Privacy statement for procurements

Personal data is processed in Länsimetro Oy’s procurement processes which may relate to, for instance, market surveys and various phases of the procurement procedure, such as procurement planning, tender processing and comparing, and preparing contracts for signing.

Legal basis for personal data processing:

EU General Data Protection Regulation (EU GDPR), Article 6(1)(f)

Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

Market dialogue

• the data subject’s first and last name
• the name of the organisation the data subject represents (in some cases)
• the data subject’s email address
• the data subject’s phone number
• the data subject’s job title
• the first and last name of the reference organisation’s contact person
• the name of the reference organisation (in certain cases)
• the email address of the reference organisation’s contact person
• the phone number of the reference organisation’s contact person
• the job title of the reference organisation’s contact person

Negotiations, tenders, tender comparisons

• the data subject’s first and last name
• the data subject’s date of birth
• the name of the organisation the data subject represents (in some cases)
• the data subject’s phone number
• the data subject’s email address
• the data subject’s job title
• a photo of the data subject
• information appearing on the data subject’s CV, such as their work experience and educational background
• recordings: the data subject’s voice, video of the data subject
• the first and last name of the reference organisation’s contact person
• the name of the reference organisation (in certain cases)
• the email address of the reference organisation’s contact person
• the phone number of the reference organisation’s contact person
• the job title of the reference organisation’s contact person

In addition, Länsimetro Oy processes criminal record extracts in order to investigate the suitability of a supplier (Criminal Records Act [770/1993], Section 6 b), but does not save, store or make copies of them.

• the data subject’s first and last name
• the data subject’s personal identity code

PUBLIC ACCESS TO DATA AND CONFIDENTIALITY:

The data is only for Länsimetro Oy’s internal use.

BASIS FOR CONFIDENTIALITY:

– Criminal Records Act (770/1993)

Personal data is also obtained from publicly available registers and services, such as trade registers and Vastuu Group’s Reliable Partner report.

Personal data may be disclosed only to a requesting authority or if consent to disclose the data has been obtained.

Securing Länsimetro Oy’s contractual position requires procurement and contractual documents to be stored for a sufficiently long period of time.

Data is stored primarily in the following electronic systems:
– The Cloudia tendering system
– Länsimetro Oy’s SharePoint environment
– The ContractZen contract management system
– The secure network drive of Länsimetro Oy’s service pro-vider

B. MANUAL DATA:
Contracts and orders
Minutes

Data is stored primarily in Länsimetro Oy’s business premises.

PRINCIPLES OF DATA PROTECTION:

A. Electronic data
Electronic data is saved in an outsourced cloud service. User rights to cloud services are based on personal user rights, the use of which is monitored. User rights are granted for each task.

B. Manual data
The archive has access control and locked doors.

ARCHIVING AND REMOVAL OF DATA:
The storage, archiving, disposal and other handling of data takes place as instructed by Länsimetro Oy.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay where one of the grounds specified in Article 17(1), of the GDPR applies. The right to erasure does not apply if, for example, processing is neces-sary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in situations referred to in Article 17(3).

Right to request the restriction of processing (GDPR, Article 18)

The data subject shall have the right to obtain from the controller re-striction of processing where one of the grounds specified in Article 18(1)(a–d) applies.

Notification obligation regarding rectification or erasure of personal data or restriction of processing (GDPR, Article 19)

The controller shall communicate any rectification or erasure of per-sonal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data has been disclosed, unless this proves impossible or in-volves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

The right to object (GDPR, Article 21)

The data subject shall have the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The controller shall no longer process the personal data unless the controller demonstrates compelling legiti-mate grounds for the processing.

The complaint is addressed to the contact person for the data file (see section 4 above).