PRIVACY POLICY

WHISTLEBLOWING CHANNEL

The following information describes the processing of personal data that takes place in connection with our handling of whistleblowing cases, as well as your rights as a data subject.

 

CONTROLLER

The Controller in relation to the processing of personal data is:

Balder Management Finland Oy, corp. ID no. 3362984-1

Mikonkatu 8A, 00100, Helsinki

Contact: tobias.hoglund@balderfinland.fi  / Phone: 0401979356

For additional information about our processing of personal data, please refer to our Privacy Policy.

 

PURPOSE AND LAWFULNESS OF THE PROCESSING

The purpose of the processing is to enable compliance with the statutory requirements imposed on the organisation with regard to the provision of a whistleblowing service, and to perform the investigations required in relation to whistleblowing cases. The purpose is also to process personal data where necessary in connection with the following up of whistleblowing cases. This means that we may need to process personal data in order to:

  • Handle reported whistleblowing cases,
  • Safeguard the rights and obligations of the organisation based on the instances of misconduct or impropriety detected in the whistleblowing cases, or
  • Comply with the statutory requirements imposed on the organisation.

 

CATEGORIES OF DATA SUBJECT

In connection with the handling of whistleblowing cases, processing of personal data may take place in relation to the following categories of data subject:

  • The person who reports a case, if he or she does not choose to remain anonymous,
  • The person or persons included in a report, or
  • The person who has an administrative role in relation to the processing and investigation of reported cases.

 

DISCLOSURE OF PERSONAL DATA AND PROCESSORS

Personal data may be disclosed to competent authorities (e.g. the Finnish Police if a whistleblowing case leads to the filing of a police report). Personal data may also be disclosed to other parts of the business or other companies within the group in connection with the investigation and following up of whistleblowing cases and actions taken in relation to such cases.

Personal data is also processed by Processors in connection with whistleblowing cases. These Processors may only act in accordance with our instructions. The service provider and the designated case handling group is the controller’s data processor and processes data with the assistance and on behalf of the controller. The service provider of the whistleblowing system is Ceriffi Check.

 

TRANSFERS TO THIRD COUNTRIES

We strive to ensure that personal data is not transferred to a country or company located outside the EU/EEA and that all storage of personal data relating to the content of whistleblowing cases takes place within the EU/EEA.

 

STORAGE AND CULLING

Personal data processed in connection with a whistleblowing case will be saved for as long as necessary in relation to the case.  

Personal data processed in order to manage administration and permissions will be saved for as long as the relevant permissions are valid.

All personal data is culled at the end of the storage period.

If a case requires continued investigation internally, we will continue to process your personal data for as long as necessary in relation to the case.

 

YOUR RIGHTS AS A DATA SUBJECT

When we collect and process your personal data, you have certain rights as a data subject. You have the right to:

  • Request a register excerpt with details of the personal data processed by the company and the way in which such data is processed;
  • Request rectification of any inaccurate personal data;
  • Request erasure of personal data. However, this can only be done if the company does not have the right to retain the personal data pursuant to some other lawful basis;
  • Request that the processing be restricted in certain circumstances, e.g. for the period of time during which an investigation is conducted into the issue of whether or not the personal data is accurate;
  • Exercise the right to data portability;
  • Object to profiling. This only applies to data that you have provided to the company, in circumstances where the data is subject to automated processing and is processed on the basis of a contract or consent; and
  • Contact an authorised supervisory authority if you wish to lodge a complaint about how we process your personal data.
  • Please note that your rights as described above may be affected by the duty of confidentiality that applies to whistleblowing-related data, as well as in cases where disclosure makes the investigation more difficult. The possibility to exercise your rights will be assessed on the basis of, among other things, the purpose and lawful basis of the processing in question.

If you have questions regarding the processing of your personal data, please contact us via the contact details provided in the first section of this document.