Privacy Policy for Customers and Partners


You have the right to object, on grounds relating to your particular situation, to the processing of your personal data at any time when we process your data based on our legitimate interests or for direct marketing purposes. Please see sections 3 and 8.6 of this document for further information.

1 INTRODUCTION

We (the Ensto group company acting as a controller as indicated in Section 2 below) are committed to protecting the privacy and security of your personal information. This privacy policy describes how we collect and use personal information about you, in accordance with the General Data Protection Regulation (GDPR).

This policy applies to all Ensto group companies’ business-to-business customers, suppliers, distributors, vendors, and other business partners (jointly referred to in this document as “stakeholders”). This policy does not form part of any contract nor does it establish any obligation to provide services. We may update this policy at any time and will make an updated version available to you.

It is important that you read this policy, together with any other privacy policy we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

2 CONTROLLER INFORMATION

This policy concerns personal data that one or more Ensto group companies process about you in the role of a controller. For example, if you are Ensto Oy’s customer, Ensto Oy processes your customer data as a controller. In case you are also a customer of Ensto Finland Oy, said company also acts as the controller of the customer data they hold about you.

Please find below a list of controllers, whose processing is governed by this policy.

In case you are uncertain about which company or companies act as the controller(s) of your personal data, please contact the Data Protection Responsible, privacy@ensto.com.

Ensto group company

Contact details

Contact person / Managing Director

email

Czech Republic

     

Ensto Czech, s.r.o.

Industry Zone Cestlice Obchodni Street 107, 25101 Prague-Vychod, Czech Republic

 Jacek Wagner

cz.privacy@ensto.com

Estonia

     

Ensto Ensek AS

Paldiski mnt 35/4A, 76606 Keila, Estonia

 Peter Mõrd

ee.privacy@ensto.com

Ensto Ensek AS

Taevakivi3/5. Tallinn 13619, Estonia

 Peter Mõrd

ee.privacy@ensto.com

Ensto Lighting Oü

Pärnuvälja 3 b, 72720 Paide

 Heimo Tammiste

ee.privacy@ensto.com

EMG Ensto Estonia Services OÜ

Paldiski mnt 35/4A, 76606 Keila, Estonia

Viljar Laidvee

ee.privacy@ensto.com

Finland

     

Ensto Oy

Ensio Miettisen katu 2, 06100 Porvoo, Finland

Ari Virtanen

fi.privacy@ensto.com

Ensto Chago Oy

Ensio Miettisen katu 2, 06100 Porvoo, Finland

 Juha Stenberg

fi.privacy@ensto.com

Ensto Finland Oy

Ensio Miettisen katu 2, 06100 Porvoo, Finland

 Marko Aarttila

fi.privacy@ensto.com

Ensto Invest Oy

Ensio Miettisen katu 2, 06100 Porvoo, Finland

Ari Virtanen

fi.privacy@ensto.com

Ensto Lighting Oy

Hepolammentie 25, 08680 Lohja, Finland

 Jukka Tiitu

fi.privacy@ensto.com

France

     

Ensto France SAS

RD 916, 66170 Nefiach, France

 Jean-Luc Mombreux

fr.privacy@ensto.com

Ensto Novexia SAS

210 rue Léon Jouhaux, BP 10466, 69656 VILLEFRANCE-SUR-SAÔNE CEDEX, France

 Mathieu Givelet

fr.privacy@ensto.com

Ensto Chago SAS

1 Boulevard Pierre Zmyslony, 27200 Vernon, France

Juha Stenberg

fr.privacy@ensto.com

Germany

 

 

 

Ensto Chago Deutschland GmbH

Mendelssohnstrasse 10, 81215 Munich, Germany

Sven Meder

de.privacy@ensto.com

Ensto GmbH

Siemensallee 84, Bau 39, 76187 Karlsruhe, Germany

 Janne Näränen

de.privacy@ensto.com

Great Britain

     

Ensto UK Ltd

Link House, Ninelands Lane, Garforth, Leeds, LS25 1NT, Great Britain

 Markku Wederhorn and Marko Aarttila as Directors of Company

uk.privacy@ensto.com

Hungary

   

 

Ensto Elsto KFT.

Komp u. 3, 1044 Budapest, Hungary

 Tibor Lakatos

hu.privacy@ensto.com

India

     

Ensto India Private Limited

Plot No. 241-242, Sector 6 IMT Manesar, Gurgaon, Haryana- 122050, India

 Ashok Kaushik

in.privacy@ensto.com

Italy

     

Ensto Italia S.r.l.

Via F. de Filippi, 3, 20129 Milan, Italy

 Aki Nevalainen

it.privacy@ensto.com

Ensto Elettrica S.r.l.

Via Zara, 42, 20032 Cormano (MI), Italy

 Marco Mariani

it.privacy@ensto.com

Kazakhstan

     

Ensto Kazakhstan LLP

050034, Almaty, Str. Brodskogo, 37 A, office 209, Republic of  Kazakhstan

 Andrey Zherebyatyev

kz.privacy@ensto.com

Latvia

     

AS Ensto Latvija

Gustava Zemgala gatve 71 Riga, LV1039, Latvia

 Uldis Kaugers

lv.privacy@as.com

Lithuania

     

Ensto Lietuva, UAB

A. Juozapaviciaus 6/2, LT-09310 Vilnius, Lithuania

 Rimantas Klimavicius

lt.privacy@ensto.com

Norway

     

Ensto Nor AS

Prof.Birkelands vei 26a, 1081 Oslo, Norway

 Svein-Arill Laksesvela

no.privacy@ensto.com

Poland

     

Ensto Pol Sp. z o.o

ul. Starogardzka 17A, 83-010 Straszyn, Poland

 Jacek Wagner

pl.privacy@ensto.com

Russia

     

OOO Ensto Rus

Tallinskoye shosse 206, 198 205 St. Petersburg, Russia

 Tatiana Novatskaya

ru.privacy@ensto.com

Slovakia

     

Ensto Czech, s.r.o.

 Jurkovicova 415, Batizovce, Slovakia

 Jacek Wagner

cz.privacy@ensto.com

Spain

     

Ensto Canal S.A.

Poligono Padrosa, Sector C2, Calle HispanoSuiza No 1,2,3,5,i 6, 17730 Llers, Spain

 Jean-Bernard Vitaux

es.privacy@ensto.com

Sweden

     

Ensto Sweden AB

Västberga allé 5, 126 30 Hägersten, Sweden

 Gunnar Engström

se.privacy@ensto.com

Ukraine

   

 

Ensto Ukraine, PrJSC

12A Poliarna St. Kyiv, 04655, Ukraine

 Alla Klymenko

ua.privacy@ensto.com

USA

   

 

Ensto USA LLC

5952 Peachtree Industrial Boulevard, Suite 13, Norcross, GA 30071, United States

 Michael Eck

us.privacy@ensto.com

3 PUROSES AND LEGAL BASES OF DATA PROSESSING

Purpose

Legal basis

  • Creating, maintaining and enhancing Ensto group companies’ products, services and stakeholder relationships, and providing services related thereto
  • Processing is necessary for the purposes of our legitimate interests to market, create and enhance our business, undertake risk assessments, undertake stakeholder due diligence, personalise our services and communication, update stakeholder details and preferences, execute logistics and transfer data to companies within and outside the Ensto Group to better serve our stakeholders and allocate our resources; and/or
  • Your consent; and/or
  • Processing is necessary for the performance of our contract with you (for example performance of R&D services) or in order to take steps at your request prior to entering into a contract
  • Providing products and services and stakeholder management
  • Processing is necessary for the performance of our contract with you (for example to deliver agreed goods); and/or
  • Processing is necessary for the purposes of our legitimate interests to execute risk assessments, undertake stakeholder due diligence, personalise our services and communication, market, execute logistics and transfer data to companies within and outside the Ensto Group to better serve our stakeholders and allocate our resources
  • Complying with contractual obligations
  • Processing is necessary for the performance of our contract with you 
  •  Business management and planning
  • Processing is necessary for the purposes of our legitimate interests to handle claims and solve disputes, undertake accounting obligations, undertake auditing obligations as well as strategic planning and resource analysis
  •  Account management
  • Processing is necessary for the performance of our contract with you; and/or
  • Processing is necessary for the purposes of our legitimate interests to execute risk assessments, undertake stakeholder due diligence, personalise our services and communication, market, and transfer data between companies within the Ensto Group to better serve our stakeholders and allocate our resources
  •  Organizing events
  • Processing is necessary for the purposes of our legitimate interests to create, enhance, and market our business and communicate with stakeholders; and/or
  • Your consent
  • Stakeholder communications and surveys
  • Processing is necessary for the purposes of our legitimate interests to market, to create and enhance our business, and to personalise our services and communication
  • Crisis Communication towards stakeholders
  • Processing is necessary for compliance with our legal obligations (for example to inform you of any data breaches)
 
  • Complying with legal obligations stemming from the Accounting Act (1336/1997) among others
  •  Processing is necessary for compliance with our legal obligations (for example to keep proper and accurate books)
  • Supporting network and system security
  • Processing is necessary for compliance with our legal obligations; and/or
  • Processing is necessary for the purposes of our legitimate interests to monitor data traffic and network security
  •  Analyzing key sales performance indicators
  • Processing is necessary for the purposes of our legitimate interests to market, to create and enhance our business, undertake risk assessments, personalise our services and communication, and to update stakeholder details and preferences
  • Legal processes and compliance with court orders, and protection of Ensto group companies rights
  • Processing is necessary for compliance with our legal obligations; and or
  • Processing is necessary for the purposes of our legitimate interests to protect our intellectual property and other rights against third-party claims or requirements from the authorities
  • Mergers and acquisitions where we are involved
  • Processing is necessary for the purposes of our legitimate interests to develop and manage our business
  • Identification purposes
  • Processing is necessary for compliance with our legal obligations (for example to make sure personal data are not disclosed to the wrong person)
  • Direct marketing of Ensto group companies’ products and services (including newsletters), informing of events organized or attended by Ensto group companies such as fairs
  • Processing is necessary for the purposes of our legitimate interests to market, create and enhance our business and personalise our services and communication; and/or
  • Your consent
  • Historical research
  • Public interest; and/or
  • Processing is necessary for the purposes of our legitimate interest to draft historical reviews and chronicles concerning our development over the years and as such satisfy a general interest of knowledge; and /or
  • Your consent

4 CATEGORIES OF PERSONAL DATA AND THEIR RETENTION PERIODS

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. We may also be required to retain data longer than described below if necessary for an ongoing legal process or to comply with a decision from a court or authority.

Details of retention periods for different aspects of your personal information are available below.

Category of data

Retention period

  • Name of stakeholder, name and title of contact persons/representatives of stakeholder, Ensto group companies’ contact person, and contact details of the aforementioned: address, telephone number, email 
  • Retained for 10 years from the last communication related to the stakeholder relationship
  • Please note that if you, e.g., have opted-out of or withdrawn its consent to receive newsletters or other marketing messages from us, we may need to save certain data longer than 10 years to make sure we respect your wishes
  •  Permissions and consents
  • Retained for 10 years from the last communication related to the stakeholder relationship
  • Please note that if you, e.g., have opted-out of or withdrawn its consent to receive newsletters or other marketing messages from us, we may need to save certain data longer than 10 years to make sure we respect your wishes. 
  • Contractual details including goods and services provided
  • Retained for 10 years from the last communication related to the stakeholder relationship
  • Sales information 
  • Retained for 10 years from the last communication related to the stakeholder relationship
  •  Contact requests and claims
  • Retained for 10 years from the last communication related to the stakeholder relationship
  •  Results of customer surveys
  • Retained for 2 years from the end of the survey 
  •  Payment information
  • Retained for 10 years from the last communication related to the stakeholder relationship
  • Photographs 
  •  Deleted immediately after the termination of stakeholder relationship, unless used for historical research or for the purposes of protecting our intellectual property rights against third-party claims or for requirements from the authorities. In the latter case photographs are used as proof/statement of use of our brands. When photographs are stored for said purposes, they are appropriately protected, and their use is limited for the purposes of historical research and protection of rights
  • Passport or other ID card information 
  • Retained for 6 months from acquiring the information 
  • Event-related personal information required for a person to participate in an event organized by an Ensto group company, such as handicap information for golf tournaments 
  •  Deleted immediately after the event
  • Health data and allergies 
  • Deleted immediately after (i) an event for which such data has been collected or (ii) your visit to the Ensto group company’s premises for which such data has been collected
  • Video surveillance material (video recorded only outside Ensto group companies’ premises for general security purposes)
  • Retained for max. 1 year, unless a longer period is necessary under applicable law  
  • Newsletter or other direct marketing subscriptions and analytics (e.g. about how many times you have opened a marketing email)
  •  Deleted immediately once subscription is cancelled (except to the extent we need to save data to make sure we respect your wish not to receive direct marketing messages from us)
  • Payment history 
  • Retained for 10 years from the last communication related to the stakeholder relationship

5 SOURCES OF PERSONAL DATA

We collect your personal data mainly directly from you, but also from the following sources:
• External contact lists obtained from customers, suppliers, distributors, vendors and other business partners as well as during seminars, events, and exhibitions
• Ensto group companies
• Publicly available sources: LinkedIn, company websites
• A third party as part of a merger or an acquisition

The provision of personal data is not mandatory but may be required in order for us to provide services and products to you, enter into a contract with you, communicate with you and personalize our marketing and communications to suit you best. Once you have entered into an agreement with us, the provision of personal data may also be implicit contractual requirements in order for us to comply with its contractual obligations. In case you do not provide us the data we request, we might not be able to do business with you or contact you, and thus we may be forced to terminate our contractual or other relationship with you.

6 RECIPIENTS OF PERSONAL DATA

• Outside legal counsels
• Tax and other relevant authorities
• Auditors
• IT system management service provides
• Information security service providers
• Ensto group companies
• Event organizers
• Business partners: distributors, suppliers and vendors, business-to-business customers in case you have permitted us to use you/your company as reference
• Third party as part of a merger or an acquisition

Please note that while most recipients are located in Finland or elsewhere in the EU or EEA, some of the above-listed recipients may be located or process data in third countries, depending on the person whose data is being processed and the situation at hand. If we and/or our service providers processing data on our behalf transfer your personal data to countries outside the EU or the EEA, the transfer is subject to standard data protection clauses adopted by the EU Commission or other appropriate safeguards such as binding corporate rules, unless the EU Commission has found that the level of data protection is adequate in the country in question. You can obtain a copy of said safeguards by contacting the contact person referred to in section 2 above.

7 PROFILING

We may use cookies and similar technologies when we send out newsletters and marketing messages to collect and analyze user activity details and preferences. Based on our findings we may, for example, provide you with tailored marketing messages. For more information about the cookies we use and how you can choose not to be subject to them, see our cookie policy at https://www.ensto.com/terms-and-conditions/cookies-policy/.

8 YOUR RIGHTS

8.1 Right of access

You have the right to obtain from us confirmation as to whether or not we process your personal data, and, when we do process such data, you have the right to obtain access to your personal data and the following information:
• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom personal data have been or will be disclosed, in particular recipients in countries outside the EU and EEA or international organizations;
• where possible, the envisaged period for which personal data will be stored or, if not possible the criteria used to determine that period;
• the existence of the right to request from us the rectification or erasure of personal data or restriction of processing of personal data concerning you or to object such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from you, any available information as to their source;
• the existence of automated decision-making and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you; and
• the appropriate safeguards applied to transfers of personal data to countries outside the EU and EEA

You have the right to receive a copy of the personal data undergoing processing as long as the copy does not adversely affect the rights and freedoms of others. For any further copies requested by you, we may charge a reasonable fee based on administrative costs.

8.2 Right to rectification

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.

You have the right to have your inaccurate personal data rectified by us without undue delay. You also have the right to have incomplete personal data completed.

We will communicate any rectification of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.3 Right to erasure (right to be forgotten)

You have the right to have your personal data erased by us without undue delay where one of the following grounds applies:
• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
• you object to the processing and there are no overriding legitimate grounds for the processing;
• you object to the processing of your personal data for the purposes of direct marketing;
• your personal data have been unlawfully processed; or
• the personal data have to be erased for compliance with a legal obligation to which we are subject.

Please note that the GDPR recognizes situations where processing may be necessary regardless of the applicability of the abovementioned grounds. We will always inform you separately of such circumstances and our grounds for processing.

We will communicate any erasure of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.4 Right to restriction of processing

You have the right to restrict the processing of your data in the following situations:
• you contest the accuracy of the personal data we process and as a result processing is restricted while the accuracy is verified;
• the processing is unlawful, but you oppose to the erasure of the personal data and instead request us to restrict their use;
• we no longer need the personal data for the purposes of the processing presented in this document, but the data are required by you for the establishment, exercise, or defence of legal claims; or
• you have objected to processing on grounds relating to your particular situation and such processing is legally based on our legitimate interests as presented in this document, and as a result processing is restricted while it is verified whether our legitimate grounds override those of yours.

If your processing has been restricted, we will inform you before the restriction is lifted.

We will communicate any restriction of processing to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.5 Right to data portability

You have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format (such as XML-format with relevant meta data), and you have the right to transmit such data to another controller, when:
• we process your personal data based on your consent; or
• we process your personal data because it is necessary for the performance of our contract with you; and
• we process such personal data by automated means; and
• this right does not adversely affect the rights and freedoms of others.

In the above situation, you also have the right to have your personal data transmitted directly from us to another controller, where that is technically feasible.

8.6 Right to object

You have the right to object to processing of your personal data at any time on grounds relating to your particular situation, if we process your personal data based on our legitimate interests as presented in this document. After such objection, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing and these grounds override your interests, rights and freedoms, or unless we need them for the establishment, exercise or defense of legal claims.

However, if your personal data are processed for direct marketing purposes, you have the right to object to such processing at any time. If you object to direct marketing, your personal data will no longer be used for such purposes.

In case you are a consumer, we will only send you electronic direct marketing, such as email newsletters, if you have given us your consent to do so (i.e. you have opted in to such marketing). You may withdraw your consent at any time as explained below, after which we will no longer process your personal data for electronic direct marketing purposes.

8.7 Right to withdraw your consent

If we process your personal data based on your consent, you have the right to withdraw such consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.

8.8 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in case we do not comply with applicable data protection legislation. The Finnish supervisory authority is the Data Protection Ombudsman (Fin: tietosuojavaltuutettu).

9 HOW TO CONTACT US

We are happy to assist you in case you have any questions or concerns over the processing of your personal data or the exercise of your rights. In order for us to provide you with sufficient information and pragmatic advice, we ask you to send your questions or comments in writing to the contact person privacy@ensto.com .

We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.