Privacy policy of the Whistleblowing reporting channel of Vantaa Energy Ltd
This privacy policy provides information to the data subject and to the supervisory authority as required by the data protection legislation.
1 Controller
Vantaa Energy Ltd
Business ID: 0124461-3
Postal address: P.O.Box 95, 01301, Vantaa
Telephone: 09 829 01
Web service: www.vantaanenergia.fi
2 Persons responsible for register matters and their contact details
Data Controller
Vantaa Energy Ltd
Postal address: P.O.Box 95, 01301 Vantaa
Street address: Peltolantie 27, 01300 Vantaa
Data Protection Officer
Heidi Itkonen
Postal address: P.O.Box 95, 01301 Vantaa
Street address: Peltolantie 27, 01300 Vantaa
Data protection queries
https://tietopalvelu.vantaanenergia.fi/tietosuojavastaavalomake
3 Name of register
Reporting channel (Whistleblowing)
4 Purpose of processing personal data and the legal basis for the processing
The purpose of the processing of personal data is to process reports made via the Reporting Channel. Reports can be submitted by employees of the Group and by external stakeholders. Data is processed in the investigation of cases submitted in the reports and in the processing of any consequences.
Personal data is processed in order to fulfil statutory obligations and by virtue of the controller’s legitimate interests.
5 Data content of the register
The register includes data provided by the Group’s personnel or persons belonging to other stakeholder groups. This kind of data includes, e.g. the name, job title, telephone number, email, location data or other personal data related to the investigation/study if the reporter provides them via the reporting channel. It is also possible to add attachments, images and videos to the report.
The data subjects of the register are the persons submitting the report and those who are subject to the report, as well as the processors.
The register includes the following data with regard to the processors: name, job title, username and log data.
The Group has a team of a few people for the processing of reports, and the members of the team receive and process the reports. Depending on the nature of the report, the number of processors can be increased on a case by case basis.
6 Regular sources of information
The principal source of information is the reporting channel.
Reports can be submitted by employees of the Vantaa Energy Group or other possible stakeholders, such as, e.g. business partners of the companies in the Vantaa Energy Group or their representatives.
The processor collects personal data provided by the person submitting the report via the reporting channel or other channels. In addition, during investigations, personal data is collected from other internal systems of the Group, when necessary. In addition, during the investigation of the case, the controller collects necessary data related to the report from the parties concerned and from persons and organisations related to the events.
7 Regular supply of data
If an anonymous report requires further investigation and personal data has been submitted in the report, it can be shared with specified persons within the organisation who are responsible for the investigation.
As a rule, personal data is not shared outside the Group. However, if criminal activity is suspected, data shall be shared with the police and, for example, with the authorities within the limits permitted and obliged by effective legislation, regulations imposed by the authorities and the guidelines of the trade associations in force at any time
8 Data retention period
The data shall be retained only for as long as and to the extent that is necessary in order to fulfil the purposes defined in this privacy policy. After that, the data shall be deleted with the exception of when we are obliged to retain the data according to the rights and obligations based on legislation or a contract between the parties.
The reports and any personal data related to them shall be retained for two years after the investigation has closed. If the case results in legal proceedings, the data shall be retained for the period required by the proceedings.
The data shall be deleted in accordance with the deletion processes complied with by the controller.
9 Transfer of data out of the EU or the EEA
The data in the register is not transferred out of the EU or the EEA.
10 Principles of register protection
Personal data is protected in the industry by generally acceptable and reasonable technical means, such as access passes, training, firewalls and passwords.
Only specified employees of the controller or companies authorised by or acting on behalf of the controller have access to the personal data processed in the registry in accordance with the access rights granted by Vantaa Energy Ltd. Vantaa Energy Ltd takes into account the applicable laws and regulations of the authorities and the industry organisations’ instructions for ensuring confidential processing of personal data.
The system supplier of the anonymous reporting channel (WhistleB) processes personal data in a secure server room. WhistleB does not save IP addresses or other data that could be used for identifying the sender of the report. All reports are encrypted and only specified persons are allowed to decrypt the reports. Access to the reports is restricted, and the processors of reports are covered by the obligation of professional secrecy.
11 Rights of the data subject
By virtue of the General Data Protection Regulation, the data subject has the right to inspect what has been recorded of them in the register. An electronic request to inspect this data is sent to the address
https://tietopalvelu.vantaanenergia.fi/tietosuojavastaavalomake.
A request for an inspection may also be made in person in the controller’s office by proving the identity of the data subject. Vantaa Energy Ltd is entitled to charge a reasonable fee for providing the data if the data subject uses their right of inspection more often than once a year.
By virtue of the General Data Protection Regulation, the data subject has the right to request Vantaa Energy Ltd to rectify, delete or complete any personal data in the register that is incorrect, irrelevant, incomplete or out-of-date with respect to the purpose of processing the data. Moreover, subject to certain conditions, the data subject also has the right to restrict and object to the processing of personal data and the right to receive a notification of personal data breaches.
12 Lodging a complaint with the supervisory authority
Should the data subject believe that the processing of personal data infringes the applicable law or their legal rights, the data subject may lodge a complaint with the Office of the Data Protection Ombudsman, the contact details of which are found at the following address: www.tietosuoja.fi.