Privacy Notice

1. Controller and contact details

This notice explains how Jalonom Oy processes the personal data of its customers, contact persons of corporate customers and users of its website jalonom.com.

Data protection requests can be sent to the email address above or submitted at any of our service points.

2. Purposes and legal bases of processing

We process only the data needed for the purposes listed below. Each purpose has its own legal basis under Article 6 of the EU General Data Protection Regulation (GDPR).

Our legitimate interests are managing and developing customer relationships, improving the quality of our services, marketing to existing customers, protecting our business against fraud and handling legal claims. We have assessed that these interests do not override the rights of data subjects. You can object to processing based on legitimate interest (section 12).

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

3. Personal data processed

We process Finnish personal identity codes under section 29 of the Finnish Data Protection Act (1050/2018), because unambiguous identification of the customer is required by the Anti-Money Laundering Act.

We do not collect special categories of personal data, such as health data. CCTV at our service points is described in a separate notice.

4. Sources of data

We obtain data mainly from customers themselves: at service points, in the online store, through forms, by email, by phone and through social media. Identity document data is recorded from the document presented by the customer. Data on representatives and beneficial owners of corporate customers is obtained from the corporate customer and the beneficial ownership register.

We also obtain data from the following sources:

• the Trade Register and beneficial ownership register (Finnish Patent and Registration Office, PRH), the LEI register and other public company registers
• sanctions and PEP lists through Signicat's screening service
• strong electronic identification with online banking credentials through Signicat
• website marketing cookies and advertising tools, if you have consented to them

5. Whether providing data is mandatory

Providing identification and customer due diligence data is a statutory requirement for trading. Without it, we cannot buy or sell precious metals or provide storage services. Contact and billing details needed to deliver an order are a contractual requirement. Providing data related to marketing and cookies is voluntary, and refusing does not affect your dealings with us.

6. Recipients and processors

We do not sell personal data. Data is disclosed only to the parties described below.

Authorities. We disclose data when required by law, for example to the Finnish Tax Administration, the police, the Finnish Financial Intelligence Unit and supervisory authorities.

Processors. We use service providers that process data on our behalf and according to our instructions. Agreements in line with Article 28 GDPR have been concluded with them.

Advertising platforms. Meta (Facebook and Instagram), Google (including YouTube) and LinkedIn receive cookie data for ad targeting based on your consent. They partly act as independent controllers, and their own privacy policies apply to their processing.

Other situations. Data may be disclosed to handle legal claims and, in connection with a business acquisition or transfer, to a buyer who continues the customer relationship.

7. Transfers outside the EU and EEA

As a rule, we process data in the EU and EEA. The customer register and online store are located in Belgium. Some service providers (Google, Meta and LinkedIn) may process data in the United States or other countries outside the EU. In addition, Odoo's support staff may, where necessary, process data from offices outside the EU to resolve support requests.

Transfers rely on safeguards under the GDPR:

• to the United States, to companies certified under the EU–US Data Privacy Framework
• in other cases, the standard contractual clauses approved by the European Commission or a Commission adequacy decision

Google and Meta are certified under the EU–US Data Privacy Framework. Transfers by LinkedIn and Odoo rely on the European Commission's standard contractual clauses. You can obtain more information on the safeguards using the contact details in section 1.

8. Retention periods

We retain data only as long as necessary for the purpose or as required by law. After that, the data is deleted or anonymised.

9. Profiling and automated decision-making

With your consent, we profile customers to target marketing, for example based on previous purchases and website use. We also assess customer relationship risk as required by the Anti-Money Laundering Act.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Decisions are always made by a person.

10. Cookies

Without consent, we use only cookies that are strictly necessary for the website to function. Other cookies are activated only after you have accepted them in the cookie banner (Finnish Act on Electronic Communications Services 917/2014, section 205).

We collect visitor statistics with Plausible. It does not use cookies, does not store data on your device and does not identify individual visitors. The statistics are aggregate data and are processed in the EU.

You can accept or reject cookie categories separately. You can use the website even if you reject marketing cookies. You can change your choices at any time from the cookie settings at the bottom of the website.

Privacy policies of the service providers: Google, Meta, LinkedIn, Plausible.

11. Information security

We protect data with technical and organisational measures. Access to data is limited to persons who need it for their work, and they are bound by confidentiality. Systems are accessed with personal credentials, data traffic is encrypted and access rights are monitored. If a data breach is likely to result in a high risk to you, we will notify you without undue delay.

12. Your rights and right to lodge a complaint

Under the GDPR, you have the following rights:

• Right of access: to know what data about you is processed and to receive a copy of it
• Rectification: to have inaccurate data corrected and incomplete data completed
• Erasure: to have your data deleted, unless the law requires us to retain it
• Restriction of processing in certain situations
• Data portability: to receive the data you have provided in a machine-readable format when processing is based on consent or contract
• Withdrawal of consent at any time

Right to object. You can object to processing based on legitimate interest on grounds relating to your particular situation. You can opt out of direct marketing and related profiling at any time without giving reasons, for example via the unsubscribe link in the newsletter or by contacting us.

The Anti-Money Laundering Act restricts some rights. For example, we cannot delete statutory identification data before the retention period ends, and the right of access does not cover all data processed to prevent money laundering.

Send your request to asiakaspalvelu@jalonom.fi or submit it at one of our service points. We may ask you to verify your identity. We respond within one month. This may be extended by up to two months if the request is extensive, in which case we will inform you.

Right to lodge a complaint. If you believe we process your data unlawfully, you can lodge a complaint with the data protection authority in the EU country where you live or work, or with the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi.

13. Changes to this notice

We update this notice when our operations or legislation change. The current version is always available on our website. We will inform our customers separately of material changes, such as new purposes of processing.

This notice was last updated on 10 October 2026.