Siirry sisältöön
Search

Privacy policy

Privacy policy of Pirkanmaan Jätehuolto Oy

1. Name of the register

Customer register of Pirkanmaan Jätehuolto Oy

2. Controller

Pirkanmaan Jätehuolto Oy, Business ID: 0968008-1 Kelloportinkatu 1, 33100 Tampere, Finland, Tel. 03 240 5110

3. Person responsible for processing personal data

Ari Kivelä, Data Protection Officer, c/o Pirkanmaan Jätehuolto Oy, Kelloportinkatu 1, Tel. 03 240 5006, Email: ari.kivela@pjhoy.fi

4. Purpose and legal grounds for which personal data is processed

Personal data is primarily processed for the performance of tasks provided for by the Waste Act. Personal data is processed to enable the provision of goods and services in accordance with the customer relationship and to fulfil the related legal obligations; to enable the management, administration, marketing and sales related to customer relationships and other partnerships; and for the planning and development of, and gathering of statistics for, each company and business owned by the Pirkanmaan Jätehuolto Group of Pirkanmaan Jätehuolto Oy.

Personal data can be used for communications, marketing, business development and other, similar purposes of Pirkanmaan Jätehuolto Oy or the subsidiaries belonging to the same group. Registered information may be analysed and used in conjunction with other information to form profiles and groups when providing information and/or benefits for the data subject. Information may also be transferred to any other customer register belonging to Pirkanmaan Jätehuolto Group.

Pirkanmaan Jätehuolto Group may outsource data processing to third-party service providers. Legal grounds for the processing of personal data comprise the following principles under the General EU Data Protection Regulation ((EU) 2016/679, hereinafter “GDPR”):

  • processing is necessary for the fulfilment of the customer contract with the data subject (GDPR, Article 6 1(b));
  • processing is necessary to comply with a statutory obligation of the controller (GDPR, Article 6 1(c));
  • processing is necessary in order to pursue the legitimate interests of the controller or a third party (GDPR Article 6 (1(f));
  • the data subject has given their consent to the processing of their personal data for one or more specific purposes (GDPR, Article 6 1(a));
  • processing, including the processing of data belonging to a special category of personal data, is necessary for the establishment, filing or defence of a legal claim (GDPR, Article 9, (2(f))

The aforementioned legitimate interest of the controller is based on a meaningful and appropriate relationship between the data subject and the controller, which arises when the data subject is in a customer relationship with the data controller and processing is done for purposes which the data subject could reasonably anticipate when the personal data was being collected and with regard to said appropriate relationship.

5. Contents of the personal data register

The register may contain data in the following categories, or changes to such data: Basic data such as: name, date of birth, email addresses, telephone numbers, addresses, property coordinates, waste collection coordinates, company name and contact information. Data related to the registration of the Service/Product or other goal-based activity, such as: Identification data related to the use of Pirkanmaan Jätehuolto Group’s services: customer number, username and password; data on services; customer feedback; product registrations (including warranty registrations); the start date of the customer relationship; invoicing, collection and warranty data; customer call recordings; direct marketing authorisations and prohibitions; as well as the activities of the data subject when using Pirkanmaan Jätehuolto Oy’s website and mobile services, including cookies downloaded to the browser and data obtained using cookies (such as the IP address and the data subject’s activities on the website); and the data subject’s activities on Pirkanmaan Jätehuolto Group’s social media channels.

6. Retention period of personal data

Data collected in the register shall be kept only for the time and to the extent necessary for the original or compatible purposes for which the data was collected.
Personal data gathered in accordance with this privacy policy shall be kept for as long as the controller uses the data for the purposes described in section 4. Personal data stored in the register is deleted when there are no longer legal grounds for its processing. The need for data retention is regularly evaluated by the controller in accordance with its internal code of conduct. In addition, the controller will take all reasonable steps to ensure that any personal data that is inaccurate, incorrect or no longer up to date for processing purposes is deleted or rectified without delay.

7. Regular data sources

Personal data is primarily collected from the data subject. Other sources of data include the Population Register Centre, the Property Register and the waste management authority. Most data is gathered from the data subject, either at the beginning or during the customer or other cooperative relationship. Data may also be collected by means of cookies and other similar technologies when a data subject uses a terminal device of some kind to access the electronic services of Pirkanmaan Jätehuolto Group. In addition, personal data may be collected from third parties to the extent permitted by law. Updates to personal data may also be obtained from the authorities, organisations and companies providing update services, and from public registers and other public sources.

8. Regular disclosures of data

Data may be disclosed or transferred to the Pirkanmaan Jätehuolto Group company and the waste management authority. Any transportation contractor awarded a tendered contract by the Pirkanmaa Jätehuolto Group will be provided with the customer’s name, waste collection address, collection bin information and, if necessary, other information relevant to providing the service.

9. Regular disclosures and transfer of data outside the EU or the EEA

As a matter of principle, personal data will not be transferred outside the EU or EEA and, when personal data is transferred, the controller will follow the model contractual clauses agreed by the European Commission regarding the transfer of personal data to third countries or other legal grounds.

10. Security of the personal data register

Under the personal access rights granted by the controller, only designated employees of the Pirkanmaan Jätehuolto Group, or employees of companies working for or on behalf of the Group, have access to applications that use the databases of registers containing personal data. Different levels of user accounts have been created for employees to enable them to perform their work tasks. The confidentiality obligation applicable to suppliers on the Pirkanmaan Jätehuolto Group’s customer register information system is fulfilled through agreements on managing systems.

Documents containing manually processed data, customer data, and partner-related data are stored in locked facilities after pre-processing. Only designated employees of the Pirkanmaan Jätehuolto Group, or employees of companies acting on its behalf, have access to manually processed data. All employees of the Pirkanmaan Jätehuolto Group, and employees of companies operating on its behalf or under an assignment issued by the Group, are under an obligation to treat all personal data obtained through their work as confidential.

11. Rights of the data subject

The data subject has rights under Finnish national data protection legislation, and the following rights under the GDPR:

  • the right to obtain confirmation from the controller of whether or not personal data concerning the data subject is being processed and, if such data is being processed, the right to access the personal data and to the following information: (i) the purposes of processing; (ii) the categories of personal data concerned; (iii) the recipients or groups of recipients to whom the personal data has been or is to be disclosed; (iv) where applicable, the intended period of retention of the personal data or, if this is not possible, the criteria for determining such a period; (v) the right of the data subject to present the controller with a request for the rectification or erasure of personal data concerning the data subject, or to restrict or object to the processing of personal data; (vi) the right to lodge a complaint with the supervisory authority; (vii) if personal data is not collected from the data subject, all available information on the origin of the data (GDPR, Article 15);
  • the right to withdraw consent at any time without prejudice to the lawfulness of processing carried out on the basis of the consent prior to its withdrawal (GDPR, Article 7);
  • the right to have inaccurate and erroneous personal data concerning the data subject rectified without undue delay by the controller and the right to have incomplete personal data supplemented, inter alia by providing additional clarification taking account of the purposes for which the data was processed (GDPR, Article 16);
  • the right to have the controller delete personal data concerning the data subject without undue delay, provided that (i) the personal data is no longer needed for the purposes for which it was collected or for which it was otherwise processed; (ii) the data subject withdraws the consent on which the processing is based and there is no other legal basis for processing; (iii) the data subject objects to processing on the basis of his or her specific personal situation and there is no valid reason for processing, or the data subject objects to processing for direct marketing purposes; (iv) personal data has been processed unlawfully; or (v) personal data must be deleted in order to comply with a legal obligation applicable to the controller under EU or national legislation (GDPR, Article 17);
  • the right to have the controller restrict processing if (i) the data subject contests the accuracy of the personal data, in which case processing shall be limited to the period during which the controller can verify its accuracy; (ii) processing is unlawful and the data subject opposes the deletion of personal data, instead requesting that the use of said data be restricted; (iii) the controller no longer needs such personal data for processing purposes, but the data subject needs it in order to establish, present or defend a legal claim; or (iv) the data subject has objected to the processing of personal data on the basis of his or her specific personal situation pending verification that the controller’s legitimate grounds override those of the data subject (GDPR, Article 18);
  • the right to access to personal data concerning him or her (and which the data subject has submitted to the controller) in a structured, commonly used and machine-readable format, and the right to transfer such data to another controller unhindered by the original controller to whom the personal data was transmitted, if such processing is based on the consent required by the GDPR and is performed automatically (GDPR, Article 20);
  • the right to lodge a complaint with the supervisory authority if the data subject believes that the processing of personal data concerning him or her infringes the EU’s General Data Protection Regulation (GDPR, Article 77).

Requests for the fulfilment of the data subject’s rights shall be addressed as set out in section 12.

12. Contacts

In all matters related to the processing of personal data and situations involving the exercising of the data subject’s rights, please contact rekisteriseloste@pjhoy.fi. A request can also be submitted to the controller’s office at Pirkanmaan Jätehuolto Oy, Kelloportinkatu 1, 33100 Tampere. If necessary, Pirkanmaan Jätehuolto may ask the data subject to provide further details about the request in writing, and if required, the data subject’s identity may be verified before other measures are taken.