Privacy statement This privacy statement describes how Pellon Group processes customers’ personal data. This statement covers 1) Data controller’s contact details 2) What data we collect 3) What rights the data subject has and how they can exercise them 4) What we use personal data for and what our legal basis for processing is 5) How long we store data for 6) Data recipients and data transfer to third countries 7) What kinds of risks are associated with data processing and how we protect personal data Data controller’s contact details Pellon Group Oy Yrittäjäntie 10 62375, YLIHÄRMÄ Tel: +358 6 4837 555 Email pellon@pellon.fi VAT NUMBER: FI01844547 What data we collect and for what purpose The personal data collected by Pellon Group can be divided into the following categories: Data related to identification and contact, such as names, addresses, telephone numbers, email addresses and personal identity codes, which are required for checking agreements and credit ratings Duty information: job title, job description or area of responsibility Data related to job applications and hiring, such as names, addresses, other contact details, dates of birth, application data identifying the job the applicant is interested in and CV-related data such as educational background, work experience, language skills, other expertise, positions of trust, photographs, data related to interviews and tests, other data the applicant may have chosen to give, such as desired salary, where the applicant learned about the vacancy and data related to the processing of the application Data related to the use of our website: cookies Personal data we collect directly from the data subject We generally collect personal data directly from the data subject when they interact with our customer service, or the customer discloses the data themselves through an online form, chat service or email. This data is used to contact the data subject to offer or provide services. Analytics data on website visitors is collected when the data subject uses our website. Personal data we may collect from third parties We collect personal data from third parties from public sources such as company websites, company registers like the YTJ business information system and the Finnish Patent and Registration Office’s Trade Register to verify the contract signatory’s authority to sign. What rights the data subject has and how they can exercise them The data subject has certain rights regarding any of their personal data we may hold. The data subject has the following rights: a) Right to access personal data The data subject has the right to access any of their personal data held by us. However, the right to access may be restricted by legislation or to protect the privacy of others. b) Right to rectify personal data The data subject has the right to request rectification of inaccurate or incomplete personal data. c) Right to erase personal data The data subject has the right to request erasure of their personal data. Personal data can be erased in cases such as the following: The data subject withdraws their consent and there is no other valid lawful basis for processing The data subject objects to the processing of their personal data and there is no valid lawful basis for further processing The processing of the personal data is illegal d) Right to restrict processing The data subject has the right to restrict the processing of their personal data. e) Right to object The data subject has the right to object to the processing of their personal data. f) Right to data portability The data subject has the right to receive the personal data they have provided in an electronically readable form. This right concerns personal data that has been processed automatically on the basis of an agreement or consent. The right to transfer personal data from one IT environment to another does not apply to the contact information of professionals processed in business-to-business relationships in which processing is not based on the consent of the data subject or an agreement they are party to. g) Right to withdraw consent If the basis for processing is consent, the data subject has the right to withdraw their consent at any time without affecting the lawfulness of any processing that occurred before the withdrawal. Withdrawing consent may affect our ability to provide services. h) Right to lodge a complaint with a supervisory authority The data subject has the right to lodge a complaint with a supervisory authority if they suspect their personal data is being used inappropriately or illegally. To exercise this right, the data subject must contact us in writing. What we use personal data for and what our legal basis for processing is We process personal data to fulfil our statutory and contractual obligations. The legal bases for our processing of personal data are: Implementing the contract Fulfilling our contractual obligations is our primary legal basis for processing personal data. We process personal data where necessary to produce the products and services ordered from us. Statutory obligation In addition to our contractual obligations, our operations are also subject to statutory obligations, such as accounting legislation, on the basis of which we process personal data. Consent To develop our website, we collect analytics data regarding visitors’ use of the site based on consent. You give your consent by accepting cookies when you arrive on the site. Before personal data is collected for marketing purposes, the data subject is asked to provide consent, which they can withdraw at any time. Pellon Group Oy processes job applications based on the applicant’s consent. The applicant has the right to withdraw their consent at any time. How long we store data for Unless otherwise required by legislation, such as the Accounting Act, personal data is only stored for the duration of the contractual relationship plus six (6) years to meet possible contractual obligations and allow for the processing of complaints and rectification requests. Website visitor analytics data is stored for 26 months for the purposes of monitoring and developing marketing and customer service. Personal data related to specific jobs used in the hiring process is stored for two (2) years, and open applications are stored for 12 months after they are submitted. Data recipients and data transfer to third countries Data is not combined into other datasets or disclosed to third parties unless otherwise required by law. Personal data related to hiring may be disclosed for internal Group use and to possible subcontractors taking part in the hiring process with whom Pellon Group has signed a separate agreement on hiring and the processing of personal data. Data security The goal of Pellon Group’s security measures is to secure the availability of data, personal data and information systems, ensure their confidentiality, ensure the integrity of data and minimize the damage caused by any data security breaches. The security measures are based on an operational risk assessment and are applied in an appropriate scope to manage the protected data and the risks the data is subject to. The requirements of current legislation concerning data security are taken into account in security measures and the processing of personal data. Changes to the privacy statement Our practices relating to data security may be updated, and any changes will be published on this page. Supervisory authority’s contact details All data subjects have the right to lodge a complaint regarding the processing of their personal data with the supervisory authority if they feel their personal data is not being processed appropriately. Office of the Ombudsman for Data Protection Address: Ratapihantie 9, 6. krs, 00520 Helsinki Post address: PL 800, 00521 Helsinki Tel: +358 29 56 66700 email: tietosuoja@om.fi
