Last updated and effective date: Feb 22 2024

1. DATA CONTROLLER AND CONTACT INFORMATION

Karoo Oy
Business ID: 3178653-6
Address: Appiukontie 14, 40530 Jyväskylä, Finland
Email: privacy@karoocamper.com

2. GENERAL

This privacy notice describes how Karoo Oy (hereinafter also referred to as ”Karoo” or “we”)
processes the personal data of its customers and subscribers, representatives of our retailers
and other possible business partners, job applicants and the users of our website (hereinafter
referred to as “data subject” or “you”).

All our personal data processing activities are conducted in accordance with the General Data
Protection Regulation (EU 2016/679, hereinafter “GDPR”) and other applicable Finnish data
protection laws.

If you have any questions relating to the processing of your personal data or exercising your
rights, feel free to contact us using the aforementioned contact information.

3. CATEGORIES OF PERSONAL DATA

We process the following categories of personal data:

  • Name and contact information, e.g. address, email address, phone number;
  • Information collected through customer service;
  • Invoicing and payment information and order history;
  • Consents and opt-outs given by you relating to direct marketing;
  • Information collected via cookies used on our website, e.g. IP-address, operating system and other information collected by cookies (see more below “Use of cookies” and from the cookie banner displayed on the website);
  • Regarding job applicants, information related to the recruitment, e.g. CV, job application, other information collected during the recruitment process.

We collect personal data mainly directly from you, for example when you fill up your information to the order form on our website. Additionally, we may obtain data from publicly available third-party sources, like companies offering contact data, public trade registers or credit rating agencies.

With your consent, we also collect personal data regarding the use of our website with the help of cookies used on the website.

Providing personal data is not required by law or contract. However, certain personal data is required in order to provide our products or services.

4. PURPOSES AND LEGAL BASES FOR PROCESSING

We use personal data for the following purposes:

  • To provide you our products and services;
  • To market and develop our business, products, services and/or brands;
  • To enable and to analyze the use of our website and to target marketing;
  • To correspond with you and to provide you with information concerning our products and services and to track the way you respond to our correspondence;
  • To recruit employees;
  • To comply with legal obligations, such as the Finnish Accounting Act.

We do not use your personal data for automated decision making, including profiling.

The legal bases for the processing of personal data are the following:

  • Performance of a contract which is made with the data subject, e.g. when we provide our products and services to consumers and maintain customer relationships with them;
  • Karoo’s legitimate interest (the operation and development of our business), e.g. when we provide our products and services to businesses or use personal data to develop and market our products, business and/or brands;
  • Karoo’s legitimate interest (the transmission of a message in the communication network and ensuring information security) when enabling and ensuring the use and functionality of our website;
  • Your consent, e.g. when you subscribe to our newsletter or when you accept the use of non-essential cookies on our website;
  • Karoo’s legal obligations, e.g. when we store your personal data as a part of our statutory accounting material.

5. DISCLOSURE OF THE PERSONAL DATA

We do not, as a rule, disclose your information to third parties. Personal data may be
disclosed to authorities when required by law or by the order of a competent court or authority.
Personal data may also be disclosed to our business partners, e.g. workshops and finance
and leasing companies, only when it is necessary, for example to organize finance or leasing
plan relating to our product.

We use external service providers, i.e. data processors, who process personal data on our
behalf for the purposes described in this privacy notice. These service providers, such as the
providers of technical services used by us, may use personal data only as instructed by us
and only for the purposes for which the data has been gathered. The data processors do not
have the right to use the personal data disclosed by us for their own purposes.

6. TRANSFERS OF PERSONAL DATA OUTSIDE EU OR EUROPEAN ECONOMIC AREA

We do not, as a rule, transfer the personal data outside European Union (“EU”) or European
Economic Area (“EEA”).

However, some of our data processors or their sub-processors are located outside EU or EEA.
In such cases, we ensure the level of data protection by ensuring that the European
Commission has adopted an adequacy decision concerning the target country in question, or
by requiring the data processor to accept the Standard Contractual Clauses approved by the
European Commission to be part of the data processing agreement between us and the data
processor.

7. STORAGE OF THE PERSONAL DATA

We store your personal data only as long as and to the extent that it is necessary for the
aforementioned purposes:

  • Customer relationships: Client information, e.g. information concerning product reservations and orders, shall be stored for two (2) years from the last date when the customer relationship was regarded as being active. This period includes, but is not limited to, the following:
    • the ordering and delivery of the product or service in question;
    • warranty period, if applicable; and
    • the processing of possible claims.
  • Marketing purposes: Personal data shall be stored for two (2) years from your latest contact with us, unless the processing is based on your consent, in which case the personal data shall be stored until you withdraw your consent.
  • Recruitment: Job applications and any other information collected during the recruitment process shall be stored until two (2) year has passed since the submission of an open application or the filling of a designated position.
  • Legal Obligations: Personal data included in accounting materials shall be stored for ten (10) years from the end of the relevant financial year.

8. USE OF COOKIES ON KAROO’S WEBSITE

We use cookies or cookie-like technologies to enable the use of our website and to ensure the
functionality of the website. Additionally, with your consent, we use cookies to analyze website
traffic and your behavior and to target marketing and advertising.

Cookies are typically small text files, which can identify your device. Cookies do not harm your
devices or files. We are not able to personally identify you by using cookies.

Managing the use of cookies:

Cookies that we use are described in the cookie banner displayed on our website. You can
manage the use of cookies on our website from the cookie banner displayed on the website or
from the floating bar with cookie icon situated on the bottom of our website. You can change or
modify your cookie preferences or withdraw your consent from the cookie banner or from the
link ”Manage cookie settings” any time you want.

Non-necessary cookies are not used unless you have specifically agreed to it. Please note
that we may not be able to provide you certain products or services and you may not be able
to see certain parts of the website if you don’t accept all cookies.

Please note that by accepting the use of the cookies relating to analytics and/or advertising
you accept that your personal data may be transferred outside of EU or EEA, which may
cause risks to your privacy.

Our website contains links and embeddings to third party websites, such as social media
platforms. Please note, that we are not responsible for the data protection of such sites.

9. YOUR DATA PROTECTION RIGHTS

You may use your rights described herein this section 9 by contacting us via email to
privacy@karoocamper.com.

We will notify you the actions taken based on your request within one month of receiving the
request. The using of these rights is generally free of charge.

Please note that before taking action based on your request, we have the right and obligation
to verify your identity. Please also note that we may refuse to fulfil your request based on the
applicable data protection legislation.

9.1. Right to Access Personal Data

You have the right to receive confirmation regarding whether we process your personal data or
not. You may also ask information about the processing of your personal data, and you have
the right to receive a copy of your personal data being processed by us.

9.2. Right to Rectification and Erasure of Personal Data

You have the right to request that inaccurate, erroneous or incomplete personal data
concerning you is rectified or supplemented.

You have the right to request the erasure of your personal data if said personal data is no
longer required for the purposes for which it was collected. Please note that we are not able to
erase your personal data in all situations if we have a legal obligation or other lawful basis to
store the data.

9.3. Right to Restrict the Processing of Personal Data

You have the right to restrict the processing of your personal data in certain situations, e.g. if
you have contested the accuracy of your personal data and we are reviewing the accuracy of
said personal data.

9.4. Right to Object to the Processing of Personal Data

You have the right to object to the processing of personal data when processing is based on
our legitimate interest. In such cases we shall no longer process the said personal data,
unless we can demonstrate that there are compelling legitimate grounds for the processing
which override your interests, rights and freedoms.

You may at any time object to the processing of your personal data for direct marketing
purposes.

9.5. Right to Withdraw Consent

If the processing of your personal data is based on your consent, you are entitled to withdraw
your consent at any time.

9.6. Right to Data Portability

If the processing of your personal data is based on your consent or the performance of a
contract, you have the right to receive such personal data which you have provided to us in a
structured, commonly used and machine-readable format and have the right to transmit this
data to another controller.

9.7. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with your national data protection supervisory authority
(in the EU region) if, in your opinion, we do not process your personal data accordingly or fulfil
your data protection rights in a sufficient manner.

In Finland, you can lodge a complaint with the office of the Data Protection Ombudsman using
the following link: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman.

You can find the other EU national data protection authorities using this link:
https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. AMENDING AND UPDATING THE PRIVACY NOTICE

Karoo is continuously developing its activities and may therefore be required to amend and
update this privacy notice when necessary. The amendments may also be based on changes
in relevant legislation.

If the amendments or updates include substantial changes in the way we process your
personal data, we will notify you directly.

This privacy notice was last updated on 08/02/2024.