Privacy Policy for Potential Customers

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data at any time when we process your data based on our legitimate interests or for direct marketing purposes. Please see sections 3 and 8.6 of this document for further information.

1 INTRODUCTION

We (the Ensto group company acting as a controller as indicated in Section 2 below) are committed to protecting the privacy and security of your personal information. This privacy policy describes how we collect and use personal information about you, in accordance with the General Data Protection Regulation (GDPR) and Chapter 24 of the Finnish Information Society Code (Electronic Direct Marketing and Cookies).

This policy applies to all Ensto group companies’ potential business-to-business customers. This policy does not form part of any contract nor does it establish any obligation to provide services. We may update this policy at any time and will make an updated version available to you.

It is important that you read this policy, together with any other privacy policy we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

2 CONTROLLER INFORMATION

This policy concerns personal data that one or more Ensto group companies process about you in the role of a controller. For example, if you are Ensto Oy’s potential customer, Ensto Oy processes your customer data as a controller. In case you are also a potential customer of Ensto Finland Oy, said company also acts as the controller of the customer data they hold about you.

Please find below a list of controllers, whose processing is governed by this policy.

In case you are uncertain about which company or companies act as the controller of your personal data, please contact the Data Protection responsible at privacy@ensto.com.

3 PURPOSES AND LEGAL BASES OF DATA PROSESSING

4 CATEGORIES OF PERSONAL DATA AND THEIR RETENTION PERIODS

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. We may also be required to retain data longer than described below if necessary for an ongoing legal process or to comply with a decision from a court or authority.

Details of retention periods for different aspects of your personal information are available below.

5 SOURCES OF PERSONAL DATA

We collect your personal data mainly directly from you, but also from the following sources:
• External contact lists obtained from customers, suppliers, distributors, vendors and other business partners as well as during seminars, events, and exhibitions
• Publicly available sources: LinkedIn, company websites, portals for professionals
• Third party as part of a merger or an acquisition
• Cookies and other similar technologies. For more information, please see our cookie policy: https://www.ensto.com/terms-and-conditions/cookies-policy/

The provision of personal data is not mandatory but may be required in order for us to provide our services and products to you, enter into a contract with you, communicate with you and personalize our marketing and communications to suit you best. In case you do not provide us the data we request, we might not be able to market and provide our products and services with you or contact you.

6 RECIPIENTS OF PERSONAL DATA

• IT system management service provides
• Information security service providers
• Web and newsletter analytics companies
• Ensto group companies
• Event organizers
• Relevant authorities
• Third party as part of a merger or an acquisition

Please note that while most recipients are located in Finland or elsewhere in the EU or EEA, some of the above-listed recipients may be located or process data in third countries, depending on the person whose data is being processed and the situation at hand. If we and/or our service providers processing data on our behalf transfer your personal data to countries outside the EU or the EEA, the transfer is subject to standard data protection clauses adopted by the EU Commission or other appropriate safeguards such as binding corporate rules, unless the EU Commission has found that the level of data protection is adequate in the country in question. You can obtain a copy of said safeguards by contacting the contact person referred to in section 2 above.

7 PROFILING

We may use cookies and similar technologies when we send out newsletters and marketing messages to collect and analyze analytics, user browser history, user activity details and preferences. Based on our findings we may, for example, provide you with tailored marketing messages. For more information about the cookies we use and how you can choose not to be subject to them, see our cookie policy at https://www.ensto.com/terms-and-conditions/cookies-policy/.

8 YOUR RIGHTS

8.1 Right of access

You have the right to obtain from us confirmation as to whether or not we process your personal data, and, when we do process such data, you have the right to obtain access to your personal data and the following information:
• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom personal data have been or will be disclosed, in particular recipients in countries outside the EU and EEA or international organizations;
• where possible, the envisaged period for which personal data will be stored or, if not possible the criteria used to determine that period;
• the existence of the right to request from us the rectification or erasure of personal data or restriction of processing of personal data concerning you or to object such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from you, any available information as to their source;
• the existence of automated decision-making and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you; and
• the appropriate safeguards applied to transfers of personal data to countries outside the EU and EEA

You have the right to receive a copy of the personal data undergoing processing as long as the copy does not adversely affect the rights and freedoms of others. For any further copies requested by you, we may charge a reasonable fee based on administrative costs.

8.2 Right to rectification

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.

You have the right to have your inaccurate personal data rectified by us without undue delay. You also have the right to have incomplete personal data completed.

We will communicate any rectification of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.3 Right to erasure (right to be forgotten)

You have the right to have your personal data erased by us without undue delay where one of the following grounds applies:
• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
• you object to the processing and there are no overriding legitimate grounds for the processing;
• you object to the processing of your personal data for the purposes of direct marketing;
• your personal data have been unlawfully processed; or
• the personal data have to be erased for compliance with a legal obligation to which we are subject.

Please note that the GDPR recognizes situations where processing may be necessary regardless of the applicability of the abovementioned grounds. We will always inform you separately of such circumstances and our grounds for processing.

We will communicate any erasure of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.4 Right to restriction of processing

You have the right to restrict the processing of your data in the following situations:
• you contest the accuracy of the personal data we process and as a result processing is restricted while the accuracy is verified;
• the processing is unlawful but you oppose to the erasure of the personal data and instead request us to restrict their use;
• we no longer need the personal data for the purposes of the processing presented in this document, but the data are required by you for the establishment, exercise, or defence of legal claims; or
• you have objected to processing on grounds relating to your particular situation and such processing is legally based on our legitimate interests as presented in this document, and as a result processing is restricted while it is verified whether our legitimate grounds override those of yours.

If your processing has been restricted, we will inform you before the restriction is lifted.

We will communicate any restriction of processing to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.5 Right to data portability

You have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit such data to another controller, when:
• we process your personal data based on your consent; or
• we process your personal data because it is necessary for the performance of a contract to which you are a party; and
• we process such personal data by automated means; and
• this right does not adversely affect the rights and freedoms of others.

In the above situation, you also have the right to have your personal data transmitted directly from us to another controller, where that is technically feasible.

8.6 Right to object

You have the right to object to processing of your personal data at any time on grounds relating to your particular situation, if we process your personal data based on our legitimate interests as presented in this document. After such objection, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing and these grounds override your interests, rights and freedoms, or unless we need them for the establishment, exercise or defense of legal claims.

However, if your personal data are processed for direct marketing purposes, you have the right to object such processing at any time. If you object direct marketing, your personal data will no longer be used for such purposes.

8.7 Right to withdraw your consent

In the limited circumstances we process your personal data based on your consent, you have the right to withdraw such consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.

8.8 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in case we do not comply with applicable data protection legislation. The Finnish supervisory authority is the Data Protection Ombudsman (Fin: tietosuojavaltuutettu).

9 HOW TO CONTACT US

We are happy to assist you in case you have any questions or concerns over the processing of your personal data or the exercise of your rights. In order for us to provide you with sufficient information and pragmatic advice, we ask you to send your questions or comments in writing to the contact person privacy@ensto.com .

We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.