developing business operations, and for conducting and targeting advertising and marketing | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - S-Etukortti cards - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data - Gender information - Hotel reservations | Year of entry + 10 years |
| Implementation of an electronic receipt archive | - Image of the receipt | Electronic cash receipt: 10 years from the purchase transaction Warranty receipt: 10 years from the purchase transaction or upon request by the customer |
| Production of the My purchases function | - Detailed purchase data | Year of entry + 10 years |
| Processing of customer feedback | - Basic data - Contact information - Content of feedback or review | 2 years |
| Direct marketing by telephone | - Basic data - Permissions and prohibitions | Year of entry + 7 years |
| Targeting and personalisation of content in digital channels. We may also use AI to personalise content. | - Basic data - Permissions and prohibitions - Detailed purchase data - Gender information - Customer categorisation and profiling data - Customer’s digital footprint | Year of entry + 10 years |
| Conducting and targeting marketing in S Group’s digital channels | - Basic data - Permissions and prohibitions - Detailed purchase data - Customer groups - Gender information - Customer categorisation and profiling data - Customer’s digital footprint - Hotel reservations | Year of entry + 10 years |
| Provision of marketing services to S Group’s partners | - Basic data - Permissions and prohibitions - Detailed purchase data - Gender information - Customer categorisation and profiling data - Customer’s digital footprint | Year of entry + 10 years |
| Realisation of prize draws based on customer relationship or the use of S-Etukortti card | - Basic data - Contact information - Customer categorisation and profiling data | 6 months |
| Profiling and inspections made in the Kerää ja skannaa service (including mobile service) | - First name - S-Etukortti card - Scanned products - Level of trust - Information about rescannings - scan history | 2 years |
| Identification and investigation of suspected misconduct, and monitoring of compliance with S Group’s membership scheme | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Customer’s digital footprint - Online shopping information - Personnel and discount entitlement data | 2 years |
| Provision of customer service and quality assurance | - Information used for the provision of co-op member benefits - User ID, S User Account - Customer groups - Subscriptions, services used and data concerning the use of services - Permissions and prohibitions - Detailed purchase data - Online store phone call recordings | 2 years |
| Provision of personnel discounts | - Basic data - Contact information - Personnel and discount entitlement data - Co-op member household information | Throughout the S Group employee’s employment relationship, and two years after its termination |
| Handling of product requests | - Form data provided by customer - Telephone number | 30 days |
| Processing of product reviews and publication in S Group online stores | - Information about product reviews - Online shopping information - S User Account | 10 years |
| Defending against legal claims | - Data required to defend against claims | The data is stored until the matter has been settled |
| Monitoring and collection of receivables | - Basic data - Contact information - Online shopping information | Throughout the collection process |
Statutory obligation
Statutory obligation
Compliance with our statutory obligations requires the processing of your personal data for the purposes indicated below.
| Purpose of use: | Data processed: | Processing period: |
| Member administration of the cooperative | - Basic data - Contact information - Cooperatives’ membership information - Deposit account for benefits payable in cash - Customer groups | End of the calendar year of the last payment transaction after the co-op membership was terminated + 6 years |
| Submitting the necessary information to the Tax Administration in accordance with fiscal legislation. | - Basic data - Cooperatives’ membership information | End of the calendar year of the last payment transaction after the co-op membership was terminated + 6 years |
| Statutory information requests by authorities, and responses to such requests | - All information related to statutory requests by authorities | 2 years |
| Maintaining information about non-disclosures for personal safety reasons | - Non-disclosure for personal safety reasons and expiration date of the non-disclosure | Expiration date of the non-disclosure |
| Product recalls and other communications related to product safety | - Basic data - Contact information - Detailed purchase data | Year of entry + 10 years |
| Provision and storage of accounting | - Membership fee and other data recorded in accounting | Until the end of the calendar year + 6 years |
3. Rights of the data subject
You have the following rights:
- Right to access your data
- Right to rectification of your data
- Right to erasure of your data (for example, when the processing is based on consent or there is no basis for retaining the data)
- Right to restrict processing (denying the authenticity of data or illegitimate processing)
- The right to object to the use of your personal data in direct marketing or other processing based on a legitimate interest
- Right to withdraw your consent
- Right to transfer data to another system (in case of automatic processing)
Rights
Get to know your data
To see the data about you stored in S Group’s co-op member and customer register, log in to your S User Account at https://s-kayttajatili.fi/en. If you do not have an S User Account, or if you wish to review data related to the Collect and Scan service, the S-Ostoslista shopping list app, online store customer service chat conversations and call recordings, or responses to research surveys, you can submit a registry extract request at rekisteriotepyynto.s-kanava.fi. Strong authentication is required to complete the form.You can also update your personal data through your S User Account, the S-mobiili app, the co-op member service (found at almost all Prisma and Sokos stores), by sending a message through our feedback form (select co-op membership, the S-Etukortti card and Bonus as the subject), or by calling S Group’s co-op member service, tel. +358 10 76 5858. We will receive information about any address and name changes directly from the Population Information System if you have submitted a notification of the change there and you have not submitted a prohibition on the updating of customer register data or any other prohibition preventing the update in the Population Information System.Manage the processing of your data
You can control how S Group processes your information by giving and withdrawing permissions and by activating prohibitions through your S User Account and the S-mobiili app. You can find permissions and prohibitions related to the processing of personal information in your S user account (https://s-kayttajatili.fi/en) and under the communication and privacy settings in the S-mobiili application. You can, for example prohibit the forming of an electronic receipt archive, analyses and customer groupings or processing of your exact purchase information. If you prohibit the processing of your exact purchase information, we will not process your purchase information in any more detail than the final sum of the Bonus you earn. This prevents the production of the My Purchases service in the S User Account and the S-mobiili app, for example, as well as the targeting of marketing and the personalization of content based on your purchase information.We only use your data for online direct marketing and targeting in S Group’s external channels if you have given us your permission to do so. If you want to receive online direct marketing, you can choose the channels through which you want to receive it. For example, if you want to receive S Group benefits and tips in your email but not on your mobile device, you can make the corresponding selections in the communication preferences of your S User Account and the S-mobiili app. If you want the S Group advertisements you see on social media and elsewhere outside S Group’s channels to be as interesting as possible for you, you can give your permission to target advertising in S Group’s external channels in the communication preferences. If you wish, you can also prohibit traditional addressed direct mail and telemarketing in the communication preferences. If you want to receive marketing but want to choose the channels used for it, you can allow us to send marketing messages by email and mobile device, for example, or prohibit traditional addressed direct mail, telephone marketing or targeting in channels other than S Group’s own channels. You can also prohibit polls and market surveys if you do not wish to receive any research surveys from us. In addition to your S User Account and S-mobiili communication settings, you can withdraw your consent to email marketing through a link in the email you received.You can also give and withdraw permissions concerning your personal data and set up prohibitions by contacting our customer service. To exercise your rights or to get more information on how your personal data is processed, you can also contact the data controller by sending an email to tietosuoja.asiakkuus@sok.fi. You also have the right to file a complaint with a supervisory authority if you are of the opinion that we are in breach of the applicable data protection legislation when we process your personal data.
4. Data sources
We obtain data from the agreement you sign when you join S Group’s co-op membership scheme, and from you personally during the customer relationship by phone, websites, email or other similar methods or based on your use of services. Updates of name, address and mobile phone data, as well as information about death, can also be received from authorities or companies providing updating services. Information on Robinson marketing prohibitions for telemarketing/direct marketing by post comes from Suomen Asiakkuusmarkkinointiliitto ry. Information of employment in the S Group and information of the right to receive the personnel discount come from S Group’s employee registers. We obtain data on your use of the S-Etukortti card and any transactions you perform when identified online from those organisations that belong to S Group's co-op member scheme and from partners that grant the S Group Bonus. In addition, we might obtain information from organisations belonging to S Group and partners belonging to the co-op membership scheme that utilise the S-Etukortti card or other credentials to verify your identity in their services. We receive information about reservations at S Group hotels from the customer register for the S Group travel and hospitality services. Information about reservation can, for example, be used for targeting marketing of S Group services near the hotel that might interest you. You can prohibit the use of reservation information in the S Group co-op member and customer register by prohibiting analyses and customer grouping under your information in the S-mobiili application or by logging into your S user account in any S Group online service. We obtain limited personal data also on SOK and S-Bank’s shared customers from our joint register. For more information, see section 10 of this notice.
5. Recipients of personal data
We disclose information to the Tax Administration about any interest paid to co-op members on their co-op contribution and return on capital paid to resigned members. We can also disclose information within the limits allowed and required by valid legislation, such as when answering authorities’ requests for information. We disclose information about your online groceries purchases to a co-operative in order for them to deliver your order. We may also disclose your contact details and personal identity code to the co-operative if the information is necessary for the billing or collection of an unpaid online store order.We may also disclose customer contact details and information about S-Etukortti cards to the co-operative for customer service purposes, as well as to identify, investigate and deal with suspected abuse of the co-operative’s rules, the rules of the membership scheme, or the rules of the staff discount scheme and related suspected criminal offences.We disclose the delivery information of your order to Posti or other similar operators such as PostNord to deliver products you have purchased. The disclosure of the information is based on the agreement concluded as part of the product purchase. With your consent, we disclose information about your co-op membership to a partner that grants S Group Bonus.If you have given your consent to the targeting of advertising in channels outside S Group and S Bank, we may disclose a pseudonymised, i.e. encrypted, customer identifier to media partners for targeting advertising. Where applicable, we serve as a joint controller with the media partner. You can find more information about the processing of personal data for targeted advertising in external channels at Targeting advertising in S Group and S Bank’s external channels.With your consent, we may disclose your data to third parties outside S Group or for external purposes, such as scientific research. Your personal data associated with customer feedback is received by S Group’s internal customer service teams, as well as product specialists participating in the processing of your feedback. Your demographic data and data about you belonging to a customer group can also be processed with other data in SOK’s customer registers in order to develop business operations in analytics and reporting for each customer group. This data can also be used for improving the quality of customer service and targeting marketing, for example when you book a room in one of S Group's Sokos Hotels.In some situations, we use subcontractors, who process customer information by our orders and on our behalf. The subcontractors we use carry out services on our behalf, such as IT services, IT system maintenance services, customer communications, marketing and customer research campaigns, payment services and delivery services for our online stores. The subcontractors are granted access to such customer information that they need to produce the agreed services for us. When it comes to providers of payment services for online stores, the necessary information may also include the cardholder’s name and contact details. Payment service providers may also process this data for their own purposes, such as complying with their legal obligations.We disclose limited personal data also on SOK and S-Bank’s shared customers to our joint register. For more information, see section 10 of this notice.
6. Transfer of personal data to third countries or international organisations and data protection safeguards used
We use subcontractors to process personal data and the data is transferred in a limited way outside the European Union (EU) or the European Economic Area (EEA) for the purposes of service provision, technical administration and support. We can perform these types of transfers if the European Commission has decided that the target country or organisation has a sufficient level of data protection or we can otherwise ensure a sufficient level of protection of the personal data in accordance with applicable legislation, such as by using standard contractual clauses approved by the European Commission. You can read more about the standard contractual clauses approved by the European Commission here. We require our subcontractors to agree to follow the data protection and information security requirements of legislation and SOK.
7. Impact of the processing of personal data and a general description of technical and organisational security measures
We diligently protect your personal data by employing the appropriate data protection and information security measures. Our system providers process your personal data at secure server facilities. Access to personal data is restricted, and the personnel are subject to a confidentiality obligation. S Group protects your personal data by means of, for example, preventive risk management and security planning, protection measures for data communications, and by using secure hardware facilities, access control and security systems. After initial processing, hard copies containing personal data are stored in locked and fire-safe storage facilities. The granting and monitoring of user rights is a well-managed process. We regularly provide training for our personnel who participate in the processing of personal data, and ensure that our partners’ personnel also understand the confidential nature of personal data and the importance of secure processing. We select our subcontractors with care. We continuously update our internal practices and guidelines. If, despite all of our safeguards, your personal data ends up the wrong hands, we will immediately begin investigating the incident and aim to prevent any damage caused. We will inform the relevant authorities and you of the data security breach in accordance with legislative requirements.
8. Effects of not providing personal data on an agreement
In order to become a co-op member and to join the S Group co-op member scheme, the customer must provide the necessary information so that the agreement can be concluded (name, address, social security code given by the Finnish civil registrant). If the necessary personal data is not provided, the agreement cannot be concluded. In order to become a member of a co-op member household and to join the S Group co-op member scheme, the customer must provide the necessary information so that the agreement can be concluded (name, address, social security code given by the Finnish civil registrant or date of birth). Providing the information required for concluding the relevant service agreement is a prerequisite for the provision of the services based on the register data. The information required for concluding a service agreement varies depending on the service.
9. Significant information related to automated decision-making or profiling
We do not perform automatic profiling or automatic decision-making on the basis of the data in the register that would result in legal effects concerning you. If you are using theKerää ja skannaa service, automatic decision-making is performed in the service on the basis of the use of the service and the scanner. The results of such analyses may lead to you being directed to have your products verified at the cash counter.
10. Data protection concerning the joint data register and controller role for shared customer data of SOK and S-Bank
10.1. Purpose and data subjects of the joint register Suomen Osuuskauppojen Keskuskunta (SOK) as a data controller and S-Bank Plc as a data controller are the joint controllers of data described in this section 12 of the notice. In this description, we will define the data subjects and what kind of information is processed in the register. We will also explain how the roles of joint data controllers have been determined in relation to the data subjects. This section supplements the privacy policies of the SOK and S-Bank customer registers. Natural persons covered by the joint register:
- Customers with a co-op membership and S-Bank membership that are active simultaneously.
- Customers who have become a co-op member in the “Become a co-op member” online service.
- Customers added to the co-op member household in the Child’s Banking service.
- Customers who have an agreement on the deployment of S-mobiili.
Data areas included in the joint register
10.2. Data areas included in the joint register
10.2. Data areas included in the joint register
| Data | Purpose of use | Storage period in the joint register *) | Legal basis |
| Basic personal data (name, social security number, date of birth, language, date of death) | Maintaining and updating data for the provision of co-op member and employee benefits. | For as long as the customer is included in the joint register, as described in section 1. | Contract |
| Contact information (permanent and temporary postal address, mobile phone number, other phone number, email address) | Maintaining and updating data for the provision of co-op member and employee benefits. | For as long as the customer is included in the joint register. | Agreement |
| Information about becoming a customer in the digital channel (Become a co-op member online service) | Providing the Become a co-op member online service. | 6 months from becoming a co-op member. | Agreement |
| Information about becoming a customer via a digital channel in the Child’s Banking service | Enabling the addition of a minor to the co-op member household as part of the service for opening S-Bank’s services and products | 6 months from using the service | Agreement |
| Information about the joining benefit offered by S-Bank | Reporting and generating mutual interest. | As long as the customer is in the joint register. However, up to 18 months from joining | Legitimate interest |
| Employee information (information on belonging to the personnel, information of right to employee discounts) | Maintaining and updating data for the provision of employee benefits. | For as long as the customer is included in the joint register. | Legitimate interest |
| Co-op member household which the customer belongs to, information about the customer's role in the co-op member household, validity period of the co-op member household, member/customer number) | Maintaining and updating data for the provision of co-op member and employee benefits. Maintaining and updating data in order to improve customer experience and develop our business | For as long as the customer is included in the joint register. | Agreement Legitimate interest |
| Deposit account for benefits payable in cash (valid account number for the payment of benefits) | Maintaining and updating data for the provision of co-op member and employee benefits. | For as long as the customer is included in the joint register. | Agreement |
| S-Etukortti Visa (card type, card validity, information on which cooperative’s membership was used to order the card) | Creation of an S-Etukortti Visa card with the customer’s details. Managing settlements on matters related to the production of co-op member benefits. | For as long as the customer is included in the joint register. | Agreement |
| Consent and prohibitions (direct marketing prohibition, email marketing permission, mobile marketing permission, permission to target in third-party channels (Google, Meta, others), telemarketing prohibition, survey prohibition, prohibition information of the Robinson prohibition service offered by Suomen Asiakkuusmarkkinointiliitto ry, and non-disclosure for personal safety reasons) | Maintaining and updating data. | For as long as the customer is included in the joint register. | Legitimate interest |
| Information on the activation of the S-mobiili app | Provision of the S-mobiili service. | Throughout the validity period of the S-mobiili agreement. | Agreement |
| Advertising identifier obtained from the mobile device to identify it | Maintaining and updating information. | For as long as the consent is valid. | Consent |
| Consents concerning S-mobiili (use of location data, reception of notifications and for the collection of digital footprint data) | Maintaining and updating information. Targeting marketing, content and announcements. Improving the customer experience and business. | For as long as the consent is valid. However, no longer than the validity period of the S-mobiili agreement. | Legitimate interest |
| Customer feedback on S-mobiili given in S-mobiili | Development of the S-mobiili mobile app and replying to feedback. | Two years. | Legitimate interest |
| S-mobiili’s digital footprint (processing in the joint register and disclosure to the customer registers of S-Bank and SOK) | Improving the customer experience, allocating customers into groups based on their use of S-mobiili, targeting of marketing communications and improving S-mobiili. | Two years. However, no longer than the validity period of the S-mobiili agreement. | Consent |
| Customer’s choice of user interface for S-mobiili | Personalisation of the S-mobiili user interface. | For the validity of the chosen option. However, no longer than the validity period of the S-mobiili agreement. | Agreement |
| Information on which benefits the customer has marked as favourite and if they have removed a benefit from favourites | Personalisation of the S-mobiili user interface. Improving the customer experience, targeting content and developing S-mobiili. | For the validity of the chosen option. However, no longer than the validity period of the S-mobiili agreement. | Agreement |
| Allocating customers into groups based on their use of S-mobiili | Recommending and personalising benefits and services. Personalisation of the S-mobiili user interface. Improving the customer experience, targeting content and developing S-mobiili. | Five years. However, no longer than the validity period of the S-mobiili agreement. | Legitimate interest |
| Information regarding mobile payment service activation | Maintaining and updating data for the provision of co-op member and employee benefits. | For as long as the customer is included in the joint register and the service is in use. | Agreement. |
| Information regarding mobile S-Etukortti activation | Maintaining and updating data for the provision of co-op member and employee benefits. | For as long as the customer is included in the joint register and the service is in use. | Agreement. |
Recipients and recipient groups of personal data
10.3. Recipients and recipient groups of personal data We disclose personal data from the joint register to S Group’s co-op member and customer register and S-Bank’s customer register in accordance with the table above. The purpose of use of these data is to maintain basic information, develop S-mobiili and customer analytics. We may disclose register data to third parties in accordance with the privacy policies of the registers. We ensure that the transfer of data is lawful if transferring customer data to countries outside the EU/EEA is necessary for technical aspects related to the processing of personal data. 10.4. Data subject’s rights in the joint register As a data subject, you can approach either data controller to exercise your rights related to the joint register data. We recommend contacting the data controller that is relevant to the rights you wish to enforce. In store customer matters, you can turn to SOK, and in banking matters, to S-Bank. If you think the processing of personal data is unlawful, you have the right to lodge a complaint or contact the Office of the Data Protection Ombudsman acting as the supervisory authority. You can prohibit the processing of personal data for advertising and analytics by using your right to opt out or by revoking your previously given consent. As a result, the contents of S-mobiili may be less personalised and we will not be able to provide you with targeted announcements or advertising in the best way possible. 10.5. Contact information of the parties to the joint register
- SOK’s Data Protection Officer: tietosuojavastaava@sok.fi
- S-Bank’s Data Protection Officer: tietosuojavastaava@s-pankki.fi
11. Contact person for the register
SOK Corporation
P.O. Box 1, FI-00088 S-RYHMÄ, Finland
S Group’s co-op member service: +358 10 76 5858
Street address: Fleminginkatu 34, FI-00510 Helsinki, Finland
Business ID 0116323–1 Contact person for the register If you need more information about the processing of personal data, you can contact us by email at the address: tietosuoja.asiakkuus@sok.fi Contact details of the data protection officer tietosuojavastaava@sok.fi
12. Updates to the privacy statement
Updated 1.9.2025 with the following changes:
Updated 1.9.2025 with the following changes:
- We have added targeted advertising in external channels as a purpose of processing personal data to the co-op member and customer register and to the joint register of SOK and S-Bank. This purpose will be based on consent from 1 September.
- We have added information regarding the processing of an email address provided for product safety purposes.
- We have supplemented content personalisation based on a legitimate interest by describing the use of AI in personalisation of content, such as online store search results.
- We have supplemented the information contained in the joint register of SOK and S-Bank by adding details regarding, for example, non-disclosure for personal safety reasons. The change applies to information concerning non-disclosure for personal safety reasons submitted after 1 September 2025.