District heat customer register of Vantaa Energy Ltd

This privacy policy provides information to the data subject, i.e. the controller’s customer, and to the supervisory authority as required by the data protection legislation.

1 Controller

Vantaa Energy Ltd
Business ID: 0124461-3
Postal address: P.O. Box 95, 01301 Vantaa, Finland
Telephone: 09 829 01
Website: www.vantaanenergia.fi

2 Persons responsible for register matters and their contact details

Person responsible for the register
Lassi Kortelainen
Postal address: P.O. Box 95, 01301 Vantaa, Finland
Street address: Peltolantie 27, 01300 Vantaa, Finland

Data Protection Officer
Heidi Itkonen
Postal address: P.O. Box 95, 01301 Vantaa, Finland
Street address: Peltolantie 27, 01300 Vantaa, Finland

Data protection enquiries
https://tietopalvelu.vantaanenergia.fi/tietosuojavastaavalomake

3  Name of register

District heat customer register of Vantaa Energy Ltd (“Customer Register”)

The data subjects of the register are the customers and potential customers of Vantaa Energy Ltd. The data subject may be a private person, an entrepreneur or an organisation.

A potential customer relationship arises when a person expresses their interest in the services of Vantaa Energy Ltd and consents to direct marketing, for example, on the website, in prize draws, trade fairs and events or at the sales points of Vantaa Energy Ltd.

4  Purpose and legal basis of the processing of personal data

The purpose of processing personal data in the customer register is the management of customer relationships and tasks related to the business operations of Vantaa Energy Ltd, providing and selling of services and products and communicating about them, and ensuring, maintaining and developing the quality of customer relationships and existing and future services and products.

For the above-mentioned purposes, personal data can be processed for managing the customer relationships of Vantaa Energy Ltd and for analysing the use of services and products and for offering, selling and developing them, for identifying the customer relationship and data subjects, for statistical purposes, for customer and marketing communication, and for the marketing, opinion polls, and market research of the products and services of carefully selected partners.

Vantaa Energy Ltd complies with the applicable legislation in the processing of personal data, such as the Data Protection Act and the EU’s General Data Protection Regulation. Personal data may be processed in order to comply with the obligations related to the applicable laws, and official regulations and guidelines.

The legal basis for the processing of personal data is an agreement, consent, legal requirement or the legitimate interest of the controller. Legitimate interests include the production, support and development of business operations and services.

5  Data content of the register

In connection with the customer register, the following data related to the customer or another registered person may be processed:

  • basic data about the data subject (such as names, date of birth, personal identity code, address details, business ID, customer number, metering point ID, username and/or another identifier, password, mother tongue),
  • data concerning the contact persons of companies (such as information about the employer and the professional status of the data subject);
  • contact details (such as address details, telephone number and email address);
  • data concerning payment and billing (such as information concerning billing, fees, payment and collection, advance estimates, data concerning damages, and credit rating queries),
  • data concerning the customer relationship and contracts (such as data concerning the contract, order and existing and terminated services, transaction data, authorisation data, contact recordings (such as telephone and email recordings, correspondence and other contacts with Vantaa Energy Ltd, and marketing-related data);
  • data related to services and products (such as order, validity, amendment and termination data, fault data, necessary data related to the use of mobile services, data provided by the data subject concerning their interests, cookies and data related to their use, and user profiles created on the basis of data processed in connection with the Customer Register)
  • data concerning district heat consumption (such as the annual consumption forecast and consumption reports)
  • any other data collected separately with the specific consent of the data subject.

In terms of potential customers, the following data related to the data subject can be processed:

  • basic data about the data subject (such as names, address details, company’s business ID, metering point and/or other unique identifier);
  • data concerning the contact persons of companies (such as data about the employer and the professional status of the data subject);
  • contact details (such as address details, telephone number and email address);
  • data related to the customer account and contracts (such as correspondence and other communications with Vantaa Energy Ltd, and marketing-related data);
  • data related to services and products (such as data provided by the data subject themselves with regard to their interests; cookies and data related to their use);
  • marketing opt-outs and opt-ins (such as opting out of receiving direct marketing or telephone marketing, opting in to receiving digital marketing;
  • any other data collected with the specific consent of the data subject.

6  Regular sources of data

Data concerning data subjects is regularly received from

  • the data subject themselves when they join as customer of Vantaa Energy Ltd or register as a user of the services of Vantaa Energy Ltd, when the data subject uses the services of Vantaa Energy Ltd, or in the event of another appropriate connection between Vantaa Energy Ltd and the data subject;
  • the data subject themselves when they request a quote from Vantaa Energy Ltd or consent to adding the data in the Customer Register of Vantaa Energy Ltd;
  • data in the Customer Register of Vantaa Energy Ltd can also be collected, recorded and updated, for example, from the register of the Population Register Centre, Suomen Asiakastieto Oy or other controller offering address, updating and other similar services.

Personal data can also be collected and updated from the authorities and other third parties within the limits of applicable legislation for the purposes described in this privacy policy.

Vantaa Energy records the customer service telephone calls in order to ensure and develop the quality of customer service.

7  Regular disclosure of data

In order to provide services, personal data may be processed in the shared information systems of the Vantaa Energy Group for purposes in accordance with this privacy policy.

Personal data can be shared for purposes described in this privacy policy and to the extent permitted and required by existing legislation, regulations imposed by the authorities and the instructions of the industry associations, for example, with the authorities, property owners and housing managers.

Personal data can also be shared with partners that have been carefully selected by the controller for purposes that support the purposes of the processing of personal data described in the Customer Register.

8  Data retention period

The data shall be retained only for as long as it is necessary in order to fulfil the purposes defined in this privacy policy, mainly the contract and related data for the duration of the customer relationship. After that, the data shall be erased unless we are obliged to retain the data according to the rights and obligations based on legislation or an agreement between the parties.

The retention period of contact recordings and customer data based on the contract and those of future customers is ten (10) years.

The retention period of other contact recordings is one (1) year.

In terms of potential customers, consent-based customer data shall be retained until the customer withdraws their consent. In terms of outside registers, the instructions of the controller shall be complied with.

The data shall be erased in accordance with the erasure processes complied with by the controller. After the contractual relationship has ended, the controller may process personal data in accordance with legislation applicable for direct marketing purposes.

9  Transfer of data outside the EU or the EEA

Vantaa Energy does not transfer the data outside the EU or EEA countries.

10  Principles of register protection

Personal data is protected in the industry by generally acceptable and reasonable technical means, such as access passes, training, firewalls and passwords.

Only specified employees of the controller or companies authorised by or acting on behalf of the controller have access to the personal data processed in the Customer Register in accordance with the access rights granted by Vantaa Energy Ltd. Vantaa Energy Ltd takes into account the applicable laws and regulations of the authorities and the industry organisations’ instructions for ensuring confidential processing of personal data.

11  Right of inspection, prohibition and rectification

By virtue of the General Data Protection Regulation, the data subject has the right to inspect the data that has been recorded of them in the Customer Register. An electronic request to inspect this data shall be submitted at https://tietopalvelu.vantaanenergia.fi/kaukolampolomake

A written inspection request shall be made in person at the controller’s office where the data subject’s identity is verified. Vantaa Energy Ltd shall charge a reasonable fee for providing the data if the data subject uses their right of inspection more often than once a year.

By virtue of the General Data Protection Regulation, data subjects have the right to prohibit the processing and sharing of their personal data for purposes of direct advertising, distance selling, direct marketing, and market research and opinion polling. The right to prohibit does not apply to customer communications related to services subscribed to or ordered by the customer or to other service-related communications carried out in order to provide services. 

By virtue of the General Data Protection Regulation, the data subject shall have the right to request Vantaa Energy Ltd to rectify, erase or complement any personal data in the register that is incorrect, irrelevant, incomplete or out-of-date with respect to the purpose of processing the data.

The data subject also has the right to restrict the processing of personal data or its transfer to another controller by virtue of the General Data Protection Regulation.

The data subject is personally responsible for the accuracy of information they have provided. The data subject shall notify if there are any changes in the information they have provided. 

12  Lodging a complaint with the supervisory authority

Should the data subject believe that the processing of personal data infringes the applicable law or their legal rights, the data subject may lodge a complaint with the Data Protection Ombudsman, the contact details of which are found at the following address:  www.tietosuoja.fi/en

11.6.2024