Privacy policy concerning customers, potential customers and interest groups

1. Controllers

The Helsinki Region Chamber of Commerce (business ID 201253-1) and Helsingin Kamari Oy (business ID 1102711-0) [hereafter jointly HRCC]

Address
Kalevankatu 12, 00100 Helsinki

Phone:
+358 (0)9 228 601

Email:
kauppakamari (at) helsinki.chamber.fi

Contact person in matters related to data security:
Max Moiseev
tietosuoja (at) helsinki.chamber.fi

2. For which purposes do we process data subjects’ personal data?

In this context Customer means the contact persons of such companies and other entities, with whom HRCC has a customer relation or other appropriate connection, or who are consumer customers.

Potential customers mean contact persons of such companies or other entities or consumers with whom HRCC aims to create a customer relationship.

Interest groups mean contact persons of such companies and other entities with whom HRCC cooperates (for example, representatives of companies and other entities producing services for HRCC) or some other connection (for example, representatives of media as parties or communication activities).

HRCC processes the personal data of data subjects for the following purposes (one or more at the same time)

Management and analysis of customer and interest group relationship

HRCC may use your personal data with the company or other entity you represent or for managing, analysing and improving a customer or interest group relation formed directly with you.

Offering products and services

HRCC may use your personal data for offering products and services, if the company or other entity you represent or you yourself have purchased a product from us, used our digital services, subscribed to our newsletter or participated in training or other events we provide. Personal data is used to exercise rights and obligations based on an agreement or another commitment between HRCC and the customer.

Customer communication

HRCC may use your personal data in its customer communication, for example, to send you notifications related to products and services (such as training), to communicate about changes made in services and to request feedback for products and services.

Marketing

HRCC may contact you to inform you of new products, services and benefits. HRCC may use personal data to customise its offering and to offer relevant content. This means, for example, that we may provide recommendations or show customised content and customised advertisements in our own and in third-party services.

Development of products and services

HRCC may use your personal data to develop its products and services.

The following subparagraphs of Article 6 of the EU General Data Protection Regulation act as the legal basis for processing personal data.

The data subject has given his or her consent for the processing of his or her personal data for one or more specific purposes;
Processing is necessary to execute a contract which the data subject is a party to, or to carry out the measures preceding the contract upon the request of the data subject;
Processing is necessary to conform with a controller’s statutory obligation; and
Processing is necessary to fulfil the legitimate interests of the controller or a third party, except when the benefits and fundamental rights and freedoms of the data subject override such interests.
HRCC processes your data to execute a contract with you (e.g., implementation of a newsletter subscription or online purchase or a training service).
HRCC has legitimate interests related to carrying out business, such as the right to promote the sale of its products and services among its customers through the means of marketing and sales, and, on the basis of a legitimate interest, HRCC may carry out direct marketing and sales using the contact data provided by you, including the processing of personal data for profiling purposes. Other legitimate interests of HRCC, based on which your personal data can be processed, include counselling and other customer service for non-customers, further development of business, and clarification of possible irregularities.

If data processing is not based on a contractual need or legitimate interest, HRCC may ask for your permission for other processing of personal data.

HRCC may also process your personal data when the legislation so obligates, for example, based on the obligation to retain data, as laid down in the Accounting Act.

3. What type of data can we collect?

The personal data collected by HRCC may contain, among others, the following type of data and amendments made to them:

3.1. Basic information of all data subjects

first and last name
contact information (postal address, email address, telephone and fax numbers)
gender
service language
Title and/or job description for work tasks related to current and previous HRCC operations
Direct marketing selections
Data concerning the use of HRCC’s digital services and digital content created for the user
Technical data sent to a user’s digital devices (such as computers and mobile devices) by HRCC
and data concerning cookies and other corresponding techniques
Communication targeted to a data subject and activities related to it
recordings of customer service calls and email and online discussions

3.2. Data of data subjects who have purchased HRCC products, provided feedback and/or lodged a complaint about them

name and information of a company or other entity related to an HRCC customer relationship,
where a data subject currently works or has worked previously
start and end date and the way a customer relationship or a corresponding relationship started and ended
campaigns and offers targeted to a customer and their usage
interests and other information given by a customer
content of feedback and complaints, correspondence and further actions related to them

3.3. data of data subjects who have participated in HRCC’s training and other services

date of birth related to events for which, for example, a shipping company requires it
essential information about the organisation and participation in an event
information concerning diet (special data, which the user has given voluntarily)
names and date of birth of a travel companion, when, e.g., a shipping company requires it

3.4. data of HRCC’s online service customers

credentials of a data subject
activity in online services after logging in

4. From which sources do we collect personal data?

The majority of the data is received at the beginning of and during the customer and interest group relationship and from the programmes through which you use our products and services. HRCC also receives personal data and updates to the data from the authorities, organisations and companies who offer procurement and update services for credit and personal data, and from public directories and other public data sources, such as websites of communities and social media channels.

5. Who can we share your personal data with?

HRCC does not give, sell or otherwise reveal your personal data to third parties outside the Helsinki Region Chamber of Commerce community, unless otherwise stated in the following.

HRCC may share the personal data of participants of HRCC events with other participants of the said events.

HRCC shares your personal data with cooperation partners with whom HRCC manages and implements projects, such as the Cooperation partner and Enterprise Europe Network unit, which operates in connection with the Chamber of Commerce.

HRCC may share your personal data with third parties who provide services for HRCC. Such services include, for example, customer service, software services, technical management and analysis of personal data, marketing and various campaigns. HRCC may share your personal data in order to collect payments for products and services, and it may transfer or sell unpaid invoices to third parties which offer collection services. Protecting your personal data is important to HRCC; therefore, it does not allow the said parties to use the data for any other purpose than offering the said services, and it requires that the parties protect the user’s personal data in compliance with this Privacy Policy.

HRCC may share your personal data with carefully selected third parties for joint or independent direct marketing purposes. Data can only be shared for the said purposes when the intended use by the third party is not in conflict with the intended use specified in this HRCC Privacy Policy.

HRCC may share your personal data in connection with reorganisation or when services are transferred to another service provider.

HRCC may share your personal data upon the order of a court of justice or in a corresponding instance.

6. Do we transfer your personal data outside the EU area?

HRCC may use resources and servers located in different part of the world when offering its services. HRCC may thus transfer your personal data outside the country of use and possibly also to countries outside the EU and EEA, where there is no special protection of personal data in the legislation, or the legislation differs significantly. In such cases, HRCC makes sure that there is a legal basis for transferring the data and that the user’s personal data is protected in compliance with the applicable legislation, for example, by using (when required) standard contracts approved by appropriate authorities and by requiring that appropriate technical and practical data security measures are followed.

7. For how long do we process your personal data?

HRCC processes your personal data in this register for as long as HRCC has a basis described in point 2 of this Privacy Policy for data processing to be in force, and for a reasonable time after it. Your data is processed at least for the duration for which HRCC and you have a valid customer relationship or other corresponding appropriate connection.

8. How can you exercise your rights related to your personal data?

As a data subject, you have various possibilities to influence the processing of your personal data. As a rule, we will fulfil your request within a month. We ask to contact the contact person mentioned in point 1 of this Privacy Policy as regards to exercising your rights. Your rights include:

Right to access the personal data collected from you. In practice, this takes place such that, based on your appropriate and identified request, we provide you with a report of the personal data collected from you in the register.
The right to ask to rectify or erase personal data collected from you. If you notice errors or deficiencies in your data, you can send us a request for rectification.
The right to ask to erase personal data collected from you. We are obligated to erase the personal data from our register, as requested by you, if any of the following grounds applies and there is no obligation to retain the data for legislative reasons or due to an authority regulation
1. personal data are no longer needed for the purposes for which they were processed;
2. you withdraw the consent you gave, and there is no other legal ground for the processing;
3. you object to the processing because of your special personal situation, and there is no legitimate interest for the processing, or you object to having your personal data processed for direct marketing;
4. your personal data have been unlawfully processed;
5. your personal data must be deleted to comply with the EU legislation or the statutory obligation based on the Finnish law, applied to HRCC.
6. your personal data have been collected in relation to the offer of information society services, for example, in connection with ordering HRCC’s digital information services.
The right to ask to restrict the processing of the personal data collected from you. You can ask HRCC to restrict the processing of your personal data, if:
1. you contest the accuracy of your personal data at HRCC;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. HRCC no longer needs the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims;
4. you have objected to processing pending the verification whether the legitimate grounds of HRCC override your grounds.
The right to object to the processing of personal data concerning you. If HRCC processes your data based on a legitimate interest, you have the right to object to the processing of personal data concerning you because of your special personal situation. Everyone in this register has the right to object to the processing of their personal data for direct marketing purposes.
Right to transfer the data provided by you from one system to another If the automatic processing of your personal data is based on consent or an agreement, you have the right to receive the personal data you delivered to HRCC in a structured, generally used and machine readable format, and you have the right to transfer the said data to another controller
Right to withdraw consent. If all or part of your personal data is processed in this register based on your consent, you have the right to withdraw the consent you have given.
Right to lodge a complaint with a supervisory authority. If a possible dispute related to the processing of your personal data cannot be amicably settled between you and HRCC, you have the right to submit the matter to be resolved by the data protection supervisor.

9. Do you have to give us your personal data?

For HRCC to be able to fulfil its contractual obligations related to a product or service you order or offer, HRCC must receive and process your personal data. Without the necessary personal data we cannot offer you our products and services, in connection with which it is necessary to process personal data.

10. Do we do profiling?

For the time being, we shall not conduct profiling, as intended in the EU General Data Protection Regulation, which would have a legal impact or other corresponding sanctions related to you.

Instead, we can otherwise analyse the personal data in our registers and combine them with information received from third parties, for example, what type of content you would probably be interested in, and target content based on forecasts.

11. Which country’s legislation is applied to data processing?

We are a Finnish organisation operating in Finland. The Finnish legislation and EU legislation applied directly in Finland, such as the EU General Data Protection Regulation, are applied to this personal register and the processing of personal data contained in it.