Marketing and Communications Register – Privacy Policy

1. Controller

SPL Company Oy (Business ID: 2871479-3)
Lapinlahdenkatu 16
FI-00180 Helsinki

Data subjects must contact the customer service of the SPL Company Oy in all matters pertaining to the processing of personal data and exercise of the rights of the data subject.

The customer service of the SPL Company Oy
Email address: asiakaspalvelu@ukko.fi
or by post:

SPL Company Oy / Tietosuoja
Lapinlahdenkatu 16
FI-00180 Helsinki

2. Purpose and Legal Basis of Processing Personal Data

Personal data are processed:
• for marketing and direct marketing of our services within the limits of the law
• for improving communications and identifying potential customers
• for handling contact requests and answering to them
• for opinion polling or market research
• for monitoring the usage of our service

Processing of personal data is based on consent of the data subject or legitimate interest of the SPL Company Oy to market and communicate information about its services to the data subject.

Users are profiled and decisions based on automated processing may be made on the basis of personal data. Automatic profiling is used for recognising the needs of customers and targeting communications.

3. Register Information Content

The following information may be processed in the register:
• Name
• Contact information (telephone number and email address)
• Age
• Gender
• Profession
• Other information concerning the duties of the data subject and role in the business community or public service
• IP address
• Information based on the activities of the data subject, such as opened marketing messages and answers to queries
• Necessary identification data and technical information related to interactions, such as telephone recordings and cookies
• Direct marketing permissions and refusal

4. Regular Sources of Data

Personal data are collected from the data subjects themselves when they register to the service or participate in the marketing campaigns and events organised by SPL Company Oy.
Data are also collected from public and publicly available sources, as well as the registers controlled by third party service providers. An example of such sources are the public information sources of the Internet.

5. Information Disclosure

We disclose data to service providers, who process personal data on behalf of SPL Company Oy in accordance with professional secrecy requirements and data protection obligations of their agreement.
Personal data may also be disclosed to e.g. authorities, who have right of access to the data, to the extent permitted and required by the applicable law.

6. International Data Transmissions

Data is transferred within the limits of the EU General Data Protection Regulation (GDPR) to U.S.-based companies providing services to SPL Company Oy. Our service providers are committed to complying with the contractual rules of the so-called Privacy Shield policy between the European Union and the United States, which guarantees an adequate level of data protection. Third parties do not have the right to use the data for their own purposes.

7. Retention Period of Personal Data

Personal data will be stored for the time necessary to carry out the purposes for which they were collected, but no longer than 10 years from the date of the last usage event of the data subject, unless the data subject has withdrawn his/her possible consent. Personal data may be stored for a longer period, if this is necessary in order to fulfil the obligations of legislation or other official sources.

8. Register Data Protection

The register is kept on a secure server, which can only be accessed by the controller and the technical administrators authorized by the controller.

9. Data Subject Rights

Data subjects have the right to request access to their personal data from the controller, the right to request rectification, limitation of processing, or erasure of their personal data, and the right to object to processing of their personal data.

The data subjects also have the right to receive the personal data that they have provided to us in a commonly used, machine-readable format, and the right to transfer the data in question to another data controller. Where technically feasible, the data subjects have the right to get their personal data transmitted directly to another data controller by us.

10. Right to Lodge a Complaint with the Regulatory Authority

Data subjects are entitled to lodge a complaint with the competent regulatory authority should they consider that SPL Company Oy has not complied with the applicable data protection legislation in its actions.