Oomi Oy’s interest group register
This privacy statement provides data subjects, i.e. the controller’s customers, and the supervisory authority with the information required by data protection legislation on how and why Oomi Oy processes the personal data of its interest groups.
1 Controller
Oomi Oy
Business ID: 3101315-4
Postal address: Teknobulevardi 7, 01530 Vantaa
Website: oomi.fi
2 Persons responsible for the register and their contact information
Person responsible for the register
Eero Pyhäranta
Data protection officer
Olli Turpeinen
Enquiries about data protection
tietosuoja@oomi.fi
3 Name of register
Oomi Oy’s interest group register (‘the Interest Group Register’)
The register’s data subjects include the suppliers of Oomi Oy, the suppliers’ employees and persons who have visited Oomi Oy’s business premises.
4 Purpose and legal basis of the processing of personal data
The purpose of the processing of the personal data contained in the Interest Group Register is to take care of the cooperation relationships and duties related to Oomi Oy’s business operations as well as ensure corporate and personal security.
Security is protected with recording surveillance cameras and an access control system.
The basis of processing in this context is Oomi Oy’s legitimate interest in monitoring the security of business premises and property as well as employees and visitors.
5 Data content of the register
In the context of the Interest Group Register, Oomi Oy may process the following data related to data subjects:
- basic information about the data subject (such as names, user ID and/or other unique identifier, password);
- information about external workers (date of birth, personal identity code, tax number, employer’s name and business ID, worksite ID, access rights, basis of the right to work, information on orientation and training, start and end date of work);
- information concerning companies’ contact persons (such as information about the employer and the data subject’s professional status);
- contact information (such as address, phone number and email address);
- image recordings by surveillance cameras (time and place of the recordings);
- possible other information collected with the specific consent of the data subject.
6 Regular sources of data
Data concerning data subjects is regularly received from
- the data subjects themselves or their employers, and this information is entered manually;
- from surveillance cameras
7 Regular disclosures of data and data transfer outside the EU or EEA
Data may be disclosed to the authorities as required by law.
Oomi Oy does not transfer data outside the EU and EEA countries.
8 Data retention period
Data is retained only for as long as it is necessary to fulfil the purposes defined in this privacy statement. After this, the data is deleted, unless we are obligated to retain the data in accordance with legislation or the rights and obligations based on the contract between the parties.
The data is deleted in accordance with the deletion processes followed by the controller.
9 Principles of register protection
Personal data is protected by means that are generally acceptable and reasonable in the sector, such as with access passes, training, firewalls and passwords.
The register data is collected in databases that are protected with passwords, firewalls and other similar technical methods. The data may only be accessed by the administrator employed by Oomi Oy Group and the administrator’s substitutes as well as persons who require the data for their work duties. Oomi Oy requires its personnel and cooperation partners to commit to keeping the data confidential. They have user IDs and passwords.
10 Rights of data subjects
Right of access
Data subjects have the right to see what data is recorded about them in the Customer Register. This right of access may be refused on grounds provided by law.
Electronic data access requests must be sent by email to tietosuoja@oomi.fi.
Written data access requests must be submitted in person at the controller’s place of business, where the data subject’s identity will be verified.
Oomi Oy will charge a reasonable compensation for providing the data if the data subject uses their right of access more often than once a year.
Right to object to the processing of personal data
On account of their special personal situation, data subjects have the right to object to being profiled and to other processing measures carried out by the controller on the data subject’s personal data in so far as the data processing is based on the controller’s legitimate interest. When making the request, the data subject must identify the situation based on which they are objecting to the processing. The controller may refuse to fulfil the request concerning the objection on grounds provided by law.
Right to object to direct marketing
Data subjects have the right to object to the processing of their personal data for the purposes of direct mail, distance selling and direct marketing as well as market research and opinion polls. The right to object does not apply to customer communications related to services subscribed to and ordered by the customer or other service-related communications carried out in order to offer services.
Right to request rectification or deletion of data or restriction of processing
Data subjects have the right to request Oomi Oy to rectify, delete or complete any personal data in the register that is incorrect, unnecessary, insufficient or outdated for the purpose of processing.
Data subjects also have the right to request the controller to restrict the processing of their personal data in situations such as when the data subject is waiting for the controller to reply to their request regarding the rectification or deletion of their data.
Data subjects are personally responsible for the correctness of the data they provide. Data subjects must notify the controller of any changes to the data they have provided.
Right to withdraw consent
If the personal data processing is based on the data subject’s consent, the data subject has the right to withdraw their consent by notifying Oomi Oy of this.
Right to transfer data from one system to another
In so far as the data subject has personally provided the register with data that is processed in order to fulfil the contract between the data subject and Oomi Oy or based on consent given by the data subject, the data subject generally has the right to receive the data in machine-readable format or transfer it to another controller.
11 Filing a complaint with the data protection supervisory authority
If the data subject deems that the processing of personal data is in breach of the applicable legislation or that the data subject’s statutory rights have been infringed upon, they may file a complaint about the matter with the relevant data protection supervisory authority. In Finland, the legality of the processing of personal data is monitored by the Data Protection Ombudsman, whose contact information can be found at the following address: www.tietosuoja.fi/en/home.
12 Changes to the privacy statement
We retain the right to change and update this privacy statement. The up-to-date privacy statements can be found on our website at oomi.fi/privacy-statements.
4 May 2020
