Information about Senergia’s processing of personal data in its capacity as data controller in connection with direct marketing and similar measures.

Senergia Suomi Oy (reg. no. 2611019-5) may process a number of personal data in connection with direct marketing and similar measures in its capacity as data controller. It is the responsibility of a data controller to provide information about its processing operations.

1. What personal data is processed, for what purposes, what is the legal basis and how long is the data kept?

1.1 Direct marketing based on a balance of interests

In order to provide direct marketing of Senergia’s service offering to both existing and potential customers of Senergia, Senergia may process personal data relating to the customers’ representatives. The legal basis for this processing is a balance of interests in order to satisfy Senergia’s legitimate interest in informing about and offering various marketing activities to a selected target group for a limited time and to a limited extent. The data that may be processed is the name, address, telephone number and e-mail address of the workplace and any information on departmental affiliation and position. The information and the offer may be provided by telephone, letter, e-mail, SMS and/or similar communication channels. Where there is a contractual relationship between the data subject’s employer and Senergia, the processing will take place during the contractual relationship and for a period of twelve (12) months after the contractual relationship has ended. In the absence of such a contractual relationship, the personal data will be processed for a period of six (6) months. The data subject has the right to object to this processing at any time.

1.2 Direct marketing based on consent

In case Senergia wants to continue processing personal data for marketing purposes of representatives of potential and old customers (older than 12 months after the termination of the contractual relationship) after six months have passed from the time of collection, the consent of the data subject is required. If the data subject has provided such consent, the consent constitutes the legal basis for such processing. Where data subjects have voluntarily provided their personal data for a specific purpose and have been informed of the processing, the data subject is deemed to have consented to the processing. The data that may be processed are the name, address, telephone number and e-mail addresses of the workplace and any information on departmental affiliation and position. Information and offers on marketing activities may be provided by telephone, letter, e-mail, SMS and/or similar communication channels. The processing will take place for as long as the consent has not been withdrawn by the data subject. The data subject has the right to object to this processing at any time, thereby withdrawing their consent.

1.3 Implementation of marketing activity

If contact with the data subject has been made in accordance with the descriptions in points 1.1 or 1.2 above for the purpose of inviting to a marketing activity (event, lecture, seminar or similar) and the data subject has actively registered for the activity, Senergia will process personal data to the extent required to carry out the activity. This means that Senergia will process names and contact information in order to send out invitations, lists of participants and materials before and after the activity. In the event that meals will be served during the activity, information about special diets may need to be processed. The legal basis for this processing is that it is necessary to fulfill Senergia’s commitment when registering for the activity (agreement between the participant and Senergia). In addition, after the activity has been carried out, Senergia may, through Senergia’s sales and marketing department, follow up on who has participated in the activity by accessing participant lists and thereby be able to target marketing measures towards them. The legal basis for the latter processing is a balancing of interests in order to satisfy Senergia’s legitimate interest in directing offers of Senergia’s service offering to the participants. The list of participants is saved for administration and follow-up for a maximum period of twelve (12) months. The list of participants may also, where appropriate, form the basis for Senergia’s accounting in the context of accounting of any representation.

1.4 Media production for marketing

In order to market Senergia and spread knowledge about Senergia’s activities, Senergia may process personal data in the form of images – both still and moving images – and sound recordings. This processing is based on the explicit and informed consent of the data subject. The processing will take place during the time that the consent has not been withdrawn by the data subject.

1.5 Website interaction

When visiting Senergia’s websites, information from browsers can be both retrieved and stored, usually in the form of cookies, in order to optimize both the function and experience of the website. The information generally consists of the website visitor’s preferences and information about the device from which the visit takes place. However, there is no identification of the visitor. Even if there is no identification, the explicit and informed consent of the website visitor is required for Senergia to use cookies. If the website visitor has provided such consent, the consent constitutes the legal basis for such processing. The website visitor has the right to object to this processing at any time, thereby withdrawing his or her consent.

2. From where is the data collected?

Names and contact details of data subjects are collected from external sources of addresses and from the data subjects themselves.

3. Transfer and disclosure of personal data

In order to fulfill the purposes of Senergia’s processing of the personal data specified above, Senergia, where appropriate, engages IT service and system providers who process personal data on behalf of Senergia. These service and system providers may only process personal data according to Senergia’s explicit instructions and may not use the data for their own purposes. They are also required by law and contract to take appropriate technical and organizational security measures to protect the data.

Where appropriate, Senergia may also disclose personal data to recipients other than those listed above in order to comply with applicable laws and regulations, a request or order from a competent court or authority, and to satisfy Senergia’s legitimate interest in establishing, exercising and defending legal claims.

Senergia may also transfer personal data to recipients located in countries outside the EU/EEA that do not have the same level of personal data protection as the EU.

4. Protection of personal data

Senergia’s objective is to safeguard the protection of personal integrity and to take all the necessary technical and organizational measures to protect personal data and to ensure that processing operations are carried out in accordance with the applicable data protection legislation and internal guidelines, policies and procedures for handling personal data. This means that only those people who need access to the data to perform their duties have access to it. A more detailed description of Senergia’s security measures can be found in the attached sub-annex.

5. Rights of the data subject

5.1 Right of access (so-called register extract)

The data subject has the right to request a confirmation from Senergia if Senergia processes personal data relating to the data subject, and in such case request access to that personal data in the form of a so-called register extract.

5.2 Right to rectification

If the data subject considers that a piece of data relating to the data subject is incorrect or incomplete, the data subject also has the right to request rectification.

5.3 Right to object to processing for direct marketing purposes

In the case of the processing of the data subject’s personal data for direct marketing purposes, the data subject has the right to object at any time and request that the data subject be removed from further mailings by notifying Senergia, e.g. by clicking on an unsubscribe link in the mailing.

5.4 Right to object to processing based on Senergia’s legitimate interest

In addition to the above rights, the data subject also has, to the extent required by applicable data protection legislation, the right to object to processing based on Senergia’s legitimate interest. However, Senergia may continue to process the data subject’s personal data, even if the data subject has objected to the processing, if Senergia has compelling legitimate grounds for the processing which override the privacy interest.

5.5 Right to request restriction or erasure, alternatively the right to object to processing and data portability.

Under certain conditions, the data subject also has the right to request restriction or erasure of their personal data or the right to object to the processing. Under certain conditions, the data subject also has the right to obtain the personal data concerning the data subject that he or she has provided to Senergia in a structured, commonly used and machine-readable format (data portability) for transfer to another controller.

6. Contact person for questions

For questions about the processing of personal data, please contact Senergia at the following e-mail address mikaela.sundberg@senergia.se.

The data subject also has the right to turn to the supervisory authority (Datainspektionen) in case of complaints.