This document is the privacy notice required under the EU General Data Protection Regulation (Articles 13 and 14) and the Finnish Data Protection Act (1050/2018).
Prepared on September 11, 2025. Last modified on September 8, 2026.
The data controller for the register is:
TP Silva Oy (Business ID: 0550899-7) X Firewood Factory is a brand of TP Silva Oy. Contact person for register matters: Lauri Kälviäinen, Sales Director Address: Technopolis Asemakeskus, Peltokatu 26, 33100 Tampere, Finland Phone: +358 40 834 7776 Email: info@xfirewoodfactory.com
The name of the register is X Firewood Factory Customer Register.
Personal data is processed for purposes related to managing, administering, and developing customer relationships, providing and delivering services, and developing services and billing. Data is also processed to investigate complaints and other claims.
Additionally, personal data is used for customer communications, including information updates, news, and marketing activities, including direct marketing and electronic direct marketing. Communications may be sent by email, telephone, and WhatsApp, and may include invitations to trade fairs, exhibitions, and other industry events.
Customers and other recipients have the right to prohibit direct marketing targeted at them.
The data controller processes the data itself and uses subcontractors operating on behalf of and for the account of the data controller.
The legal bases for processing personal data under the GDPR are:
The mentioned legitimate interest is based on the relevant and appropriate relationship between the data subject and the controller resulting from the data subject being a customer of the controller and where processing occurs for purposes that the data subject could reasonably expect at the time of data collection and within the context of the relationship.
Legitimate interest is also relied upon for business-to-business direct marketing addressed to representatives of companies and organisations operating in the forestry, firewood production, and wood processing sectors, where the marketing concerns products and events relevant to the recipient’s professional role. The recipient may object to such marketing at any time, and any objection will be given effect without exception.
The register may contain the following personal data of each data subject:
Personal data is collected primarily from the data subjects themselves.
The information is obtained directly from customers, for example via online forms, emails, phone calls, WhatsApp messages, social media, customer meetings, or other situations where the customer provides their information.
Personal data is also collected and updated from publicly available sources as permitted by applicable law to fulfill the customer relationship and the controller’s obligations.
Contact details of potential business customers are also collected from publicly available sources, including company websites, publicly available business and trade directories, industry association listings, and trade fair exhibitor and attendee listings. In these cases the categories of data collected are limited to name, job title, employer, business email address, and business telephone number.
Personal data is retained only as long and to the extent necessary for the original or compatible purposes for which it was collected.
The necessity of storing data is reviewed every 5 years from the start of the customer relationship; in any case, personal data will be deleted 5 years after the end of the customer relationship, provided all related obligations have been fulfilled. For example, accounting documents are retained for five years after the end of the fiscal year.
Contact details of potential customers who do not enter into a customer relationship are deleted no later than two years after collection, or immediately upon objection to direct marketing.
The controller regularly evaluates the necessity of data retention according to internal practices and ensures that inaccurate, incorrect, or outdated data is deleted or corrected promptly.
Personal data is not sold or disclosed to third parties for their own independent purposes.
Personal data is processed on the controller’s behalf by the service providers listed in Section 9, under data processing agreements concluded with each of them.
Personal data is processed on behalf of TP Silva Oy by the following service providers:
Some of these service providers are established outside the EU/EEA, mainly in the United States and Australia. Where personal data is transferred outside the EU/EEA, the transfer is based on the EU–US Data Privacy Framework where the recipient organisation is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses together with appropriate supplementary measures.
Materials containing personal data are stored in locked premises accessible only to designated and authorized personnel.
The database containing personal data is located on a server kept in a locked facility with appropriate firewall and technical protection.
Access to databases and systems is restricted to persons with separately granted personal usernames and passwords. Access rights are limited to individuals who need to process the data lawfully. System activities are logged.
Employees and other persons processing personal data are bound by confidentiality obligations.
Under the GDPR, data subjects have the following rights:
Requests regarding the exercise of data subject rights should be addressed to the contact person mentioned in Section 1.
The following services collect data about visits to the website, including IP address, device and browser information, and cookie identifiers. This data constitutes personal data. It is processed on the basis of consent given via the cookie banner, except where the processing is strictly necessary for the operation of the website.
Based on website visits, and where consent has been given via the cookie banner, we may engage in targeted advertising on the following platforms:
