Processing of personal data in events organised by Mehiläinen

Publicerat: 5.2.2021
Uppdaterat: 19.2.2021

1 Controller

Mehiläinen Oy
Business ID 1927556-5,
Pohjoinen Hesperiankatu 17 C,
00260 Helsinki, Finland

2 Contact information in matters relating to the registers

Contacts in matters concerning the register: tietosuoja@mehilainen.fi. The Data Protection Officer of Mehiläinen Group is Kim Klemetti.

More information on the processing of personal data in Mehiläinen and contact information can be found on the Mehiläinen website at: https://www.mehilainen.fi/en/customer-register

3 Register name

The personal register of Mehiläinen’s events.

4 Purpose and grounds for the processing of personal data

Mehiläinen may organise various physical or virtual events in connection with which Mehiläinen processes personal data necessary for the organisation of the event.

Personal data is processed for the following purposes:

• Event registration and participation
• Communications
• To collect possible surveys, such as feedback
• To ensure the safety of events
• For other purposes necessary for the organisation of the event.

The processing of personal data is based on a legitimate interest of the controller, which arises when the event participant registers for the event or when the data subject contacts Mehiläinen in a matter related to the event.

If recruitment activities are carried out at the event, personal data will be processed in accordance with Mehiläinen’s recruitment-related privacy statement, which we ask you to familiarise yourself with in case the data subject participates in recruitment.

Processing tasks may be outsourced to Mehiläinen Group companies and/or external service providers in accordance with and within the limits set by the data protection legislation.

5 Register data content

The following information of the data subject, among others, may be stored:

• Name
• Email address
• Other necessary contact details, such as the street address
• Profession, when necessary
• Language or dietary information, if necessary
• Information related to the technical processing of the collected data, such as the date of recording and data source
• Other information necessary for the organisation of the event.

6 Personal data retention period

Mehiläinen shall retain personal data relating to the events until the event in question and the arrangements and other measures relating thereto have been completed.

If personal data have been collected in connection with recruitment activities, such data will be stored in accordance with Mehiläinen’s recruitment-related privacy statement.

7 Regular data sources

The information to be processed is the information provided by the data subject themselves.

8 Regular data transfers and transfers outside the European Union or the European Economic area

The data will be disclosed to Mehiläinen Group companies for the purposes described in section 4 of this privacy statement. If the data subject gives their separate consent to marketing, the data can also be used for electronic direct marketing.

Personal data shall not be disclosed on a regular basis outside Mehiläinen or to parties involved in the production, development or maintenance of services and communications on behalf of Mehiläinen for purposes other than those mentioned above, except in accordance with an agreement, separate consent and/or explicit regulations. However, if necessary, we may transfer personal data to a subcontractor who processes personal data on behalf of Mehiläinen.

Personal data may be transferred outside the European Union or the European Economic Area, including the United States, in accordance with and within the limits set by the data protection legislation.

9 Description of the principles of registry protection

Any manual material shall be stored in a locked space accessible only by persons who have been granted individual access. Access to digital material shall be granted only by means of the personal username and password of the authorised employee, private practitioner or partner. There are different levels of access rights and each user is granted access that is sufficient but as limited as possible to carry out the task.

10 Profiling

Personal data is not used for profiling or automated decision-making.

11 Right of the data subject to object to the processing of personal data and direct marketing (Prohibition right)

The data subject has the right, in relation to their special personal situation, to object to the processing operations, which Mehiläinen targets at the data subject’s personal data, in so far as the processing of the data is justified by the controller’s legitimate interest. The data subject may present their request for the prohibition in accordance with section 13 of this privacy statement. In connection with the request, the data subject must identify the special situation on the basis of which they object to the processing of data. Mehiläinen may refuse to implement the request for prohibition on statutory grounds.

The data subject may give channel-specific consent or prohibitions to Mehiläinen regarding direct marketing.

12 Other rights of the data subject regarding the processing of personal data

12.1 The data subject's right of access (inspection right)

The data subject has the right to inspect Mehiläinen’s customer register with respect to the stored data concerning them. The inspection request must be presented in accordance with section 13 of this privacy statement. The right to inspect the data may be denied on a statutory basis. In principle, exercising the inspection right is free of charge.

12.2 The data subject's right to demand rectification or erasure of data or restriction of the processing of data

The data subject has the right to demand rectification of incorrect or incomplete personal data. Insofar as the data subject cannot rectify the data themselves, the rectification request must be presented in accordance with section 13 of this privacy statement.

The data subject has the right to demand erasure of data, unless there is a special reason for storing the personal data.

The data subject also has the right to demand the controller restricts the processing of their personal data, such as when the data subject is waiting for Mehiläinen’s response to the request concerning the rectification or erasure of the data concerning them in the register.

12.3 Data subject’s right to transfer data from one system to another

Insofar as the data subject themselves has provided information in the customer register for processing on the basis of the data subject’s consent or commission, the data subject has the right to access such data mainly in machine-readable format and the right to transfer such data to another controller.

12.4 Data subject’s right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority if the controller has not adhered to the applicable data protection regulation in its operations.

12.5 Other rights

If the personal data is being processed on the basis of the data subject’s consent, the data subject has the right to withdraw the consent by notifying Mehiläinen of this in accordance with section 13 of this privacy statement.

13 Contacts

In all matters related to the processing of personal data and all situations regarding the exercise of the data subject’s own rights, the data subject should contact Mehiläinen at a Mehiläinen clinic or by post at the address: Mehiläinen Oy / Viestintä, Pohjoinen Hesperiankatu 17 C, 00260 Helsinki, Finland or by email tietosuoja@mehilainen.fi.

Mehiläinen can request the data subject further specifies their request in writing, and the identity of the data subject can be verified before taking any other measures, if necessary.