Privacy policy for the supplier register

1. Data controller

Kaarea Oy (2925981-7)
PL 180, 20101 Turku, Finland
Other contact details: www.kaarea.fi, tel. switchboard +358 20 764 9850

2. Contact person for matters concerning the register

Riikka Samuli
Postal address: PL 180, 20101 Turku; Finland
Visiting address: Lemminkäisenkatu 48, 20520 Turku, Finland
Other contact details: riikka.samuli@kaarea.fi, tel. switchboard +358 20 764 9850

3. Name of the register

Kaarea’s supplier register

4. Purposes and legal basis for processing personal data

Personal data is used for managing and maintaining supplier relationships and for contract management. The processing of personal data is based on the performance of a contract.

5. Legitimate interests of the data controller or a third party

–

6. Data content of the register

The register may contain the following information: the last name, first names, telephone number, and email address of the supplier’s contact person.

7. Regular sources of information

The information entered in the register is based on information provided by the supplier’s contact person.

8. Recipients of personal data

Personal data is processed only by Kaarea personnel.
Personal data may also be disclosed within the limits permitted and required by applicable law, for example to authorities that have the right to access the data.

9. Transfers to third countries and related safeguards

No data will be transferred outside the EU/EEA.

10. Data retention period and applicable retention criteria

Personal data is retained in the register until the supplier relationship between the data subject and Kaarea can be considered to have ended. The end date is determined from the expiry of the supplier’s delivery agreement or the most recent service interaction or contact, to which a period of five years is added. Information related to purchase invoices is retained for the duration required by applicable accounting legislation.

11. Principles of data protection

The register is stored electronically and the original agreements are also stored in paper form. Access to the register’s data is restricted to certain individuals to the extent required by their duties.

The data processed in information systems is protected from external use by means of information network access rights and user-specific access rights. IT equipment is located in secure and monitored facilities.

Manually processed data is retained under supervision in files or filing systems and stored in locked cabinets with restricted and monitored access.

12. Rights of the data subject

The data subject has the right to access, correct, and request the erasure of their personal data in accordance with Kaarea’s data protection principles. The data subject may, at any time and on grounds relating to their particular situation, object to the processing of personal data concerning them. Requests for objection must be addressed in writing to the contact person for the register.

13. Automated decision-making and profiling

The register does not involve automated decision-making or profiling.