Privacy statement for the partner register of Moovy Oy
This privacy statement pursuant to Articles 13 and 14 of the General Data Protection Regulation (679/2016/EU) describes how the controller processes personal data of its partners.
1. Contact details of the controller
Moovy Oy
P.O. Box 15, FI-33211 Tampere
Business ID: 3375902-1
Email: asiakaspalvelu@finnpark.fi
2. Personal data processed
Personal data necessary for cooperation with partners is collected and processed, including identification and contact details of the partner’s representative or contact person, such as name, position in the company, address, telephone number, email address, organisational unit and supervisor.
3. Regular sources of personal data
The register mainly contains information provided to the controller by its partners. Data may also be collected from publicly available sources.
4. Purpose of processing personal data and legal bases
The controller processes personal data contained in the register for the preparation, management and administration of contractual relationships during contract negotiations and throughout the contractual relationship. Personal data contained in the register is also processed for the management of documentation related to contractual relationships.
The legal basis for processing is the performance of pre-contractual measures and the performance of a contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
In addition, the legal basis for processing is the legitimate interest of the controller based on a customer relationship or other relevant connection (Article 6(1)(f) of the General Data Protection Regulation, GDPR).
No automatic decision-making is used in the processing of personal data and the data is not used for profiling.
5. Disclosure and transfer of personal data
Data is not regularly disclosed to third parties unless otherwise required by legislation.
Personal data may be transferred to partners of the controller who process personal data on behalf of the controller in accordance with the controller’s instructions. The processor does not have the right to process personal data for its own purposes.
6. Transfer of data outside the EU or the EEA
Personal data contained in the register is stored on a server located within the European Union. If personal data is transferred outside the EU/EEA, for example if a service provider is located outside the EU/EEA, the controller ensures that the transfer is carried out in accordance with applicable data protection legislation, such as decisions on an adequate level of protection adopted by the European Commission.
7. Principles of data protection
The protection and processing of personal data complies with the provisions and principles of the General Data Protection Regulation and other applicable data protection legislation, as well as with instructions issued by authorities and good data processing practices.
The controller has implemented appropriate technical and organisational measures to ensure the protection of personal data. The electronic data contained in the register is stored in databases protected by firewalls, passwords and other technical and application-level solutions commonly used in business operations to prevent misuse and unauthorised access. The electronic register data is located in access-controlled, locked and monitored facilities. The use of the register is monitored by means of personal user IDs and passwords. Only persons whose duties require the use of the register have access to it. The controller’s personnel and subcontractors are bound by confidentiality obligations.
8. Data retention period
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, as defined in this privacy statement, or for as long as required by law.
Data is retained for the duration of the cooperation with the partner and for a maximum of 10 years after the termination of the contract relating to the cooperation, to the extent that such retention is necessary for the fulfilment of statutory obligations related to the contract or for the establishment, exercise or defence of legal claims.
If, during the retention period, it becomes necessary to retain the data for the investigation of suspected misuse or for legal proceedings, personal data will be retained for as long as required for such purposes or until the matter has been finally resolved and enforced.
Outdated data is replaced with up-to-date data without delay and unnecessary data is deleted appropriately.
9. Rights of the data subject
The data subject has the right to access their personal data in the register free of charge once per year.
For more frequent requests, the controller may charge a reasonable fee covering the direct costs. A written request must be submitted to the controller using the contact details provided above. Before disclosing the data, the identity of the data subject will be verified to ensure that the data is not disclosed to unauthorised persons.
If the data subject notices that the personal data in the register is inaccurate, incomplete or has been processed in violation of the purpose of the register or applicable legislation, they may request that the controller rectify, restrict, erase or otherwise process the personal data accordingly by contacting the controller using the contact details provided above.
In addition, a person who considers that their rights under the GDPR have been infringed has the right to lodge a complaint with a supervisory authority. The Finnish national supervisory authority is the Office of the Data Protection Ombudsman, whose contact details are:
Office of the Data Protection Ombudsman
P.O. Box 800, Lintulahdenkuja 4, FI-00530 Helsinki
Tel. +358 29 56 66700
tietosuoja@om.fi
www.tietosuoja.fi
10. Changes to the privacy statement
The controller continuously develops its operations and therefore reserves the right to amend this privacy statement. Changes may also be based on changes in legislation. The controller recommends reviewing the content of the privacy statement regularly.
