Privacy Policy
How The Grand Game Deal campaign processes personal data.
Controller
The controller of the personal data in this campaign is Gigantti Oy Ab (business ID 1523846-8, Sanomatalo, Töölönlahdenkatu 2, 00100 Helsinki, Finland). Gigantti Oy Ab belongs to the Elkjøp Nordic AS group (org. no. 911 382 296), which manages Gigantti’s website together with Gigantti and may act as a joint controller as described in Gigantti’s general privacy notice. Gigantti’s general privacy notice (in Finnish): https://www.gigantti.fi/asiakaspalvelu/gigantti-tietosuojaseloste
Contact
For privacy matters you can contact Gigantti’s data protection officer at infosec@gigantti.fi or through the Customer Service page.
What data we process
When you upload your signed agreement: your email address, phone number, the photo of the agreement (which contains the parties’ names, signatures and any self-written trade-off), the chosen language, the time you accepted the rules, and a one-way identifier derived from your IP address to prevent misuse. If you win, we also ask you for your name, age, delivery address and phone number in order to deliver the prize. When you draft an agreement we store only anonymous statistics (number of agreements created and their level); the names typed into the agreement are not stored at that stage. The website hosting service may also record technical log data that is necessary for operating and securing the service (for example the IP address and the time of the request).
Source of data and whether you must provide it
The data comes from you. Providing your email address, phone number and the agreement photo is a requirement for entering the draw; without them your entry cannot be accepted. The winner must also provide the details needed to deliver the prize so that it can be handed over. The draw is open only to residents of Finland aged 18 or over. The photo of the agreement may also show the other signatory’s name and signature: make sure they know the photo is being sent and about this notice. Your personal data is not used for automated decision-making or profiling.
Why and on what basis
Running the draw, contacting the winner by email or phone, checking age and place of residence, delivering the prize, verifying entries and delivering the discount code: performance of the agreement on participation (Article 6(1)(b) GDPR). Preventing misuse and monitoring the campaign: legitimate interest (Article 6(1)(f) GDPR). Keeping the winner’s data needed for delivering the prize and for accounting: legal obligation (Article 6(1)(c) GDPR). Photos are used in marketing only after all personal data has been removed from them. The terms of use are set out in section 6 of the campaign rules.
Recipients and transfers
The data is not disclosed to third parties or used for direct marketing. The courier company delivering the prize receives the winner’s name, address and phone number for the delivery. Technical processing is carried out on Gigantti’s behalf by providers of website hosting and storage (Vercel Inc. and the database service delivered through it), whose servers are located in the European Union (Frankfurt, Germany). Data processing agreements under Article 28 GDPR are in place with the processors. Because the providers are US companies, access to the data from outside the EU may occur, for example in support situations; such transfers are based on the standard contractual clauses approved by the European Commission or another appropriate safeguard, and you can request a copy of the safeguards by contacting the details above.
Security and retention
Email addresses and phone numbers are stored encrypted, photos in private storage without public addresses, and access is limited to the people running the campaign and protected by passwords. Entry data is deleted within 30 days after the draw has closed and the prize has been handed over. The winner’s data needed for delivering the prize and for accounting is kept for the period required by law (accounting records generally for six years from the end of the financial year). Technical logs of the hosting service are deleted within a short time in accordance with the provider’s practices.
Cookies
The website does not set cookies and does not use tracking or marketing technologies, so visitors are not asked for cookie consent. The total number of page views is counted without identifying visitors or storing anything on your device: the counter records only the time and the language. The address of your agreement PDF is kept temporarily in the browser’s session storage so that you can reopen it; it is cleared when you close the tab.
Your rights
You have the right to access your data, request its rectification or erasure, restrict processing, object to processing based on legitimate interest and receive your data in a portable format. You can exercise your rights by contacting the details above; we reply within one month. If you ask us to delete your data before the draw, your entry can no longer take part. If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi, tietosuoja@om.fi, P.O. Box 800, 00531 Helsinki).