Vantaa Energy’s district heat customer register

This privacy policy provides the information required by data protection laws to the registered person i.e. the customer of the registrar/controller and to the controlling authority.

1 Registrar/controller
Vantaan Energia Oy (“Vantaa Energy”)
Business (VAT) ID: FI01244613
Mailing address: PO Box 95, 01301 Vantaa, Finland
Telephone: +358 9 829 01
Online service: www.vantaanenergia.fi/en

2 Persons responsible for the register and their contact information
In charge of the register:
Lassi Kortelainen
Mailing address: PO Box 95, 01301 Vantaa, Finland
Street address: Peltolantie 27, 01300 Vantaa, Finland

Data Protection Officer
Heidi Itkonen
Mailing address: PO Box 95, 01301 Vantaa, Finland
Street address: Peltolantie 27, 01300 Vantaa, Finland

Data security inquiries
https://tietopalvelu.vantaanenergia.fi/kaukolampolomake

3 Title of the register
Vantaa Energy’s district heat customer register (“customer register”)

The persons registered are Vantaan Energy’s customers and potential customers. The registered person may be a private person, an entrepreneur, or a community.

A potential customer account is created when a person expresses interest towards Vantaa Energy’s services and consents to direct marketing at, for example, the Vantaa Energy website, drawing lots, trade fairs, and events or the sales desk.

4 The purpose and legal basis of processing personal information
The purpose of processing the personal information in the customer register is to manage the customer relations and assignments related to Vantaa Energy’s operations and business, to offer services and products, to sell and communicate them, as well as to assure, maintain and develop the quality of customer relations and existing and future services and products.

For the above purposes, personal information may be processed to manage Vantaa Energy’s customer relations as well as to analyze, offer, sell and develop the use of its services and products, to recognize customer accounts and registered customers, to compile statistics, to pursue customer and marketing communications, to market carefully selected partners’ products and services, and to survey opinions and markets.

In processing personal information, Vantaa Energy complies with applicable laws, including the Data Protection Act and EU’s General Data Protection Regulation (GDPR). Personal information may be processed to comply with obligations related to applicable laws and official orders and guidelines.

The legal basis for processing personal information is an agreement, consent, legal obligation, or legitimate interest pursued by the controller. Legitimate interests include production, support and development of business and services.

5 Information included in the register/data file
The following information related to a customer or other registered person (registrant) may be processed related to the customer register:

  • basic information about the registrant (including names, date of birth, social security number, address, business/VAT ID, account number, use location ID, user ID and/or other unique identifier, password, native language and gender);
  • information about contact persons in a company (including employer and professional status);
    contact information (including address, telephone number and email address);
  • information related to payments and invoicing (including billing, fees, transactions and debt collection, prospects, indemnity and credit inquiries);
  • information related to customer accounts and contracts (including contracts, orders and valid or terminated services, transactions, authorizations, contact records (such as phone calls and emails), correspondence with Vantaa Energy, other contacting, and marketing);
  • information about services and products (including orders, validity, changes and terminations, power failures, mobile services (as necessary), the registrant’s entries regarding personal interests, cookies and their use, and user profiles created based on the
  • information processed for the customer register);
  • information about district heat consumption (including annual consumption forecast and consumption reports);
    any other information collected with the consent of the registrant.
  • The following information related to potential customer registrations may be processed:
  • basic information about the registrant (including names, address, business/VAT ID, use location ID and/or other unique identifier);
  • information about contact persons in a company (including employer and professional status);
  • contact information (including address, telephone number and email address);
  • information related to customer accounts and contracts (including correspondence with Vantaa Energy and other contacting, and marketing);
  • information about services and products (including the registrant’s entries regarding personal interests, cookies and their use);
  • marketing bans and authorizations (including direct marketing ban, telemarketing ban, and consent to digital marketing);
  • any other information collected with the consent of the registrant.

6 Regular sources of data
Information about the registrant is regularly received from the following sources:

  • the registrant when they become a customer of Vantaa Energy, when they register for Vantaa Energy’s services, when they use Vantaa Energy’s services, or when any other factual contact is created between the registrant and Vantaa Energy;
  • the registrant when they request for an offer from Vantaa Energy or consent to add their information to the customer register of Vantaa Energy.
  • The information for the Vantaa Energy customer register may be collected, saved and updated from, for example, the Finnish Digital and Population Data Services Agency, Suomen Asiakastieto Oy, or other respective service provider’s register of addresses, updates and other information.
  • Personal information may be collected and updated from authorities and other third parties within the limits of applicable laws for the purposes described in this privacy policy.

Vantaa Energy records customer service calls to assure and improve customer service quality.

7 Regular disclosure of information
In order to produce services, personal information may be processed in the shared data systems of the Vantaa Energy Group for the purposes described in this privacy policy.

Personal information may be disclosed for the purposes described in this privacy policy and according to current legislation, official orders, and industry associations’ guidelines to, for example, authorities and property owners and managers.

Personal information may also be disclosed to such carefully selected partners’ purposes that support the use of personal information defined in the customer register.

8 Data retention period
Personal information data is retained only as long as is necessary for the purposes described in this privacy policy. In principle, contracts and any related information are retained for the length of the customer relationship. After this, the data is removed, except if the rights and obligations given by law or by a mutual contract require that we retain the information.

The retention period for customer data based on an agreement is ten (10) years.

The retention period for contact records is one (1) year.

For potential customers, the data based on consent is retained until the potential customer withdraws their consent. Regarding external registers, we comply with the guidelines of the registrar.

Data is removed in accordance with the registrar’s removal processes. After the contract period, the registrar may process personal information according to laws applicable to direct marketing.

9 Data transfer outside the EU or the EEA
Vantaa Energy does not transfer information to other than the countries of the European Union (EU) and the European Economic Area (EEA).

10 Principles of register/data file protection
Personal information is protected by reasonable means generally approved for the industry, including access control, training, firewalls and passwords.

Only the dedicated registrar or the employees assigned and managed by the registrar have access to the personal information processed in the customer register according to the user rights admitted by Vantaa Energy. Vantaa Energy takes into consideration the applicable laws, official orders, and industry associations’ guidelines to secure the processing of confidential personal information.

11 Right of inspection, prohibition and rectification
Based on the GDPR, the registrant has the right to inspect their personal information recorded in the customer register. A digital request to inspect can be submitted via digital form at https://tietopalvelu.vantaanenergia.fi/kaukolampolomake. A written request to inspect can be submitted in person at the registrar’s office where the registrant’s identity will be verified. If the registrant uses their right of inspection more than once per year, Vantaa Energy will charge a reasonable fee for their service.

Based on the GDPR, the registrant has the right to prohibit the use of their personal information for direct marketing and advertising, telesales, market surveys and opinion polls. This right of prohibition does not concern customer or other necessary communications related to the services ordered by the customer or other service-offering related communications.

Based on the GDPR, the registrant has the right to require that Vantaa Energy rectify, remove or amend any personal information included in the customer register that is incorrect, unnecessary, faulty or outdated for the purpose of data processing.

Based on the GDPR, the registrant also has the right to restrict the processing and transfer of their personal information to another registrar.

The registrant is personally liable for the accuracy of the information given. The registrant must inform the registrar of any changes to their personal information.

12 Filing a complaint to the supervisory authority
If the registrant thinks that the processing of their personal information violates the applicable laws or that their legal rights have been violated, they can file a complaint to the Data Protection Ombudsman whose contact information is available at www.tietosuoja.fi/en.