1. Data controller
| Name | Bonnier Rights Finland Werner Söderström Ltd (hereinafter ”WSOY”) |
| Visiting address | Lönnrotinkatu 18 A, Helsinki, Finland |
| Mailing address | PL 1259, 00101 Helsinki, Finland |
| Telephone number | Tel. +358 10 5060 101 |
| Contact information in all data protection matters | Werner Söderström Ltd Data protection matters PL 1259 00101 Helsinki Finland tietosuoja@wsoy.fi |
2. Personal data and the purposes and grounds for their processing
WSOY collects and processes the following personal data of contact persons and other representatives of a company (hereinafter ‘Company’) that is its customer, subcontractor or partner:
- Basic information: name, professional title, position or role in the company, company details, work-related contact information (postal and visiting address, email address, phone number), language, preferred method of contact;
- Marketing information: information regarding tasks and positions in business roles, professional interests, other information provided by the data subject; marketing activities directed at the data subject, participation in events, direct marketing and other permissions and consents, as well as prohibitions and restrictions;
- Usage of Data in Electronic Services: marketing identifiers, etc., newsletter reading data, information on direct marketing link clicks; service usage and browsing data collected via cookies; the page from which the user accessed WSOY’s site, device model, unique device and/or cookie identifier, data collection channel (internet browser, mobile browser, application), browser version, IP address, session identifier, session time and duration, as well as screen resolution and operating system, country/city-level location;
- Profile and Classification Data: Customer/user and marketing segments and profiles created based on the analysis and profiling of the above-mentioned data, as well as classification and other data collected from regular data sources.
The collected data is processed for the purposes and legal bases:
- Based on the legitimate interest arising from the customer, supplier, or other relationship between WSOY and the Companies: establishing a customer or other relationship between WSOY and the Company (e.g., responding to inquiries, requests for quotations), managing, maintaining, and developing the customer relationship; planning and developing business, products, and services; and other communication based on the relationship between the Company and WSOY;
- Fulfilling WSOY’s statutory obligations;
- Based on WSOY’s legitimate interest: detecting, preventing, and investigating fraud, money laundering, and other crimes and abuses;
- Processing data collected from the use of WSOY’s online and mobile services via marketing and newsletter identifiers, or other similar technical tracking means for purposes defined in the privacy statement;
- Based on the legitimate interest of WSOY and its partners: marketing their products and services in their own and other Internet and mobile media, services, applications, and targeting advertising;
- Based on the legitimate interest of WSOY and its partners: analyzing, profiling, segmenting, and statistically processing the data subjects and their data in connection with and for the aforementioned purposes.
3. Where data is collected
Information is collected from the individual themselves or through other personal, electronic, or telephone interactions. Information can be collected from public sources.
4. To whom data is disclosed or transferred
WSOY may disclose registered data to other Finnish companies within the Bonnier Group for the purposes mentioned in this statement, and to partners when necessary to fulfill the purposes of the register, such as delivering and invoicing agreed licenses, products or services. Otherwise, data will not be disclosed to external parties without the consent of the data subject, except when necessary to fulfill WSOY’s statutory obligations, in connection with legal proceedings, at the request of authorities, or as part of business arrangements.
WSOY has the right to use subcontractors for the processing of personal data as described in this statement. In such cases, personal data may be transferred to subcontractors to the extent necessary for the provision of their services. WSOY uses subcontractors for the following tasks:
- ICT: IT infrastructure, information security and user management, electronic messaging services
- Operations management
- CRM, analytics, marketing, sales, and communication
- Financial management
Subcontractors process personal data on behalf of and for WSOY, in accordance with WSOY’s instructions and this privacy statement. WSOY ensures through contractual agreements that personal data is processed in compliance with legislation in the provision and implementation of their services.
Personal data may also be transferred for processing to a country outside the EU/EEA. Unless the European Commission has decided that the level of data protection in the processing country is adequate, WSOY ensures appropriate data protection by entering into written agreements with subcontractors using the European Commission’s approved standard contractual clauses or other lawful procedures. The standard contractual clauses can be found at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
5. Processing of company data
Communication and documents between WSOY and a Company that is its customer, subcontractor, or partner, as well as the information of the company’s representative, i.e., the contact person, contained therein, are not personal data but information describing the company and are not subject to data protection legislation. This includes, for example, communications, emails, electronic transaction forms, feedback, inquiries, requests for quotations, orders, and contracts.
6. Data protection of the register and data retention period
Only individuals who have the right to process data as part of their job are authorized to use the data. The data is stored in locked and access-controlled facilities. Electronic data is protected by firewalls, access control, and other technical means.
Personal data is retained as long as necessary for the intended purpose. Personal data related to the customer, supplier, or other relationship between WSOY and the Company is deleted after the relationship ends or after WSOY is informed that the data subject is no longer the Company’s contact person, with the following exceptions:
- Anonymized data may be retained permanently.
- Usage data of electronic services and communication related to the customer, supplier, or other relationship is retained for five years from the aforementioned date.
- Other usage data of electronic services collected via cookies is deleted according to the timeframes specified in the cookie consents.
- Basic information, marketing information, and profile and classification data of the data subject may be retained permanently for marketing purposes.
- Data may be retained in situations permitted by applicable legislation beyond the above-mentioned retention periods.
7. The right to inspection, the right to rectify and other rights of the data subject
The data subject can review and manage their personal data and other information, as well as data access rights, in certain WSOY services through their user account or by using the functions available in our services. Additionally, the data subject has the right to:
- Review the data stored about them in the register and request the correction, completion, or deletion of incorrect data in the register
- Prohibit the use of their data for direct marketing, opinion, and market research, including related profiling.
- Object to the processing of their personal data based on WSOY’s legitimate interest due to reasons related to their personal situation.
- Withdraw their consent for the processing of personal data.
- Transfer the data to another system in situations required by law.
- In situations defined by law, request the restriction of the processing of their personal data, for example, by suspending it entirely or partially when the data subject believes there is uncertainty about the accuracy of the data or its processing until the requests related to the data are clarified and resolved.
The data subject also has the right to file a complaint about the processing of their personal data with the Data Protection Ombudsman. The data subject can exercise these rights by sending written or email requests to WSOY (contact details are provided in section 1) or by presenting them to WSOY’s customer service with reliable identification. The request must include the data subject’s name, personal identification number, and contact details. To ensure data protection, the data subject must prove their identity upon request.