1. Contact details of the data controller for data protection matters

Data controllers

VAV Yhtymä Oy (company registration number 0640915-7) and its subsidiaries listed below, hereinafter referred to as the “data controller”

Contact details for data protection matters

Enquiries to the data controller’s data protection officer and in all matters relating to data protection may be sent using the following contact details:

email: tietosuoja@vav.fi

Address: VAV Yhtymä Oy, Data Protection Matters, Veturikuja 7, 01300 Vantaa

2. Data subjects and the content of the register

The register contains image material of persons moving within the premises, captured and recorded by cameras located in the customer service area of the Data Controller’s office. Areas covered by CCTV surveillance are marked with signs indicating this.

In addition to the images, the register records the date and time of the events. No other data is collected or stored in the register.

3. Legal bases and purposes for the processing of personal data

The data controller processes CCTV recordings for the following purposes and on the following legal grounds:

to ensure the safety and health of employees in accordance with the Occupational Safety and Health Act and regulations issued pursuant thereto

In accordance with the data controller’s legitimate interests and Section 16 of the Act on the Protection of Privacy in Working Life:

• to ensure the personal safety of employees and other persons present in customer service areas, to protect property, and to prevent and investigate situations that endanger safety and property
• CCTV monitoring of a customer service employee’s workstation is necessary to prevent an obvious threat of violence related to the employee’s work.

4. To whom data is disclosed or transferred

The data controller will not disclose data to external parties without the data subject’s consent, except where this is necessary to fulfil the data controller’s statutory obligations, in connection with a police investigation or legal proceedings, or at the request of the authorities.

The Data Controller has the right to use subcontractors in the processing of personal data in accordance with this policy, e.g. in the storage of recordings and other technical tasks related to CCTV surveillance, and to provide recordings and data to subcontractors for processing to the extent necessary for the provision of the subcontractor’s services.

Subcontractors process personal data on behalf of and for the account of the Data Controller in accordance with the Data Controller’s instructions. Subcontractors are bound by agreements concluded with the Data Controller concerning the processing of personal data, including provisions relating to confidentiality and data security.

Records are not processed outside the EU/EEA.

5. Principles governing the protection of the register and data retention periods

Only those persons who require the data to carry out their work duties are authorised to access it. Manual records are stored in locked premises commensurate with the level of data protection. Staff and subcontractors processing the data are bound by confidentiality obligations. The security of electronically stored data is based on

access rights management, technical protection of databases and servers, physical security of premises, access control, communication security and data backup. Access to the electronic data in the register by data processors is protected by personal usernames and passwords. Access and processing rights to the data are granted on the basis of job duties.

Recordings are retained for 14 days. Recordings required as evidence are retained until the matter has been concluded, for example, until a final judgement has been handed down.

6. The data subject’s rights to access, rectification and other rights

The data subject has the following rights under the General Data Protection Regulation:

• The customer has the right to access their personal data held in the register by submitting a request for access by email or in writing.
• The data subject has the right to request the rectification or erasure of data that is inaccurate, out of date, unnecessary or unlawful.
• Data subjects also have the right to withdraw their previously given consent to the processing of their personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

If the data subject has provided their personal data to the data controller and the processing is based on consent or a contract, they have the right to receive this data in a structured, commonly used and machine-readable format and the right to transfer the data to another controller in accordance with applicable legislation.

Where the processing of personal data is based on a legitimate interest, the data subject has the right to object to the processing of their data on grounds relating to their particular personal situation. When making such a request, the data subject must specify the particular situation on which the objection is based.

In situations specified by law, the data subject may request that the processing of their personal data be restricted, for example, by suspending it in whole or in part, where the data subject considers there to be uncertainty regarding the accuracy of the data or its processing.

Requests must be submitted in person, by post or by email using the contact details set out in paragraph 1. If necessary, the data controller may ask the data subject to clarify their request in writing and to verify their identity.

The data subject has the right to lodge a complaint regarding the processing of personal data with the Data Protection Commissioner.