Oomi Oy’s Staff Register

This privacy statement provides data subjects, i.e. the controller’s staff, and the supervisory authority with the information required by data protection legislation on how and why Oomi Oy processes the personal data of its staff.

1  Controller

Oomi Oy
Business ID: 3101315-4
Postal address: Teknobulevardi 7, 01530 Vantaa, Finland
Website: oomi.fi

2  Persons responsible for the register and their contact information

Person responsible for the register
Mervi Rastinniemi

Data protection officer
Olli Turpeinen

Enquiries about data protection
Online data request form – Oomi (in Finnish only)

3  Name of register 

Oomi Oy’s staff register (‘the Staff Register’)

4  Purpose and legal basis of the processing of personal data 

The primary basis of the processing of personal data is the employer obligations imposed on the controller and the rights granted to employees in legislation. As an employer, Oomi Oy may, in order to fulfil its legal obligations and implement employment contracts, process the personal data of its employees in contexts such as the following:

  • measures related to the start of employment, such as drawing up the employment contract and confidentiality agreement;
  • measures related to the end of employment, such as preparing the certificate of employment;
  • measures related to leaves of absence, such as certificates of employment, Kela applications and study leave agreements;
  • implementation of the right to direct work;
  • payment of salaries and other benefits (such as a lunch benefit);
  • taking care of pensions and taxes;
  • working hours tracking;
  • management of instances of leave;
  • implementation of occupational health care;
  • measures related to maintaining the ability to work;
  • measures related to occupational safety;
  • bookings related to business trips and reimbursement of travel expenses;
  • taking out insurance policies;
  • taking care of statutory insurance policies.

In other respects, the processing of employees’ personal data is based on Oomi Oy’s legitimate interests related to maintaining and developing employment relationships. On this basis, personal data may be processed in contexts such as the following:

  • measures related to supervising and assessing work performance;
  • management of access rights and user IDs;
  • internal reporting, such as statistics and retention of historical data (including photographs);
  • various surveys (work atmosphere, registrations, etc.);
  • videos, podcasts, Teams recordings.

Oomi Oy’s legitimate interest is related to Oomi Oy’s role as employer as well as examination and development of its business. Oomi Oy’s legitimate interest may also be related to physical safety or data security or Oomi Oy’s need to protect its rights and property.

5  Data content of the register 

In the context of the Staff Register, Oomi Oy may process data related to data subjects: 

  • basic information about the data subject (such as names, date of birth, personal identity code, address, gender); 
  • data related to the use of systems; 
  • contact information (such as address, phone number and email address, and name and phone number of next of kin);
  • data related to the payment of salaries (such as data about salaries, working hours, the employment relationship and leaves of absence as well as data related to the tax card and bank account); 
  • data related to the person’s ability to work (such as instances of sick leave); 
  • data related to employment benefits (such as name, email address, phone number); 
  • photographs and videos (without a personal identifier); 
  • data related to working hours tracking and access control (such as name, clock-in and clock-out times, access routes, camera surveillance); 
  • basic information required for personnel surveys (name, email address, organisation details); 
  • any other information collected with the specific consent of the data subject. 

6  Regular sources of data 

Data concerning data subjects is regularly received from the data subjects themselves when they become employed by Oomi Oy, when they use Oomi Oy’s personnel services or when some other proper connection is established between Oomi Oy and the data subject (e.g. pensioners, board members). 

Personal data may also be collected and updated from the authorities and other third parties within the limits permitted by the applicable legislation for the purposes described in this privacy statement.  

7  Regular disclosures of data and data transfer outside the EU or EEA 

Personal data may be disclosed for the purposes described in this description of data file and within the limits permitted and required by legislation, official regulations and instructions issued by industry associations that are in force at any given time.  

Third parties that provide Oomi Oy with services related to HR may also have access to the data. Oomi Oy ensures, through contracts and agreements, that these parties do not process the personal data except in accordance with Oomi Oy’s instructions and this privacy statement.

Oomi Oy transfers data outside the EU/EEA to a limited extent. When data is transferred outside the EU/EEA, the transfer is carried out in accordance with the EU-US DPF or another transfer mechanism permitted by legislation.

8  Data retention period 

Data is retained only for as long as it is necessary to fulfil the purposes defined in this privacy statement. After this, the data is deleted, unless we are obligated to retain the data in accordance with legislation or the rights and obligations based on the contract between the parties.

9  Principles of register protection 

Personal data is protected by means that are generally acceptable and reasonable in the sector, such as with access passes, training, firewalls and passwords.  

Only identified employees of the controller or companies acting on assignment by or on behalf of the controller have access to the personal data processed in the Staff Register in accordance with the access rights granted by Oomi Oy. Oomi Oy takes into account the applicable legislation and official regulations regarding ensuring confidential processing of personal data.  

10  Rights of data subjects

Right of access

Data subjects have the right to see what data is recorded about them in the Staff Register. Any data access requests should be sent to Oomi at: Online data request form – Oomi (in Finnish only).

Right to object to the processing of personal data

On account of their special personal situation, data subjects have the right to object to being profiled and to other processing measures carried out by the controller on the data subject’s personal data in so far as the data processing is based on the controller’s legitimate interest. When making the request, the data subject must identify the special situation based on which they are objecting to the processing. The controller may refuse to fulfil the request concerning the objection on grounds provided by law. Any requests to object to personal data processing should be sent to Oomi at: Online data request form – Oomi (in Finnish only).

Right to request rectification or deletion of data or restriction of processing

Data subjects have the right to request that Oomi Oy rectify, erase or complete any personal data in the register that is incorrect, unnecessary, insufficient or outdated for the purpose of processing.

Data subjects also have the right to request that the controller restrict the processing of their personal data in situations such as when the data subject is waiting for the controller to reply to their request regarding the rectification or erasure of their data.

Data subjects are personally responsible for the correctness of the data they provide. Data subjects must notify the controller of any changes to the data they have provided. Any requests for rectification or erasure of personal data or restriction of processing should be sent to Oomi at: Online data request form – Oomi (in Finnish only).

Right to withdraw consent

If the personal data processing is based on the data subject’s consent, the data subject has the right to withdraw their consent by notifying Oomi Oy of this. Any requests to withdraw consent should be sent to Oomi at: Online data request form – Oomi (in Finnish only).

Right to transfer data from one system to another

In so far as the data subject has personally provided the register with data that is processed in order to fulfil the contract between the data subject and Oomi Oy or based on consent given by the data subject, the data subject generally has the right to receive the data in machine-readable format or transfer it to another controller. Any requests to transfer data from one system to another should be sent to Oomi at: Online data request form – Oomi (in Finnish only).

11  Filing a complaint with the data protection supervisory authority 

IIf the data subject deems that the processing of personal data is in breach of the applicable legislation or that the data subject’s statutory rights have been infringed upon, they may file a complaint about the matter with the relevant data protection supervisory authority. In Finland, the lawfulness of the processing of personal data is monitored by the Data Protection Ombudsman, whose contact information can be found at the following address: www.tietosuoja.fi/en/home.  

12  Changes to the privacy statement  

We retain the right to change and update this privacy statement. You can find the up-to-date privacy statement on our website at oomi.fi/en/privacy-statements/staff-register.

5 September 2024