Privacy Policy

Consumer customer register

Privacy statement: Consumer customer register

Updated: 12 February 2020 

1. Data controller

Finnish Packaging Recycling RINKI Ltd (hereinafter referred to as “RINKI Ltd”)
Tynnyrintekijänkatu 1 C
FI-00580, HELSINKI FINLAND
Tel +358 9 616 230

(hereinafter referred to as “RINKI Ltd”)

2. Data file contact

Tel. +358 9 616 230

info@rinkiin.fi 

3. Name of the register

Consumer customer register 

4. Legal basis and purpose of processing personal data stored in the register

The legal basis for processing personal data stored in the register is the legitimate interest of the controller in developing the services.

Purpose of the register:

  • handling feedback provided by households regarding Rinki eco take-back points;
  • processing personal data for marketing purposes (except electronic direct marketing) in connection with campaigns organised by RINKI Ltd, such as raffles. 
5. Information content of the data file

Identification and basic information for handling feedback: first and last name, telephone number and email address, and correspondence with the contact person.

With regard to campaigns, only the (registered) person’s first and last name, telephone number and email address are processed. 

6. Data sources

A customer’s basic information is stored on the basis of a message or a phone call made by the registered person. The information collected during campaigns is also provided by the (registered) person participating in the campaign. 

7. Data disclosure and transfers of data outside the EU or the EEA

Personal data will not be disclosed for commercial purposes or processed outside the EU or the EEA. RINKI Ltd shall only make available to the authorities data concerning consumer customers as prescribed by law or other official decisions. If the use of services of RINKI Ltd’s subcontractor requires access to customer data, the data shall be transferred to the subcontractor for this purpose only and the subcontractor shall not disclose the data to third parties.

8. Retention and deletion of personal data

Personal data are stored for as long as it is necessary for the purpose of processing the data. Data collected in connection with campaigns shall be destroyed immediately after the end of that campaign unless the consent of the data subject to use the data for other purposes has been specifically requested or unless retention of the personal data is required by applicable law. Personal data stored in the consumer customer register may be processed and retained for 10 years from the date of customer contact.

The controller regularly assesses the need to store the data, taking account of the applicable laws.  The controller also takes reasonable measures to ensure that the data file does not contain any information about data subjects that is incompatible, outdated or incorrect in terms of the purposes of processing. The controller shall rectify or delete such information without delay. 

9. Principles of protecting the data file

RINKI Ltd strictly adheres to its duty of confidentiality. Only persons whose duties require the use of the register have access to it.

a. Hard copy

Hard copies are stored in a locked space in RINKI Ltd’s office. Only RINKI Ltd’s employees have the right to process data in hard copies.

b.  Data stored in information systems

Access to the register requires a user ID assigned by the database administrator. The administrator also determines the level of access to be granted to users. The use of the application requires an individual password. Access to the register and logins are monitored. The system is protected by a firewall against external threats. Databases are located in locked spaces and only certain pre-designated persons have access to the data.

The security of information systems at RINKI Ltd is based on information security laws and regulations, as well as related guidelines and recommendations.

10. Rights of data subjects

Data subjects have the right to check the data stored in the data file concerning themselves and to request the rectification or deletion of incorrect data if there are legal basis for this. If the processing of personal data is based on the consent of the data subject, the data subject has the right to withdraw this consent.

In accordance with the General Data Protection Regulation, data subjects have the right to object to or to request the restriction of the processing of their data and to lodge a complaint with the supervisory authority.

For particular personal reasons, data subjects also have the right to object to the use of their data for profiling and other types of processing when the processing is based on the controller’s legitimate interest. When filing the demand, the data subject must identify the specific situation that is the basis for the objection. The controller can only refuse to comply with the objection if it has legal grounds to do so. Data subjects also have the right to object to the processing of their personal data for direct marketing purposes at any time, including profiling when it is related to direct marketing.

11. Reviewing the privacy statement

Should we make amendments to this statement, we will upload the new statement to our website and indicate the date of the update. If the amendments are substantial, we may inform our customers of these by other means such as email or posting a notice on our website. We recommend that you visit our website on a regular basis and take note of any amendments to this policy.

Business customer and supplier register

Privacy policy, RINKI Ltd 22 May 2018

1. Data controller
Finnish Packaging Recycling RINKI Ltd
Tynnyrintekijänkatu 1 C
FI-00580, HELSINKI FINLAND
Telephone +358 9 616 230

(hereinafter ”RINKI Ltd”)

 

2. Data protection officer
Maija Peltola
Tel. +358 40 543 7007
info@rinkiin.fi

 

3. Register name
Business customer and supplier register

 

4. Legal basis for processing personal data in the register and the purpose of personal data usage
The bases for processing personal data stored in the register are the preparation and execution of a contract made with a customer or supplier and the data controller’s legitimate interest for the purposes of maintaining a customer or supplier relationship, invoicing, developing services and for direct marketing.

The main purpose of using the register is for the registration of producer responsible firms which supply packed products for the Finnish market and for the collection of packaging data and statistics. Personal data are collected for customer communication and customer relationship management as well as for notification of matters relating to producer responsibility for packaging. The data may also be used for the purposes of ascertaining RINKI Ltd’s own customer satisfaction or similar information unless the customer has refused permission for the use of their data for that purpose. Information collected about suppliers is used for communication with suppliers and to monitor and coordinate the services ordered from them. The data may also be used for electronic and other direct marketing.

 

5. Personal data in the register
Identification and basic information: The name, telephone number, email address of a firm’s contact person and the correspondence with that contact person.

 

6. Register data sources
Basic information stored about a customer or supplier are obtained from an agreement made with a firm, telephone calls or from other similar notifications made to the data controller during the customer or supplier relationship. Information about net sales, line of business and similar information may be obtained from producer firms or by other legal means permitted by data protection legislation.

 

7. Personal data transfers and transfer of data to outside of the EU or European Economic Area
Personal data are not transferred onwards nor to outside of the EU or European Economic Area. RINKI Ltd transfers for the use of the authorities only data about firms that the law or other regulatory decisions require to be transferred. If use of a RINKI Ltd subcontractor’s service requires the customer’s data, the data will be transferred to the subcontractor solely for that purpose and the subcontractor may not, without separate consent, transfer or pass this data on.

 

8. Storage and erasure of personal data
Personal data are stored in the register for as long as necessary depending on the purpose they are used for. Data stored in the business customer and supplier register are stored for the duration of the supplier contract or claims and proceedings submitted pursuant to the contract. As a rule, this period is three (3) years from the end of the customer or supplier relationship.

The data controller regularly assesses the need to store data taking into account the applicable legislation. In addition to this, the data controller takes reasonable measures to ensure that no obsolete or inaccurate data about the data subject that are incompatible with purposes for which they are processed are stored in the register. The data controller will immediately rectify or destroy such data.

 

9. Register protection principles
RINKI Ltd strictly complies with the prescribed confidentiality. Only those persons whose job description includes use of the register have access to the register.

a. Manual documents

Manual documents are stored in locked premises in RINKI Ltd’s office. Only RINKI Ltd’s employees have the right to process manual customer and supplier information.

b. Data stored in information systems

Access to the register requires user ID granted by the database administrator. The administrator also determines the access level granted to users. Use of the application requires a personal password. Register use and logins are controlled. The system is protected with a firewall against incoming external connections. The databases are in locked premises and only certain persons specified in advance can access them.

RINKI Ltd’s data security is based on the laws and decrees applying to data security and the data security instructions and recommendations issued.

 

10. Rights of data subject
The data subject has the right to access data concerning him or her stored in the personal register and to request the rectification or erasure of any inaccurate information where there are legal grounds for doing so. Where the processing of personal data is based on the consent of the data subject, he or she also has the right withdraw that consent.

Under the General Data Protection Regulation, effective as of 25 May 2018, the data subject has the right to object to or to request the restriction of the processing of his or her personal data and to complain to the supervisory authority about the processing of personal data.

On grounds relating to his or her particular situation, the data subject has the right to also object to profiling and other processing concerning him or her when processing the data is based on the data controller’s legitimate interest. In conjunction with the request, the data subject must specify the particular situation based on which he or she objects to processing. The data controller may refuse to take action on the objection requested solely on the grounds provided by law.

The data subject also has the right to object to the processing of his or her data for direct marketing purposes, including profiling related to this.

 

11. Amendments to the privacy policy
Should we amend this policy, we will post the new policy on our website and indicate when it was updated. If major amendments are made, we will also notify them in other ways such as email or by posting a notice about it on our website. We recommend that you visit our website regularly and note any amendments to the policy.

Information about cookies