Privacy Policy

Partners, other stakeholder representatives, website visitors

1. General

This privacy notice describes how Suomen Voima Oy (the “Data Controller”) processes personal data, what personal data is collected, for what purposes personal data is processed, to whom personal data may be disclosed, and how you can influence the processing of your personal data. The privacy notice also provides information on the obligations that are complied with when processing personal data.

This privacy policy applies to the provision of services by Suomen Voima Oy:the provision of its services and the processing of personal data in connection with those services, as well as the processing of personal data relating to representatives of partners and other stakeholders. This Privacy Policy also applies to the processing of personal data of website visitors on the basis of consent.

The data controller complies with data protection legislation when processing personal data. Data protection legislation refers to the data protection legislation in force, such as the European Union’s General Data Protection Regulation (2016/679) (‘the GDPR’), the national Data Protection Act (5 December 2018/1050), and the guidelines and regulations issued by the supervisory authority. Any data protection-related terms not defined in this privacy notice shall be interpreted in accordance with data protection legislation.

2. Name of the register

A register of Suomen Voima Oy’s partners and representatives of other stakeholders, as well as other visitors to the website.

3. Contact details for matters relating to the register

suomenvoima@suomenvoima.fi

4. Data content of the register

The register processes the personal data of Suomen Voima Oy’s partners, representatives of other stakeholders and visitors to its website.

The following personal data is subject to processing:

  • Name

  • Contact details, such as a telephone number and email address

  • IP addresses

  • Service passwords (not in plain text)

  • Location details (country and town)

  • Browser

  • Operating system

5. The purpose of processing personal data and the legal bases

The data controller or a partner authorised by it (acting on behalf of the data controller) shall use the personal data in the register in accordance with data protection legislation for the following purposes:

  • Establishing, maintaining, developing and marketing collaborative relationships

  • Provision, delivery and production of services

  • Contract management and invoicing

The data controller is entitled to process personal data on the following grounds:

  • On the basis of the data subject’s consent: the data subject has given their consent to the processing of their personal data.

  • On the basis of a contract: the conclusion and performance of a contract between the data controller and a partner or a representative of another stakeholder.

  • On the basis of legitimate interest: the data controller has a legitimate interest in using personal data to develop services and to market products and services, subject to the conditions and restrictions laid down in legislation.

6. Standard sources of information

Data is obtained from representatives of partners and other stakeholders, for example in connection with requests for quotations, orders, contracts and other contacts. Data is also collected directly from data subjects (website visitors) themselves.

Data is also collected using cookies and similar technologies in accordance with the procedures permitted under the regulations in force at any given time.

7. Cookies

The website collects only non-personally identifiable information about its use, which is stored in the log files of the website’s hosting service.

8. Data processors and other recipients

As a general rule, personal data is not disclosed to third parties. Data may be transferred to Suomen Voima Oy’s partners for processing for the purposes set out in section five.

9. Transfer of data outside the EU or the EEA

Personal data will not be transferred outside the EU or the EEA.

10. Principles governing the retention of personal data

Personal data will be retained for as long as the data controller uses the data for the purposes described in section five. Personal data stored in the register will be deleted when there is no longer a lawful basis for its processing.

Personal data relating to representatives of partners and other stakeholders will be retained for a maximum of two years following the end of the collaboration, or until the data subject requests that the data be erased. Personal data may need to be retained for longer than this if applicable legislation or contractual obligations binding the data controller towards third parties require a longer retention period. Personal data collected on the basis of consent will be retained for two years.

11. Principles governing the protection of the register

The security of the register, as well as the confidentiality, integrity and availability of personal data, are ensured through appropriate technical and organisational measures. Access to the data is restricted to persons employed by Suomen Voima Oy or to authorised third parties whose duties require the processing of personal data. The data in the register is protected by personal user IDs and passwords. Staff and partners are required to undertake to maintain the confidentiality of the personal data in the register.

12. Rights of the data subject

Data subjects have rights under data protection legislation. Please note that the precise application of these rights in each individual case depends on the purpose and context of the processing of personal data.

Data subjects should send requests regarding their rights by email to: suomenvoima@suomenvoima.fi

As a general rule, the data controller shall not charge the data subject a fee for processing a request. However, if the data subject’s requests are manifestly unfounded or excessive – for example, if they are made repeatedly – the data controller may charge the data subject a reasonable fee based on the administrative costs incurred in processing the request.

12.1 The right to access personal data and to obtain a copy of personal data

The data subject has the right to obtain confirmation as to whether their personal data is being processed, as well as the information specified in data protection legislation regarding the processing of personal data. Furthermore, the data subject has the right to receive a copy of the personal data being processed.

12.2 Right to access and rectify data

The data subject has the right to check what information concerning them has been stored in the register. The data subject has the right to request the rectification of incorrect or inaccurate personal data

12.3 Right to erasure

The data subject has the right to have personal data concerning them erased without undue delay, provided that:

  • Personal data is no longer required for the purposes for which it was collected or for which it is otherwise processed

  • The data subject withdraws the consent on which the processing was based, and there is no other legal basis for the processing

  • Personal data has been processed unlawfully

  • Personal data must be erased in order to comply with a legal obligation under Union or national law.