Privacy policy for the member register

1. Controller

The Helsinki Region Chamber of Commerce (Business ID 0201253-1) [hereafter HRCC]

Address
Kalevankatu 12, 00100 Helsinki

Phone:
+358 (0)9 228 601

Email:
kauppakamari (at) helsinki.chamber.fi

Contact person in matters related to data security:
Max Moiseev
tietosuoja (at) helsinki.chamber.fi

2. For which purposes do we process our members’ personal data?

In this context, a member means a contact person of such companies and other entities with which HRCC has a member relationship.

HRCC processes the personal data of the members for the following purposes (one or more at the same time)

Management and analysis of a member relationship

HRCC uses your personal data for the management and analysis of the member relationship formed with the company or other entity you represent. HRCC’s task is to develop the operational prerequisites of the business within its operational area.

Offering membership perks

HRCC may use your personal data to offer various changing membership benefits and to analyse the usage of them. Personal data is used to exercise rights and obligations based on an agreement or another commitment between HRCC and the host organisation.

Member communication

HRCC may use your personal data in its member communication, for example, to send you notifications related to membership and membership perks, to communicate about changes made in services or to request feedback for products and services.

HRCC may use personal data to customise its member offering and to offer relevant content. This means, for example, that we may provide recommendations or show customised content and customised messages in our own and in third-party services.

Development of products and services

HRCC may use a member’s personal data to develop its products and services.

The following subparagraphs of Article 6 of the EU General Data Protection Regulation act as the legal basis for processing personal data.

The data subject has given his or her consent for the processing of his or her personal data for one or more specific purposes;
Processing is necessary to execute a contract which the data subject is a party to, or to carry out the measures preceding the contract upon the request of the data subject;
Processing is necessary to conform with a controller’s statutory obligation; and/or
Processing is necessary to fulfil the legitimate interests of the controller or a third party, except when the benefits and fundamental rights and freedoms of the data subject override such interests.

In principle, HRCC processes your data in its member register based on the Chamber of Commerce Act and the Associations Act. HRCC may also process your personal data when other legislation so obligates, for example, based on the obligation to retain data, as laid down in the Accounting Act.

HRCC has legitimate interests related to conducting its business, such as further development of the operation and clarification of potential circumvention, and your personal data can also be processed on those grounds.

3. What type of data can we collect?

The personal data collected by HRCC may contain, among others, the following type of data and amendments made to them:

3.1. Basic information of all data subjects

first and last name
contact information (postal address, email address, telephone and fax numbers)
gender
service language
title and/or job description for work tasks related to current and previous HRCC customer relationship
Name and information of the company related to HRCC membership where the data subject currently works
or has worked previously
start and end date of acting as a contact person
communication targeted to the data subject and the use of products and services contained in the communication
data concerning the use of HRCC’s digital services and digital content created for the data subject
technical data sent to a data subject’s digital devices (such as computers and mobile devices) by HRCC
and data concerning cookies and other corresponding techniques
recordings of customer service calls and email and online discussions

3.2. data of data subjects who have used HRCC member products, provided feedback and/or made a complaint about them

content of feedback and complaints, correspondence and further actions related to them

3.3. data of data subjects who have participated in HRCC’s regular meetings, events and other services

date of birth related to events for which, for example, a shipping company requires it
essential information about the organisation and participation in an event
information concerning diet (special data, which the user has given voluntarily)
benefits targeted to a data subject and their usage

4. From which sources do we collect personal data?

The majority of the data is received at the beginning of and during the membership and from the programmes through which you use our products and services.

HRCC also receives personal data and updates to them from the authorities, organisations and companies who offer update services for credit and personal data, from public directories and other public data sources, such as websites of communities and social media channels.

5. Who can we share your personal data with?

HRCC does not give, sell or otherwise reveal your personal data to third parties outside the Helsinki Region Chamber of Commerce community, unless otherwise stated in the following.

HRCC may share your personal data with the member company or entity where you work, for example, when your employer asks for the data of the employees who have participated in HRCC events. HRCC may share the data of the participants of HRCC events with other participants of a given event, for example, by sharing a participant list in connection with other material.

HRCC shares your personal data with cooperation partners with whom HRCC manages and implements projects, such as the Cooperation partner and Enterprise Europe Network unit, which operates in connection with the Chamber of Commerce.

HRCC may share your personal data with third parties who provide services for HRCC. Such services include, for example, customer service, software services, technical management and analysis of personal data, communications and various campaigns. HRCC may share your personal data in order to collect payments for products and services, and it may transfer or sell unpaid invoices to third parties which offer collection services. Protecting your personal data is important to HRCC; therefore, it does not allow the said parties to use the data for any other purpose than offering the said services, and it requires that the parties protect the user’s personal data in compliance with this Privacy Policy.

HRCC may share your personal data with carefully selected third parties for joint or independent research, advisory services or direct marketing purposes. Data can only be shared for the said purposes when the intended use by the third party is not in conflict with the intended use specified in this HRCC Privacy Policy.

HRCC may share your personal data upon the order of a court of justice or in a corresponding instance.

6. Do we transfer your personal data outside the EU area?

HRCC may use resources and servers located in different part of the world when offering its services. HRCC may thus transfer your personal data outside the country of use and possibly also to countries outside the EU and EEA, where there is no special protection of personal data in the legislation, or the legislation differs significantly. In such cases, HRCC makes sure that there is a legal basis for transferring the data and that the user’s personal data is protected in compliance with the applicable legislation, for example, by using (when required) standard contracts approved by appropriate authorities and by requiring that appropriate technical and practical data security measures are followed.

7. For how long do we process your personal data?

HRCC processes your personal data in this register for as long as HRCC has a basis described in point 2 of this Privacy Policy for data processing to be in force, and for a reasonable time after it. Your data will be processed at least while HRCC and the organisation you represent have a valid member relation and you act as a contact person towards HRCC or work in the said member company.

8. How can you exercise your rights related to your personal data?

As a contact person of a member you have various possibilities to influence the processing of your personal data. As a rule, we will fulfil your request within a month. We ask to contact the contact person mentioned in point 1 of this Privacy Policy as regards to exercising your rights.

Your rights include:

Right to access the personal data collected from you. In practice, this takes place such that, based on your appropriate and identified request, we provide you with a report of the personal data collected from you in the register.
The right to ask to correct personal data collected from you. If you notice errors or deficiencies in your data, you can send us a request for rectification.
The right to ask to erase personal data collected from you. We are obligated to erase the personal data from our register, as requested by you, if any of the following grounds applies and there is no obligation to retain the data for legislative reasons or due to an authority regulation:
1. personal data are no longer needed for the purposes for which they were processed;
2. you withdraw the consent you gave, and there is no other legal ground for the processing;
3. you object to the processing because of your special personal situation, and there is no legitimate interest for the processing, or you object to having your personal data processed for direct marketing;
4. your personal data have been unlawfully processed;
5. your personal data must be deleted to comply with the EU legislation or the statutory obligation based on the Finnish law, applied to HRCC.
6. your personal data have been collected in relation to the offer of information society services, for example, in connection with ordering HRCC’s digital information services.
The right to ask to restrict the processing of the personal data collected from you. You can ask HRCC to restrict the processing of your personal data, if:
1. you contest the accuracy of your personal data at HRCC;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. HRCC no longer needs the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims;
4. you have objected to processing pending the verification whether the legitimate grounds of HRCC override your grounds.
Right to transfer the data provided by you from one system to another If the automatic processing of our personal data is based on consent or an agreement, you have the right to receive the personal data you delivered to HRCC in a structured, generally used and machine readable format, and you have the right to transfer the said data to another controller.
Right to withdraw consent. If all or part of your personal data is processed in this register based on your consent, you have the right to withdraw the consent you have given.
Right to lodge a complaint with a supervisory authority. If a possible dispute related to the processing of your personal data cannot be amicably settled between you and HRCC, you have the right to submit the matter to be resolved by the data protection supervisor.

9. Do you have to give us your personal data?

For HRCC to be able to fulfil its contractual obligations related to Chamber of Commerce membership, HRCC must receive and process your personal data. Without the necessary personal data we cannot offer a member and/or you the member benefits, in connection with which it is necessary to process personal data.

10. Do we do profiling?

For the time being, we shall not conduct profiling, as intended in the EU General Data Protection Regulation, which would have a legal impact or other corresponding sanctions related to you.

Instead, we can otherwise analyse the personal data in our registers and combine them with information received from third parties, for example, what type of content you would probably be interested in, and target content based on forecasts.

11. Which country’s legislation is applied to data processing?

We are a Finnish organisation operating in Finland. The Finnish legislation and EU legislation applied directly in Finland, such as the EU General Data Protection Regulation, are applied to this personal register and the processing of personal data contained in it.