Oomi Oy’s marketing register for electricity sales

This privacy statement provides data subjects, i.e. Oomi Oy’s potential customers, and the supervisory authority with the information required by data protection legislation on how and why Oomi Oy processes the personal data of its potential customers for marketing purposes.

1  Controller

Oomi Oy
Business ID: 3101315-4
Postal address: Teknobulevardi 7, 01530 Vantaa
Website: oomi.fi

2  Persons responsible for the register and their contact information

Person responsible for the register
Isko Lappalainen

Data protection officer
Olli Turpeinen

Enquiries about data protection
tietosuoja@oomi.fi

3  Name of register

Oomi Oy’s marketing register for electricity sales (Marketing Register)

The register’s data subjects are potential customers of Oomi Oy.

A person becomes a potential customer when they express their interest towards Oomi Oy’s services and consent to direct marketing on Oomi Oy’s website, in lotteries, at fairs and events or at a sales point, for example.

4  Purpose and legal basis of the processing of personal data

The purpose of the processing of the personal data contained in the Marketing Register is to offer, sell and market services and products related Oomi Oy’s business as well as ensure, maintain and develop the quality of existing and future services and products.

For the aforementioned purposes, personal data may be processed in order to offer, sell and develop Oomi Oy’s services and products, analyse their use, identify data subjects, compile statistics, implement marketing communications as well as market the products and services of carefully selected cooperation partners and carry out opinion polls and market research.

The processing of personal data is primarily based on Oomi Oy’s justified and legitimate interest in communicating and marketing its services in order to promote its business and ensure, maintain and develop its services.

Oomi utilises the generally used advertising opportunities offered by Facebook and, in certain forms of advertising, customer data to a limited extent in order to create target audiences. We do not use customers who have opted out of marketing when forming these anonymous advertising audiences. For more information  on targeted advertising and advertising restrictions for Facebook users, see here.

Oomi offers content on many social media websites and also carries out marketing measures through them. The use of the content of social media websites complies with the terms of the social media service provider. You can check out the privacy settings and marketing practices in the settings of the services in question. 

5  Data content of the register

With regard to potential customers, the following data related to data subjects may be processed:

• basic information about the data subject (such as names, address, the company’s business ID, ID of the location of use and/or other unique identifier);
• information concerning companies’ contact persons (such as information on the employer and the data subject’s professional status);
• contact information (such as address, phone number and email address);
• information related to the customer account and contracts (such as correspondence and other contact with Oomi Oy, contact recordings and records (such as phone call recordings and email records) as well as information related to marketing);
• information on services and products (such as information provided by the data subject on their interests; cookies and information on their use);
• marketing opt-ins and opt-outs (such as direct marketing opt-out, telemarketing opt-out, electronic direct marketing opt-in);
• possible other information collected with the specific consent of the data subject.

6  Regular sources of data

Data concerning data subjects is regularly received from

• the data subjects themselves when they request a quote from Oomi Oy or consent to their information being added to Oomi Oy’s Marketing Register;
• data may also be collected, saved and updated to Oomi Oy’s Marketing Register from the registers of the Digital and Population Data Services Agency and Suomen Asiakastieto Oy, for example.

Personal data may also be collected and updated from the authorities and other third parties within the limits permitted by the applicable legislation for the purposes described in this privacy statement.

Oomi Oy records phone calls made to and received from customers in order to ensure and develop the quality of customer service. Phone calls between customers and cooperation partners acting on behalf of Oomi Oy are also recorded. Phone call recordings are kept for 25 months. Sales calls to potential customers that do not lead to a customer relationship are kept for three months.

7  Regular disclosures of data and data transfer outside the EU or EEA

For the purposes described in this privacy statement and within the limits permitted and required by legislation, official regulations and instructions issued by industry associations that are in force at the time, personal data may be disclosed to the authorities, other energy companies operating on the electricity market, property owners and housing managers as well as parties to an electricity supply and sales contract, for example.

Personal data may also be disclosed to cooperation partners carefully selected by the controller (e.g. outsourced customer service) for purposes that support the purposes of personal data processing described in the Marketing Register.

The controller may use subcontractors in data processing, and data is transferred outside the EU and EEA to a limited extent. When data is transferred outside the EU/EEA, the transfer is carried out by using the standard contractual clauses of the European Commission or other transfer mechanism permitted by legislation.

8  Data retention period

With regard to potential customers, customer data that is based on consent is retained until the customer withdraws their consent to receive direct marketing or opts out of direct marketing. With regard to external registers, the controller’s instructions are complied with.

The data is deleted in accordance with the deletion processes followed by the controller.

9  Principles of register protection

Personal data is protected by means that are generally acceptable and reasonable in the sector, such as with access passes, training, firewalls and passwords.

Only identified employees of the controller or companies acting on assignment by or on behalf of the controller have access to the personal data processed in the Marketing Register in accordance with the access rights granted by Oomi Oy. Oomi Oy takes into account the applicable legislation, official regulations and instructions issued by industry associations regarding ensuring confidential processing of personal data.

10  Rights of data subjects

Right of access

Pursuant to the General Data Protection Regulation, data subjects have the right to see what data is recorded about them in the Marketing Register. This right of access may be refused on grounds provided by law. Electronic data access requests must be sent by email to tietosuoja@oomi.fi.

Written data access requests must be submitted in person at the controller’s place of business, where the data subject’s identity will be verified.

Oomi Oy will charge a reasonable compensation for providing the data if the data subject uses their right of access more often than once a year.

Right to object to the processing of personal data

On account of their special personal situation, data subjects have the right to object to being profiled and to other processing measures carried out by the controller on the data subject’s personal data in so far as the data processing is based on the controller’s legitimate interest. When making the request, the data subject must identify the situation based on which they are objecting to the processing. The controller may refuse to fulfil the request concerning the objection on grounds provided by law.

Right to object to direct marketing

Data subjects may opt in or out of the controller’s direct marketing on a channel-by-channel basis.

Data subjects have the right to object to the processing of their personal data for the purposes of direct mail, distance selling and direct marketing as well as market research and opinion polls. The right to object does not apply to customer communications related to services subscribed to and ordered by the customer or other service-related communications carried out in order to offer services.

Right to request rectification or deletion of data or restriction of processing

Data subjects have the right to request Oomi Oy to rectify, delete or complete any personal data in the register that is incorrect, unnecessary, insufficient or outdated for the purpose of processing.

Data subjects also have the right to request the controller to restrict the processing of their personal data in situations such as when the data subject is waiting for the controller to reply to their request regarding the rectification or deletion of their data.

Data subjects are personally responsible for the correctness of the data they provide. Data subjects must notify the controller of any changes to the data they have provided.

Right to withdraw consent

If the personal data processing is based on the data subject’s consent, the data subject has the right to withdraw their consent by notifying Oomi Oy of this.

Right to transfer data from one system to another

In so far as the data subject has personally provided the register with data that is processed in order to fulfil the contract between the data subject and Oomi Oy or based on consent given by the data subject, the data subject generally has the right to receive the data in machine-readable format or transfer it to another controller.

11  Filing a complaint with the data protection supervisory authority

If the data subject deems that the processing of personal data is in breach of the applicable legislation or that the data subject’s statutory rights have been infringed upon, they may file a complaint about the matter with the relevant data protection supervisory authority. In Finland, the legality of personal data processing is monitored by the Data Protection Ombudsman, whose contact information can be found at the following address: www.tietosuoja.fi/en/home.

12  Changes to the privacy statement

We retain the right to change and update this privacy statement. The up-to-date privacy statements can be found on our website at oomi.fi/privacy-statements.

3 November 2020