User Register – Privacy Statement

1. Controller

SPL Company Oy (Business ID:  2871479-3)
Itämerenkatu 1
FI-00180 Helsinki

Data subjects must contact the customer service of the SPL Company Oy in all matters pertaining to the processing of personal data and exercise of the rights of the data subject.
The customer service email address of the SPL Company Oy is asiakaspalvelu@ukko.fi and our postal address is:

SPL Company Oy / Tietosuoja
Itämerenkatu 1
FI-00180 Helsinki

2. Purpose and Legal Basis of Processing Personal Data

Personal data are processed for customer relationship management, services, analysis, and development purposes, such as:
• Maintenance of user data
• Performance of assignments authorized by the users, such as sending invoices, payment of salaries, handling insurance matters, debt collection
• Surveys, such as customer satisfaction surveys
• Fulfilment of obligations for us stated in laws, regulations or instructions from authorities, such as handling tax affairs

Processing of personal data is based on a contract or legitimate interest of the SPL Company Oy.
Personal data can also be used for marketing purposes of the SPL Company Oy, unless the users have objected to the processing of their data for direct marketing.  Users are profiled and decisions based on automated processing may be made on the basis of personal data, such as decisions to offer targeted additional services.

3. Register Information Content

The following data are saved in the register:
• Name
• Contact information (telephone number and email address)
• Age
• Gender
• Profession
• Personal identity number
• Tax data
• Possible enforcement information
• Details related to salary payments
• Customer data, such as the details on assignments authorized by the customer
• Necessary identification data and technical usage statistics related to interactions, such as telephone recordings, cookies and log details
• Nationality and work permit-related information, if necessary
• Copy of identity paper, if necessary

4. Regular Sources of Data

Data are mainly collected from the data subjects themselves. Personal data are also collected and updated from authorities providing personal data services.

5. Information Disclosure

We disclose data to service providers, who process personal data on behalf of SPL Company Oy in accordance with professional secrecy requirements and data protection obligations of their agreement.
Personal data may also be disclosed to e.g. authorities, who have right of access to the data, to the extent permitted and required by the applicable law.

6. International Data Transmissions

Data is transferred within the limits of the EU General Data Protection Regulation (GDPR) to U.S.-based companies providing services to SPL Company Oy. Our service providers are committed to complying with the contractual rules of the so-called Privacy Shield policy between the European Union and the United States, which guarantees an adequate level of data protection. Third parties do not have the right to use the data for their own purposes.

7. Retention Period of Personal Data

Personal data will be stored for the time necessary to carry out the purposes for which they were collected, but no longer than 10 years from the date of the last usage event of the data subject, unless the data subject has withdrawn his/her possible consent. Personal data may be stored for a longer period, if this is necessary in order to fulfill the obligations of legislation or other official sources, such as the Accounting Law

8. Register Data Protection

The register is kept on a secure server, which can only be accessed by the controller and the technical administrators authorized by the controller

9. Data Subject Rights

Data subjects have the right to request access to their personal data from the controller, the right to request rectification, limitation of processing, or erasure of their personal data, and the right to object to processing of their personal data. The data subjects also have the right to receive the personal data that they have provided to us in a commonly used, machine-readable format, and the right to transfer the data in question to another data controller. Where technically feasible, the data subjects have the right to get their personal data transmitted directly to another data controller by us.

10. Right to Lodge a Complaint with the Regulatory Authority

Data subjects are entitled to lodge a complaint with the competent regulatory authority should they consider that SPL Company Oy has not complied with the applicable data protection legislation in its actions.