Privacy notice
Customer and order register of Silver Trade Hub Oy
Drawn up 17 September 2026 · updated 15 October 2026 · version 1.5
This notice explains what personal data Silver Trade Hub Oy processes about its customers and their contact persons, what the data is used for and what rights each person has. The notice covers the ordering platform at masaro.fi, the company's enterprise resource planning system and the contact details collected in sales work.
The notice has been drawn up in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (2016/679). Our customers are businesses, but data about a company's contact person is personal data. Data about a sole trader is also personal data.
The notice is available in Finnish and English. All language versions have the same content.
1 Controller
| Item | Details |
|---|---|
| Controller | Silver Trade Hub Oy |
| Business ID | 3618531-8 |
| Visiting address | Vihikari 10, 90440 Kempele, Finland |
| Contact person for data protection | Jouni Pitkänen, CEO |
| info@masaro.fi |
- Controller
- Silver Trade Hub Oy
- Business ID
- 3618531-8
- Visiting address
- Vihikari 10, 90440 Kempele, Finland
- Contact person for data protection
- Jouni Pitkänen, CEO
- info@masaro.fi
Silver Trade Hub Oy also provides the ordering platform to the companies in its group. For customers doing business in Norway and Spain, the controller is the group company of that country: in Spain SILVERTRADE SPAIN 2026, S.L. and in Norway SILVERTRADE NORGE AS (organisation number 920 223 001). Silver Trade Hub Oy processes this data on behalf of the group company, and in all countries data protection matters can be sent to the same address.
The company has not appointed a data protection officer. There is no obligation to appoint one, as the company is not a public authority and its core activities do not consist of large-scale regular monitoring of individuals or processing of special categories of personal data.
2 What data is processed
| Data category | Content |
|---|---|
| Basic company details | trade name, legal form, business ID, visiting and delivery address, billing address, e-invoicing address |
| Contact person details | name, position, email address, phone number, language of service |
| Ordering settings of the premises | delivery days, receipt of order reminders, product requirements that limit the range, such as halal products |
| Contract details | accepted terms and their version, electronic signature details: signatory's name, email address, time and IP address |
| User details | username, password hash, user role, account status, login times |
| Order details | products and quantities ordered, order and delivery dates, saved order templates, order status, messages attached to orders |
| Financial and payment details | invoices, payments, payment delays, granted credit limit and its use, the order's payment method, the invoice payment term, payment term surcharge, due date and payment date, prepayment invoice reference numbers, customer-specific discounts and annual rebates |
| Credit limit review | order and payment figures calculated every six months (number and value of orders, payment methods, invoices paid on time and late, length of delays, open and overdue invoices, credit limit utilisation), the suggestion based on them, the decision with its reasoning, who made it and when, the credit limit change history, and the staff member responsible for the customer relationship |
| Service interaction details | account requests, contact form messages, email correspondence, notes from calls and visits |
| Invoice comparison material | an image or file of a wholesale invoice sent by the customer, together with the sender's company, contact person, phone number, email address, country, free-text message and the time of consent |
| Purchase documents from sales visits | wholesaler invoices, order confirmations and delivery notes photographed or saved with the customer's permission during a sales visit, and the supplier name, document date, products, quantities and prices read from them. A document may show the name of the customer's contact person or of the supplier's representative. |
| Marketing details | marketing consent or opt-out and its date |
| Technical details | event logs, change history, the source of an order, for example the identification code on a package, delivery details of text messages and emails sent |
- Basic company details
- trade name, legal form, business ID, visiting and delivery address, billing address, e-invoicing address
- Contact person details
- name, position, email address, phone number, language of service
- Ordering settings of the premises
- delivery days, receipt of order reminders, product requirements that limit the range, such as halal products
- Contract details
- accepted terms and their version, electronic signature details: signatory's name, email address, time and IP address
- User details
- username, password hash, user role, account status, login times
- Order details
- products and quantities ordered, order and delivery dates, saved order templates, order status, messages attached to orders
- Financial and payment details
- invoices, payments, payment delays, granted credit limit and its use, the order's payment method, the invoice payment term, payment term surcharge, due date and payment date, prepayment invoice reference numbers, customer-specific discounts and annual rebates
- Credit limit review
- order and payment figures calculated every six months (number and value of orders, payment methods, invoices paid on time and late, length of delays, open and overdue invoices, credit limit utilisation), the suggestion based on them, the decision with its reasoning, who made it and when, the credit limit change history, and the staff member responsible for the customer relationship
- Service interaction details
- account requests, contact form messages, email correspondence, notes from calls and visits
- Invoice comparison material
- an image or file of a wholesale invoice sent by the customer, together with the sender's company, contact person, phone number, email address, country, free-text message and the time of consent
- Purchase documents from sales visits
- wholesaler invoices, order confirmations and delivery notes photographed or saved with the customer's permission during a sales visit, and the supplier name, document date, products, quantities and prices read from them. A document may show the name of the customer's contact person or of the supplier's representative.
- Marketing details
- marketing consent or opt-out and its date
- Technical details
- event logs, change history, the source of an order, for example the identification code on a package, delivery details of text messages and emails sent
The register does not contain personal identity numbers, payment card numbers or special categories of personal data referred to in Article 9 of the GDPR. The fact that a restaurant orders only halal products is an ordering setting of the premises and is used only to limit the product range. No conclusions are drawn from it about the beliefs of the customer or its contact person. The language of service tells which language the service is used in and says nothing about a person's origin.
3 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling account requests and approving customers | steps prior to entering into a contract, Article 6(1)(b) |
| Concluding the customer contract and verifying the electronic signature | performance of a contract and legitimate interest in proving that the contract was concluded, Article 6(1)(b) and (f) |
| Receiving and delivering orders and customer service | performance of a contract, Article 6(1)(b) |
| Order reminders by text message and email on agreed ordering days | performance of a contract, Article 6(1)(b) |
| Invoicing, payment monitoring and debt collection | performance of a contract and legitimate interest in collecting receivables, Article 6(1)(b) and (f) |
| Bookkeeping and retention of vouchers | legal obligation, Article 6(1)(c), Finnish Accounting Act |
| Food traceability and recalls | legal obligation, Article 6(1)(c), food legislation |
| Granting credit limits and invoice payment terms and assessing credit risk | steps prior to entering into a contract and legitimate interest in limiting credit losses, Article 6(1)(b) and (f) |
| Regular review of the credit limit based on order and payment history | performance of a contract and legitimate interest in managing credit risk, Article 6(1)(b) and (f) |
| Preparing a price comparison from an invoice sent by the customer | consent given by the person, Article 6(1)(a) |
| Managing the customer relationship and sales work | legitimate interest, Article 6(1)(f) |
| Comparing the customer's current purchase prices during a sales visit, based on purchase documents | legitimate interest, Article 6(1)(f) |
| Electronic direct marketing to legal entities | legitimate interest, Article 6(1)(f) |
| Electronic direct marketing to sole traders | the person's prior consent, Article 6(1)(a), or an existing customer relationship to the extent permitted by law |
| Ensuring the service works, preventing misuse and information security | legitimate interest, Article 6(1)(f) |
- Handling account requests and approving customers
- steps prior to entering into a contract, Article 6(1)(b)
- Concluding the customer contract and verifying the electronic signature
- performance of a contract and legitimate interest in proving that the contract was concluded, Article 6(1)(b) and (f)
- Receiving and delivering orders and customer service
- performance of a contract, Article 6(1)(b)
- Order reminders by text message and email on agreed ordering days
- performance of a contract, Article 6(1)(b)
- Invoicing, payment monitoring and debt collection
- performance of a contract and legitimate interest in collecting receivables, Article 6(1)(b) and (f)
- Bookkeeping and retention of vouchers
- legal obligation, Article 6(1)(c), Finnish Accounting Act
- Food traceability and recalls
- legal obligation, Article 6(1)(c), food legislation
- Granting credit limits and invoice payment terms and assessing credit risk
- steps prior to entering into a contract and legitimate interest in limiting credit losses, Article 6(1)(b) and (f)
- Regular review of the credit limit based on order and payment history
- performance of a contract and legitimate interest in managing credit risk, Article 6(1)(b) and (f)
- Preparing a price comparison from an invoice sent by the customer
- consent given by the person, Article 6(1)(a)
- Managing the customer relationship and sales work
- legitimate interest, Article 6(1)(f)
- Comparing the customer's current purchase prices during a sales visit, based on purchase documents
- legitimate interest, Article 6(1)(f)
- Electronic direct marketing to legal entities
- legitimate interest, Article 6(1)(f)
- Electronic direct marketing to sole traders
- the person's prior consent, Article 6(1)(a), or an existing customer relationship to the extent permitted by law
- Ensuring the service works, preventing misuse and information security
- legitimate interest, Article 6(1)(f)
Where processing is based on legitimate interest, the company's interest is to manage the customer relationship, to market its products to food service businesses and to protect its assets. Processing is limited to data related to the contact person's work, and it involves no monitoring of private life. A person has the right to object to processing based on this ground as set out in section 9.
Order reminders are part of the ordering service, not marketing. The customer can switch them off in the ordering platform settings.
The invoice comparison is based on consent given on the form before sending. The invoice is used only to prepare the comparison and is not shown to other customers, suppliers or outsiders. Consent can be withdrawn at any time, after which the invoice and the related details are deleted. Withdrawal does not affect the lawfulness of processing carried out before it.
Electronic direct marketing is handled differently depending on the recipient. Marketing messages may be sent to a limited company or other legal entity unless it has opted out. Marketing to a sole trader requires prior consent, as the recipient is a natural person. The exception is a customer whose contact details were obtained in connection with a sale: such a customer may receive marketing for our own similar products, provided they are told how to opt out. Every marketing message explains how to opt out free of charge.
During a sales visit the customer may show a wholesaler invoice or other purchase document so that its prices can be compared with Masaro's offer. An image of the document is saved only with the customer's permission. An AI service reads the product rows and prices from the document as a suggestion. The salesperson checks every row before it is used. Only the data needed for the price comparison is used.
The customer's credit limit is reviewed every six months. The ordering platform calculates figures from the previous six months' orders and payments, such as how many invoices were paid on time, and uses them to suggest raising, keeping or lowering the limit. The suggestion is sent to the staff member responsible for the customer relationship. The suggestion does not change the credit limit; the limit is always decided by a person. The review uses only the company's order and payment data. No new data is obtained from other sources, and no conclusions are drawn about the contact person's personal finances. For a sole trader, however, the data is personal data, and the rights in section 9 apply, including the right to object to the processing.
4 Where the data comes from
Data is obtained primarily from the customer: from the account request form, during onboarding, from the contact form, from the invoice comparison form, from orders, email, phone calls and sales visits, including purchase documents the customer shows during a sales visit.
Data is also obtained from public sources and authorities: the Finnish Business Information System, the Trade Register, the VAT register, municipal food control registers, companies' own websites and public business directories. Credit information is obtained from a credit reference agency when a credit limit is being considered for a customer.
When contact details have been obtained from someone other than the person, the person is informed of the processing at the latest at the first contact and no later than one month after the data was obtained.
5 Who the data is disclosed to
Personal data is not sold or disclosed to third parties for marketing purposes. The following service providers process data on the company's behalf under a data processing agreement in accordance with Article 28 of the GDPR.
| Service | Role in processing |
|---|---|
| Ordering platform development and maintenance | providing, maintaining and troubleshooting the online service |
| Database and hosting service | storage of order and user data, authentication, backups |
| Enterprise resource planning system provider | customer relationship management, pricing, invoicing, inventory management |
| Email and file service | communication and the storage of documents and files sent for invoice comparison |
| Outgoing application email service | order confirmations and system messages |
| Text message service | order reminders |
| Electronic signature service | signing customer contracts |
| AI-based document reading service | reading product rows and prices from purchase documents saved during sales visits |
| E-invoicing operator | invoice delivery |
| Accounting firm | bookkeeping and accounts receivable |
| Transport and warehouse partners | handling deliveries |
| Debt collection agency | collection of overdue receivables |
- Ordering platform development and maintenance
- providing, maintaining and troubleshooting the online service
- Database and hosting service
- storage of order and user data, authentication, backups
- Enterprise resource planning system provider
- customer relationship management, pricing, invoicing, inventory management
- Email and file service
- communication and the storage of documents and files sent for invoice comparison
- Outgoing application email service
- order confirmations and system messages
- Text message service
- order reminders
- Electronic signature service
- signing customer contracts
- AI-based document reading service
- reading product rows and prices from purchase documents saved during sales visits
- E-invoicing operator
- invoice delivery
- Accounting firm
- bookkeeping and accounts receivable
- Transport and warehouse partners
- handling deliveries
- Debt collection agency
- collection of overdue receivables
Customer data is processed within the group to the extent needed to serve the customer, for example when a delivery is shipped from a warehouse in another country. Data may also be disclosed to authorities when required by law, for example to food control authorities in a recall or to the tax authorities.
6 Data location and transfers outside Europe
Personal data is kept within the European Union or the European Economic Area whenever the service allows it. Norway is part of the European Economic Area, so processing data in Norway is not a transfer outside Europe.
Some of the software services we use are American or use subcontractors outside Europe. In these cases the transfer is based on the standard contractual clauses approved by the European Commission or on the EU–U.S. Data Privacy Framework.
The company keeps a list of the processors it uses and the regions where data is located. The list is provided on request.
7 Retention periods
| Data | Retention period | Reason |
|---|---|---|
| Account request that does not lead to a customer relationship | 12 months after the request is handled | possible later contact and proof of handling |
| Contact form message | 24 months | continuity of customer service |
| Invoice sent for comparison and the related contact details | 12 months after the comparison is delivered | proof of the comparison and possible later contact |
| Sales contact that does not lead to a customer relationship | 24 months after the last contact | continuity of sales work |
| Purchase documents from sales visits and the data read from them | 24 months from saving | verifying the price comparison and continuity of sales work |
| Customer's basic details, contact persons and ordering settings | for the duration of the customer relationship and 24 months after the last order | managing the customer relationship |
| Signed customer contract and signature details | 6 years after the contract ends | proof of the contract and of receivables based on it |
| Order, delivery and invoicing data | 6 years from the end of the year in which the financial period ended | Finnish Accounting Act |
| Traceability data on delivered batches | at least one year after dispatch; in an approved food establishment two years after the last date of use | food legislation |
| Credit and collection data | 6 years after the receivable ends | limitation of receivables and bookkeeping |
| Credit limit reviews and credit limit change history | for the duration of the customer relationship and 24 months after it ends | verifying credit decisions and assessing a possible new customer relationship |
| User accounts and access rights | for as long as the access right is valid | use of the service |
| Usage and change logs and message delivery data | 12 months | information security and investigating misuse |
| Marketing opt-outs | until further notice | the opt-out can only be respected if it is kept |
- Account request that does not lead to a customer relationship
- Retention period: 12 months after the request is handled
- Reason: possible later contact and proof of handling
- Contact form message
- Retention period: 24 months
- Reason: continuity of customer service
- Invoice sent for comparison and the related contact details
- Retention period: 12 months after the comparison is delivered
- Reason: proof of the comparison and possible later contact
- Sales contact that does not lead to a customer relationship
- Retention period: 24 months after the last contact
- Reason: continuity of sales work
- Purchase documents from sales visits and the data read from them
- Retention period: 24 months from saving
- Reason: verifying the price comparison and continuity of sales work
- Customer's basic details, contact persons and ordering settings
- Retention period: for the duration of the customer relationship and 24 months after the last order
- Reason: managing the customer relationship
- Signed customer contract and signature details
- Retention period: 6 years after the contract ends
- Reason: proof of the contract and of receivables based on it
- Order, delivery and invoicing data
- Retention period: 6 years from the end of the year in which the financial period ended
- Reason: Finnish Accounting Act
- Traceability data on delivered batches
- Retention period: at least one year after dispatch; in an approved food establishment two years after the last date of use
- Reason: food legislation
- Credit and collection data
- Retention period: 6 years after the receivable ends
- Reason: limitation of receivables and bookkeeping
- Credit limit reviews and credit limit change history
- Retention period: for the duration of the customer relationship and 24 months after it ends
- Reason: verifying credit decisions and assessing a possible new customer relationship
- User accounts and access rights
- Retention period: for as long as the access right is valid
- Reason: use of the service
- Usage and change logs and message delivery data
- Retention period: 12 months
- Reason: information security and investigating misuse
- Marketing opt-outs
- Retention period: until further notice
- Reason: the opt-out can only be respected if it is kept
When the retention period ends, the data is deleted or converted into a form from which the person cannot be identified. Order history may be kept without identifying details for statistics and business monitoring. Product and price data read from purchase documents is kept without information about the customer or individuals, in order to monitor price levels.
8 Data security
The data is held in electronic systems that can only be accessed with a personal user account. No paper customer registers are kept.
The basic principles of protection are:
- access is granted only to the extent required by the person's work and removed as soon as the task ends
- administrator accounts use two-factor authentication
- access rights are checked in the database, not only in the user interface
- customers see only their own company's data, and pricing and margin data is separated from the customer view
- data traffic is encrypted, and the database is backed up daily and exported weekly into the company's own custody
- changes to access rights are logged
- all processors have a written data processing agreement and staff are bound by confidentiality
Personal data breaches are reported to the Finnish Data Protection Ombudsman within 72 hours and to the data subject without undue delay when required by law.
9 Your rights
A person has the right to
- know whether their data is being processed and receive a copy of it
- have inaccurate data corrected
- have data erased when there is no longer a basis for processing it
- have processing restricted while the accuracy of the data is being checked
- object, on grounds relating to their particular situation, to processing based on legitimate interest
- opt out of direct marketing at any time without giving a reason
- withdraw consent they have given
- receive the data they have provided on the basis of a contract or consent in a machine-readable format
The right to erasure does not apply to data that must be kept by law, such as accounting records and food traceability data.
Requests are sent to info@masaro.fi in Finnish or English. The requester's identity is verified before any data is disclosed. A reply is given within one month. If a request is exceptionally extensive, the deadline may be extended by two months, and the requester is informed of this.
10 Automated decision-making
The company does not make decisions about individuals based solely on automated processing. The ordering platform may suggest an order based on previous orders or a saved order template, but the order is only sent once the customer has confirmed it. Decisions on account requests and on granting, changing and withdrawing credit limits are always made by a person. The suggestion from the six-monthly credit limit review supports the decision and does not change the limit by itself. The data an AI service reads from a purchase document is a suggestion that the salesperson checks, and no decisions about individuals are made on the basis of it.
In line with the contract terms, the ordering platform offers invoice as a payment method only when the customer has been granted a credit limit, some of it remains and the customer has no overdue invoices. This is the application of agreed terms, not an assessment of the customer. The customer can always pay for an order with Pay now.
11 Right to lodge a complaint
If a person considers that their data has been processed in breach of data protection law, they may lodge a complaint with a supervisory authority.
In Finland the supervisory authority is the Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, postal address P.O. Box 800, 00531 Helsinki, switchboard +358 29 566 6700, email tietosuoja@om.fi. A complaint may also be lodged with the supervisory authority of the country where the person lives or works: in Norway Datatilsynet and in Spain the Agencia Española de Protección de Datos.
12 Changes to this notice
This notice is updated when the service or the processing changes. The latest version is always available at masaro.fi/tietosuoja. Customers are informed of material changes by email or on the ordering platform.