Data Protection Notice – VR Track – Customers, suppliers and partners
VR Track Ltd (hereinafter referred to as “VR Track”)
PO Box 488
FI-00101 Helsinki, Finland
Business ID: 1007822-3
tel. +358 307 10
VR-Group Ltd’s data protection officer
VR Track’s data protection contact person
Contact information, see above
Personal data of the contact persons and/or employees of VR Track’s customers, suppliers and partners is processed for the following purposes:
The processing of personal data about partners’ contact persons is based on:
A contract: We process the contact persons’ personal data for the performance of a contract that the partner is a party at.
A legal obligation: We process the customer’s personal data to fulfil our statutory obligations, such as those stipulated by the provisions for the retention of information in the Accounting Act and the special requirements laid down in the Act on the Contractor’s Obligations and Liability when Work is Contracted.
A legitimate interest: The processing of the personal data of a partner’s contact person may be based on a legitimate interest of the data controller when the data is used to manage and develop the customer relationship or to prevent and clarify irregularities.
Data about partners’ contact persons is collected from a company acting as a partner or from the persons themselves. In addition, personal data may be collected from and updated based on publicly accessible sources of data, such as company websites, the Trade Register, other public and private registers (e.g. Suomen Asiakastieto Oy, Posti Ltd, Fonecta Ltd) and other similar company or decision-maker registers.
Regarding this data protection notice, the categories of data subjects and related personal data categories include the following data about customer, supplier and partner companies’ decision-makers, employees and contact persons:
We use external parties to support the processing of personal data in the maintenance and development of IT systems, for instance. These service providers process personal data commissioned by us and on our behalf. The data processing follows current legislation and is always carried out in accordance with this data protection notice . This is ensured, among other things, through contracts between the organisations.
Without statutory or contractual grounds, we will not disclose customer, supplier or partner data to parties other than those participating in the production of VR’s or VR Track’s services.
Data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers having an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.
In data storage, the controller follows its statutory obligations. The practices of the storage of the personal data of partners’ contact persons depend on the grounds for the processing of the data.
As a data subject, you have a right to your personal data processed by VR Track. You can exercise your rights by contacting VR Track’s data protection contact person. You will receive a response to your request no later than one month after sending the request. We have listed below the rights of data subjects on a general level:
A data subject has the right to obtain confirmation whether their personal data has been processed by VR Track and to receive a copy of their personal data.
A data subject has the right to request VR Track to rectify inaccurate and erroneous data about them. The erroneous nature of data is to be decided on a case-by-case basis by resolving whether the data is erroneous from the viewpoint of its processing (unnecessary, incomplete, outdated).
A data subject has the right to request VR Track to erase their personal data. Requests will be handled on a case-by-case basis and data that VR Track has a legislation-based obligation or right to store will not be erased.
A data subject has a right in certain special situations stipulated by the regulation to request the restriction of the processing of their personal data.
A data subject has the right to object to the processing of their personal data if the processing is based on the controller’s legitimate interest or if personal data is processed for direct marketing purposes.
A data subject has the right to request VR to provide the data about them in machine-readable format. This right concerns data that is in electronic format and whose processing is based on either consent or the performance of a contract.
In situations in which the processing of a data subject’s personal data is based on consent, the data subject has the right to withdraw their consent. After the consent is withdrawn, the consent-based processing in question will be discontinued.
We seek to resolve any disputes primarily directly with data subjects. If a customer finds that we have not processed personal data as stipulated by law, the customer may lodge a complaint with a data protection authority.
The data security of VR’s and VR Track’s personal data processing as well as personal data confidentiality, integrity and accessibility are ensured with appropriate technical and organisational measures in accordance with VR’s data security principles. Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by VR to such tasks. We train and provide guidance to our employees involved in the processing of customer data in matters related to data protection.