PRIVACY POLICY OF DINOLIFT OY

Most recent update from 15.9.2026 relating to collection of personal data due to sanction regulations and KYC-process.

1. DATA CONTROLLER

Dinolift Oy, (3358988–6), Raikkolantie 145, FIN-32210 Loimaa

Please send any remarks concerning this privacy statement or other privacy-related issues to privacy@dinolift.com.

2. REASON AND LEGAL BASIS FOR DATA PROCESSING

We collect personal data for delivering our products and services, communicating with our customers, e-marketing, training, as well as sending newsletters and information, related to servicing and safety. The legal grounds for processing personal data are contractual relationship, legal requirements, consent from the data subject and legitimate interest (management of the contractual relationship, marketing, KYC-process).

Providing personal data is a prerequisite for creation of a contractual relationship and/or a customer relationship. Without the necessary personal data, the controller cannot deliver the product and/or the service.

Customer Due Diligence and Statutory Obligations (KYC)

Dinolift processes personal data for customer due diligence purposes (Know Your Customer, KYC) in order to comply with applicable anti-money laundering and counter-terrorist financing legislation, national and international sanctions regulations, and other statutory obligations.

In connection with customer due diligence, Dinolift may collect and process personal data for the following purposes:

Identifying the customer and the customer’s representative
Establishing the customer’s ownership and control structure, including beneficial owners
Complying with sanctions and restrictive measures regulations
Preventing and assessing risks related to money laundering, terrorist financing, or other forms of misuse

The legal basis for such processing is compliance with a legal obligation to which the controller is subject (Article 6(1)(c) of the General Data Protection Regulation) and, where applicable, the legitimate interest of the controller in preventing misuse and ensuring lawful business operations.

The information collected for customer due diligence purposes may include, among other things:

Identification details of the customer and its representatives
Information regarding beneficial owners
Personal data of members of management and governing bodies
Information relating to the customer’s countries of operation and ownership structure
Other information required by applicable legislation

Personal data is processed only to the extent necessary and for as long as required to fulfil statutory obligations. KYC information may be updated during the course of the customer relationship if the customer’s circumstances or applicable legal requirements change.

Customer Register: Customers of Dinolift

Keeping the Customer Register enables us to send our customers information about DINO products and services, technical bulletins, or other bulletins related to the machines or safety. Using the customer register also enables us to improve our services and/or our products by conducting customer satisfaction surveys. The customer satisfaction surveys are conducted either by email or by phone. The name and address of the company are used for delivering the machines or spare parts ordered for the machines and the related invoices. We obtain the customer data either from the order form or from the quote. Orders or quotes are received by phone, email or during an appointment. To know our customers and to comply with Finnish and international sanctions regulations, as well as to prevent money laundering and terrorist financing, we identify each customer and its owners, ultimate beneficial owners, board members and managing directors/CEOs.

Customer register: Potential customers of Dinolift

Keeping the register of potential customers enables Dinolift to send its customers useful information about the products and services of the company in newsletters. The information send to potential customers is based on the interest these have shown in Dinolift’s products or services by visiting the company’s website and submitting their email address.

DINO training register

The following personal data is collected from the trainee in connection with the training sessions on DINO products, either before (the background information required for planning of the training) and/or during the session. Personal data is collected to establish the level of expertise of the trainees in advance, and to enable delivering of the training certificates and the training material to the trainees. We may use the personal data for sending queries to persons, who have participated in the training courses to evaluate the content and quality of the training. We also send useful information, related to the technology of DINO, such as service instructions, technical bulletins or some other information, related to the maintenance and/or care of the product.

Extranet register

The extranet register contains important technical information such as, for example, spare part catalogues and user manuals for older machines, technical information, hydraulic and electric diagrams, pictures, maintenance instructions and other information, which may be important to the owner of the DINO machine or his/her representative (service personnel, fleet manager or other). Accessing the extranet requires login and the information is only visible to the logged in user.

The register of new DINO owners contains data of the new owner, listed in greater detail in the section below, in case the ownership of the lift has been transferred from one owner to another. The purpose of the collected data is to enable us to send the new owner technical bulletins concerning his/her machine, instructions for maintenance or any other instructions, which the new owner requires when servicing or maintaining his/her DINO lift. Personal data is also used for dispatching spare parts or other products or for performing services and sending invoices possibly resulting from these actions. The data on the new owner is added to the customer register.

MyDINO –service user register

Each Product manufactured after 1st of January 2023 incorporates MyDINO telematics solution enabled by remote access to the data collected by the equipment as specified more in detail in Supplier’s MyDINO service description (for more information www.dinolift.com/meet-mydino/)

3. RECIPIENTS AND CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA

The following information is entered in the customer register:

Name, address and business ID of the enterprise, responsible persons and possible credit information
Name, customer number, telephone number and email address of the customer, information about customer relationship (contracts, orders, correspondence, etc.) and possible electronic direct marketing ban
Customer’s direct or indirect private owner’s name, ownership and control percentage, date of birth, home country)
Information of customer’s managing director/CEO and board member(s) (name, nationality, date of birth)
Any other information necessary for managing the customer relationship, collected separately with the consent of the data subject.

The data of the candidates for the potential customer register is collected on the website.

Data to be collected:

Name, telephone number and email address of the customer
Company name, country and domain

The following data is collected in the DINO training register:

Name, company, email address
Training courses attended

The following data for the extranet register is collected on the website:

Name, telephone number, company, email address, IP-address
Country
Date of registration

The data collected for the new DINO owner register:

Name of the customer/company
Address, telephone number (not mandatory) and email address
The model and serial number of the DINO machine, the date when the machine was put into operation by the new owner, operating hours, possibly also picture of the machine (for possible theft, not mandatory)

The data collected for the MyDINO register:

When signing in to the MyDINO service following details are collected

User name ja contact details (email address and phone number)
Company name
Key ID / RF ID (if the information is given during the registration.

Logs are recorded when using the service.

We use cookies and similar technologies on our website and social media channels to build up and develop the website, to improve and analyse the user experience, and to target marketing in the services provided by us or our partners. The cookies allow us to collect information such as, for example, from which page the visitor enters our website, which pages of the site he/she is browsing, at what time does this happen and which browser is he/she using and what is the IP address of his/her computer. Please visit Dinolift’s Cookie Policy for more information on our cookie processing practice.

We use profiling to identify personal profiles and online behaviour of the visitors, for example, in targeting our marketing and developing our services.

4. SOURCE OF THE DATA

Customer register: Customers of Dinolift

We obtain data for the customer register from the order or the quote, from authorities, credit information agencies, providers of contact information services and other similar reliable sources.

In addition, personal data may be collected and updated for the purposes described in this privacy statement also from publicly available sources and on the basis of information received from authorities or other third parties, within the limits of applicable law. This data is updated manually.

Customer register: Potential customers of Dinolift

We collect data of potential customers for the customer register on our website, in connection with subscription to a newsletter or the DINO blog, from the contact form, or from the authorities, credit information agencies, providers of contact information services and other similar trusted sources.

DINO training register

We collect data for the DINO training register in connection with enrolling or participating in the course.

Extranet register

We collect data for the extranet register on our website in connection with logging in to the extranet.

We collect data for the new DINO owner register in connection with the purchase of a new DINO product.

MyDINO user register

Personal information is collected when the user registers to the service by using MyDino application or web browser.

5. TRANSFER OF DATA OUTSIDE TO A THIRD COUNTRY OR INTERNATIONAL ORGANISATION

Dinolift may transfer the personal data of the data subjects to third parties, including, for example, DINO dealers or DINO service partners, as well as the financial or legal counsels of the company, for a justified reason. Otherwise, Dinolift will not transfer the data to outside parties, unless required by law or obliged by an authority order.

Dinolift may also transfer personal data to subcontractors, who are acting on behalf of the company, and who have signed a contract with Dinolift (aka processors) also outside the European Union or the European Economic Area, in accordance with the legislation, by requiring the subcontractors to follow, for example, the standard contractual clauses, approved by the EU. Dinolift has outsourced a part of its IT services and the maintenance of its customer and marketing system to external service providers and personal data may be stored on servers administered by these partners.

6. PERIOD OF STORAGE OF DATA

Dinolift retains personal data in its customer register until it becomes aware that the customer relationship has expired and the rights and obligations associated with it have been completed. Subsequently, Dinolift may retain anonymised personal data, which cannot be combined with the data subject, discard the data, or transfer the data as permitted by law into the permanent direct marketing register. The company retains the data in the training register for 24 months after the end of the training course to identify those who have participated in the training during the past year. After that, the register will be deleted.

7. RIGHTS RELATED TO DATA PROCESSING

The data subject may at any time withdraw any consent given to Dinolift for electronic direct marketing or other purposes. The data subject may object to the use of his/her personal data for direct marketing purposes. The data subject has the right to access personal data concerning him/her that is stored in Dinolift’s registers and to receive a copy of the personal data being processed. The data subject has the right to request the rectification, erasure or completion of inaccurate or incomplete personal data.

In accordance with the General Data Protection Regulation (GDPR), the data subject has the right to object to the processing of personal data and to request restriction of processing. The data subject also has the right to receive personal data concerning him/her in a structured, commonly used and machine-readable format and to transmit those data to another controller where the processing is based on consent or a contract and is carried out by automated means. The data subject has the right to lodge a complaint with a supervisory authority regarding the processing of his/her personal data. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman.

8. TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

Any hard copies of the material are stored in a locked space, where only explicitly authorised persons are permitted to gain access.

Electronic material is protected by personal usernames and passwords, as well as by up-to-date, current security software and solutions. The firewall solution is enabled by default.

The low-level snapshot of our data systems is monitored through advanced software. Situational data collected from multiple sources is analysed in real time in one place, and alarms are generated of suspicious observations.

Our website is SSL-protected. Backups are stored in the EU or EEA area. Backups are encrypted before the transfer. All connections to the servers are encrypted, and a SSH key pair is used for logging in.

Dinolift monitors and takes into account applicable legislation relating to cybersecurity and the governance of digital systems, including the requirements of the Network and Information Security Directive (NIS2) and the European Union Artificial Intelligence Act (EU AI Act), to the extent that they are applicable to Dinolift’s operations and the systems in use.

Technical and organizational security measures, risk management practices, and the development and use of systems are based on a risk-based approach and are continuously improved, taking into account developments in legislation, regulatory guidance, and industry best practices.