Privacy Notice for Sunshine Early
Learning Centre Oy’s Customer Register
1. Controller
Sunshine Early Learning Centre Oy (“SELC”, part of the Touhula daycare group) processes personal data in its operations in order to manage customer relationships, enable customer communications, perform concluded agreements and for direct marketing purposes. SELC also collects analytics data on visitors to its website.
In addition to individual customers, SELC has corporate customers and cooperation partners whose representatives’ personal data may be processed as part of this register. The data of representatives of corporate customers is used only for communications and marketing directed at the organisation.
It is important to us that you know how we process your personal data. Below we provide further information about the processing of your personal data.
2. Contact details
Controller’s contact details:
Address: Satulatie 1, 90540 Oulu
Email: tietosuoja @ touhula.fi
www.touhula.fi
Person responsible for the register:
Mikko Peltoniemi
3. Data collected
Customers and marketing contacts
Child’s name, personal identity code and address
Guardian’s name, personal identity code, address, email address and telephone number
Application details and service needs
Information concerning customer fees and the determination of such fees
Daily records related to the service and other necessary information required for organising early childhood education activities
Content provided by the data subject, such as customer feedback and additional information provided in relation to the service, including reserve applicants, allergies and photo permissions
The child’s profile picture, information concerning the course of the child’s day and communications between the home and the controller when using TouGo or another customer communication application
We collect technical data on the use of our website, such as IP address, browser type, device type, time of visit and information about the pages visited by the user. This data is used to develop the functionality, security and user experience of the website. Further information about the use of cookies is provided in a separate cookie notice.
4. Where do we obtain personal data?
As a rule, we obtain the personal data processed in accordance with this Privacy Notice from the data subject or their guardian.
Data collected from the website is stored on the server in connection with the visit. Data collected through the mobile application is stored in a separate database.
Personal and family information is mainly obtained as application data through an electronic application from the child’s guardians or from the early childhood education service guidance of the child’s municipality of residence. The information is supplemented with details provided by the guardians. Information concerning the implementation of services is generated during the customer relationship and recorded by daycare personnel. If the application for early childhood education is made through the municipality, the service provider receives the personal and family information from the municipality’s early childhood education service guidance.
Touhula daycare centres’ own website provides the possibility to give feedback on our operations either under one’s own name or anonymously. Contacts may create customer data supporting customer service, such as name and contact details, and feedback is stored.
5. Legal bases and purposes of processing
The processing of personal data is primarily based on early childhood education legislation. Personal data is also processed in order to fulfil obligations arising from the childcare agreement relationship and, in relation to processing activities requiring separate consent, such as photographing the child, on the basis of the specific consent requested.
SELC’s legitimate interest is used as the legal basis for processing personal data when we need to process personal data for the management and development of our business, including messages received through the feedback channel, or when we provide our customers or potential customers with information and offers about our services through direct marketing. We do not profile minors or approach them with marketing messages. When we process personal data on the basis of legitimate interest, for example in connection with direct marketing activities or the handling of customer feedback, we always balance the benefits of processing against any possible disadvantages to customers. We also minimise identifiable personal data.
You have the right to object to processing based on legitimate interest.
Personal data may be used for the following purposes:
Providing the service or fulfilling the contractual relationship
Meeting the requirements set by early childhood education legislation
Appointment booking service and customer advice
Organising and providing the service
Service-related communication and reminders
Customer invoicing
Collection and analysis of statistical data related to early childhood education
Collection and processing of customer feedback and customer satisfaction data
Development of the controller’s business and related customer service, as well as direct marketing
Processing tasks may be outsourced within the group companies and/or to external service providers in accordance with data protection legislation and within the limits set by it.
Customer communications and customer relationship management
Personal data is used to manage, maintain and develop the customer relationship between SELC and the customer, as well as for communications.
If you contact us, we use the information provided to respond to questions, resolve any issues and process your message.
For direct marketing purposes
We may send you information about the activities of SELC or its group companies, as well as direct marketing material.
The data subject always has the right to prohibit us from using their personal data for direct marketing, market research or profiling by contacting us using the contact details provided above or by using the unsubscribe option provided in connection with direct marketing messages or newsletters.
6. Retention period
We retain personal data only for as long as required by law or for as long as it is necessary to fulfil the purposes specified above.
7. Transfer of personal data outside the European Economic Area
Personal data is not transferred outside the European Economic Area.
8. Categories of recipients of personal data
Early childhood education data is generally confidential. Personal data is disclosed only on the basis of a specified information request to authorities entitled to receive it under early childhood education legislation. Persons processing the data are bound by a duty of confidentiality that continues after the end of the customer and childcare relationship. If early childhood education is provided using a service voucher, the municipality owns all documents generated and, after the end of the customer relationship, the documents are delivered to the municipality for archiving. Information on customers who have started the childcare relationship is transferred to Kela if the service is provided with Kela’s private childcare allowance. The municipality supervising the service and/or Kela is responsible for maintaining the register formed by them in their respective roles.
Otherwise, we do not disclose your personal data to parties outside SELC and the shared organisation of the group companies providing services to it, except in the following situations:
For legal reasons
We may disclose personal data to parties outside SELC and the group organisation if access to the personal data is reasonably necessary to: (I) comply with applicable law, regulation or a court decision; (II) detect, prevent or otherwise address fraud, money laundering, terrorist financing or security or technical issues; or (III) protect the property or ensure the safety of SELC or our customers, or to safeguard purposes required by the public interest in accordance with legislation.
To authorised service providers
We may disclose personal data to authorised service providers performing services for us. Our agreements with our service providers include commitments under which the service providers undertake to restrict the use of personal data and to comply with privacy and information security standards at least equivalent to those set out in this Privacy Notice.
With your explicit consent
We may disclose personal data to third parties outside SELC and the group organisation for reasons other than those stated above when we have the data subject’s explicit consent to do so. The data subject has the right to withdraw such consent at any time.
9. Rights of the data subject
Right of access
Data subjects have the right to access their personal data processed by SELC and the group organisation. If you wish, you may contact us to find out what personal data we process and for what purposes the data is used.
Right to request rectification
You have the right to have inaccurate, incorrect, incomplete, outdated or unnecessary personal data that we store rectified or supplemented by us. By contacting us, you may update, for example, your contact details or other personal data.
Right to request erasure
You may request us to erase your personal data. We will take the measures requested by you if we do not have a justified reason not to erase the data.
Right to object and right to restriction of processing
You have the right to object to the processing or profiling of your data if your data is processed for direct marketing purposes. You also have the right to request restriction of the processing of your personal data, for example where the data concerning you is inaccurate. In addition, in certain special situations, you have the right to object to the processing of your personal data if the basis for the objection is a particular personal situation.
Right to data portability
The data subject has the right to receive their personal data from us in a structured and commonly used format and to independently transfer the data to a third party.
Exercising your rights
If you wish to exercise any of the rights listed above, please send us the following information by post or email: name, address, telephone number and a copy of a valid identity document. In order to verify your identity, we may request additional information.
We may reject requests that are made unreasonably frequently, are excessive or are manifestly unfounded.
10. Data security
We have implemented administrative, organisational, technical and physical safeguards to protect the personal data we collect and process. Our security measures are designed to maintain an appropriate level of confidentiality, integrity and availability of the data.
Personal data may only be processed by persons whose work duties justify such processing. Access to personal data is protected by appropriate user-specific IDs, passwords and access rights.
11. Lodging a complaint
You have the right to lodge a complaint with the supervisory authority if you consider that our processing of personal data is contrary to data protection legislation.
12. Changes to this Notice
We reserve the right to amend this Notice. We will notify changes on our website, where you can also find the latest version of this Notice. The current version was prepared in 8/2026.