PRIVACY STATEMENT – PARCEL SERVICES AND OFFICIAL LICENSE DOCUMENTS
Oy Matkahuolto Ab
Business identity code 0111393-9
P.O. Box 100
Tel. 020 710 5000
(Hereinafter “Matkahuolto” or “We”).
Parcel Services mean shipping of goods in Finland by Matkahuolto and the handover of consignments to consignees. Delivery of official license documents means the delivery of official licenses undertaken by Matkahuolto to its designated pick-up points and government offices in Finland as well as the handover of such license documents to recipients at Matkahuolto’s designated outlets.
Matkahuolto is the controller of the personal data processed by it in connection with the provision of Parcel Services. As the controller, Matkahuolto is responsible for all the personal data that it processes in connection with Parcel Services. As data protection is about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto, in its capacity as the controller, only collects personal data to the extent necessary to be able to offer you first-rate service.
In connection with the processing of personal data as part of the provision of official services, Matkahuolto serves as the processor of personal data. When delivering official license documents, Matkahuolto is not in a position to exercise any independent decision-making powers as to the means and purposes of the processing of personal data; instead, Matkahuolto acts in accordance with the instructions and guidelines issued by the controller.
A more detailed description of the ways in which your personal data is processed and the purposes of such processing is provided in this privacy statement.
Oy Matkahuolto Ab
Customer Service Centre
P.O. Box 100
In connection with Parcel Services, Matkahuolto process the personal data of the consignors and consignees of the consignments or their representatives or persons authorised by them (data subjects) when such processing is necessary to enable Matkahuolto to provide the Parcel Services. The following data is processed:
- Full name of the consignor (or his/her representative) and the consignee (or his/her representative);
- Information required for the dispatch of the arrival notice to the consignee, such as telephone number, e-mail address and/or street address, as applicable;
- Delivery address of the consignment, if applicable;
- Information on the content of the consignment, if applicable;
- The number of the identification document presented when the consignment is collected or the suffix of the consignee’s personal identity number required for the positive identification of the consignee;
- Where applicable, the name of the representative authorised by the consignee; the authorisation that Matkahuolto will retain as an attachment to the handover list, as well as number of the identification document or the suffix of the consignee’s representative’s personal identity number required for the positive identification of the representative;
- Invoicing or payment information including bank details, as applicable;
- Any objection to or permission for direct marketing filed by the data subject.
- Any changes to the foregoing information as applicable.
1. Purposes of processing personal data
In its capacity as the controller, Matkahuolto processes personal data for the purposes of providing the service, meaning sending and receiving addressed consignments, sending arrival notices and crediting COD payments as well as for the positive identification of individuals.
Additionally, Matkahuolto processes personal data for the purpose of managing and developing customer relationships, investigating any instances of misuse, filing or defending any legal claims, as well as for direct marketing purposes to the extent permitted by law provided that the data subject has not forbidden the use of his/her personal data for direct marketing purposes.
The suffix of the personal identity number is saved in Matkahuolto’s system in order to positively identify the consignee and, if necessary, verify at a later date that the person handing over the consignment or making the delivery has duly checked the consignee’s identity.
2. Legal basis for the processing of personal data
In its capacity as the controller, Matkahuolto processes personal data when necessary for the performance of a contract to which the data subject is party or based on Matkahuolto’s legitimate interest. As consignees of parcels delivered by Matkahuolto or consignees’ representatives, the data subjects have a relevant connection with Matkahuolto’s operations, which means that Matkahuolto is authorised, on the basis of a legitimate interest, to process the consignees’ personal data in its capacity as the controller. Additionally, the processing of personal data may be necessary for the fulfilment of Matkahuolto’s statutory obligations (Road Transport Agreements Act 345/1979).
When official license documents are shipped, the controller bears ultimate responsibility for the personal data processed in connection with the delivery of the license documents whereas Matkahuolto serves as the processor of personal data. When serving as the processor of personal data, Matkahuolto processes the personal data of consignors and consignees in accordance with the instructions and guidelines issued by the controller.
3. Data subject’s obligation to provide proof of identity
The Road Transport Agreements Act imposes detailed requirements as to the minimum information that the consignor or carrier is required to enter in the shipping document. The delivery or disclosure of this information to Matkahuolto is based on the obligations laid down in the Road Transport Agreements Act.
Under the Road Transport Agreements Act, Matkahuolto is liable for ensuring that the consignment is handed over to the consignee indicated in the shipping document. The consignment is handed over to the consignee identified in the shipping document or a person authorised by the same against acknowledgement of receipt. The consignee’s identity (or that of any authorised representative) and any authorisation to collect the consignment are verified on handover and the suffix of the personal identity number recorded.
If the consignee (or a person authorised by the same) refuses to provide proof of identity and disclose the suffix of his or her personal identity number to Matkahuolto as described in this privacy statement, Matkahuolto is unable to verify the consignee’s or his/her representative’s identity and will therefore not release the consignment.
Informed is disclosed to Matkahuolto by the consignor, Matkahuolto’s partner or authority whose consignments Matkahuolto carries.
When handing over the consignment, Matkahuolto verifies the identity of the consignee or the person authorised by the same. In this connection, Matkahuolto receives personal data directly from the data subject: To positively verify the identity the consignee or the person authorised by the same, Matkahuolto records the number of the identity document or the suffix of the personal identity number of the person involved.
Matkahuolto may transfer data subjects’ personal data to third parties for the purposes described in this privacy statement as explained below. When doing so, Matkahuolto ensures, through contractual arrangements, that the processor of personal data processes that data exclusively in accordance with the instructions issued by Matkahuolto and exclusively for the purposes indicated in this privacy statement. Also, Matkahuolto ensures that access to personal data is limited to persons who need to access it for work-related reasons.
Matkahuolto’s delivery chain in Finland (partner carriers and distributors) and service network (dispatch and pick-up points): Matkahuolto may transfer personal data to its partners and subcontractors in the delivery chain to the extent they need such data to carry out the duties assigned to them, such as the carriage, handover and distribution of parcels and dispatch of arrival notices or customer satisfaction surveys.
Processors of personal data: Matkahuolto may transfer personal data to processors for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance or other data processing tasks.
No personal data will be transferred to outside the European Union or the European Economic Area.
The Road Transport Agreements Act and relevant international logistics agreements impose detailed requirements as to the minimum information that the consignor or carrier is required to enter in the shipping document. This information contained in the shipping document is regularly disclosed by Matkahuolto to its partners in the delivery chain in connection with consignments destined to other countries. The categories of personal data disclosed in this context are as follows:
- Full name of the consignor (or his/her representative) and the consignee (or his/her representative);
- Information required for the delivery of the consignment, such as the consignee’s telephone number, e-mail address and/or street address, as applicable;
- Additionally, the acknowledgement by the consignee (or his or her authorised representative) is re-transmitted to the consignor in accordance with the transport agreement.
Personal data is also disclosed to competent authorities, such are border authorities and the customs subject to the authorities’ statutory right of access to information.
Matkahuolto submits the information in encrypted format over a secure technical interface.
In connection with international deliveries, information may also be disclosed to outside the EU and EEA depending on the country or countries in which the consigner and its partners or subcontractors are based.
Manually processed data is kept in locked rooms at Matkahuolto sites.
The register data is saved in a database that may only be accessed by specifically designated controller’s staff members who need to access such data for work-related reasons, have received adequate training and who are bound by a statutory or contract-based non-disclosure obligation.
The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are protected through technical means.
All the data communications between the browser and server environment is encrypted.
Access to servers and applications is restricted through role-based access control management.
Matkahuolto or a processor of personal data who carries out processing of such data on behalf of Matkahuolto in connection with Parcel Services retains the personal data of data subjects in accordance with applicable legislation for only as long as the retention of data is necessary to achieve the purpose of the processing of personal data.
As a rule, the personal data processed in connection with Parcel Services is retained in Matkahuolto’s operational systems for 18 months, after which the data is archived. As the maximum period allowed for filing action under the Road Transport Agreements Act is three years, Matkahuolto archives all the data related to Parcel Services for at least three years. Access to archived data is closely restricted.
The suffix of the consignee’s personal identity number (or that of a person authorised by the same) is retained for 18 months.
Personal data forming part of accounting information is retained for the period of time required under accounting legislation.
When Matkahuolto no longer needs the personal data for the original purposes, the data is erased from Matkahuolto’s and processor’s IT systems and other files or irrevocably anonymised.
The EU General Data Protection Regulation guarantees data subjects a number of rights that they can exercise to determine how their personal data is processed. The data subject may exercise the following rights in respect of Matkahuolto insofar as Matkahuolto serves as the controller of personal data.
- Right of access: The data subject has the right to receive a confirmation from Matkahuolto as to whether Matkahuolto processes his or her personal data and to access such data. Matkahuolto may request the data subject to formulate his or her request in more detail regarding the procedure for the delivery of the data, etc.
- Right to correct personal data: The data subject has the right to correct any errors in the personal data processed by Matkahuolto or complete any incomplete data. When requesting a correction, the data subject needs to be aware that all information cannot be changed retroactively by such request. For example, the contents of the decisions concerning the data subject’s benefits cannot be amended. Specific appeal procedures exist for such decisions as explained in each individual decision.
- Right to be forgotten: If there is no longer any legal basis for the processing of personal data or a statutory or contractual provision obligating Matkahuolto to retain personal data ceases to apply, the data subject has the right to demand that Matkahuolto erase his or her personal data and Matkahuolto is required to comply with the request.
- Limitation of processing: In certain cases stipulated by law, the data subject may have the right to demand that Matkahuolto limit the processing of his or her personal data.
- Right to transfer personal data: Subject to certain statutory provisions, the data subject may have the right to receive from Matkahuolto the personal data concerning him or her in Matkahuolto’s possession in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from Matkahuolto.
- Right to object to the processing of one’s personal data: Additionally, subject to certain conditions, the data subject may have the right to object to the processing of his or her personal data in situations in which processing is based on Matkahuolto’s legitimate interest, and Matkahuolto is required to comply with such a request unless Matkahuolto demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
- Direct marketing and the right to forbid the processing of personal data for direct marketing purposes: The data subject has the right to forbid the processing of his or her personal data for direct marketing purposes.
- If the data subject has given his or her consent to receiving direct marketing material from Matkahuolto, he or she may cancel such consent at any time.
- The data subject may check and correct his or her personal data using the electronic services provided by Matkahuolto, such as the mobile application, or by contacting Matkahuolto’s Customer Service Centre mentioned in section 1 of this privacy statement. Any requests for the erasure, transfer or limitation of the use of the personal data or objection to direct marketing must be submitted to Matkahuolto’s Customer Service Centre.
Matkahuolto will take prompt action in response to the data subject’s request and will provide the data subject with information on the exercise of rights normally within one month of receipt of the request.
Additionally, the data subject has the right to lodge a complaint concerning the processing of personal by Matkahuolto with the data protection authority. Any complaint must be filed with the competent authority, in Finland with the Data Protection Ombudsman in accordance with the instructions provided by the same. Address of the Data Protection Ombudsman’ website: http://www.tietosuoja.fi.
Matkahuolto reserves the right to update and revise this privacy statement. Unless otherwise provided by law, Matkahuolto may not necessarily notify the data subject of such changes personally, and Matkahuolto therefore urges data subjects to check this private statement from time to time for any changes.