Privacy Statement for Prize draws and Competitions

Statement updated 27 December 2022

Oy Matkahuolto Ab
Business identity code 0111393-9

(Hereinafter “Matkahuolto” or “We”)

Matkahuolto may organise prize draws or competitions for its customers or other stakeholders in which the person participating in the prize draw or competition provides Matkahuolto with their name, contact details and other information that may be needed for the prize draw or competition. Prize draws can also be organised in connection with surveys or similar events.

Matkahuolto is the controller of the personal data that our customers or other persons provide us in connection with a prize draw or competition. As the controller, Matkahuolto is responsible for all personal data provided by you and the processing of this data. As data protection is about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto only collects personal data to the extent necessary for the purposes described below. A more detailed description of the ways in which your personal data is processed and the purposes of such processing is provided in this privacy statement. When we process your personal data for the purposes described below, you are the data subject referred to in the privacy statement and have, for example, the rights laid out in section 9.

If you want more information about how your personal data is processed in order to implement our electronic and non-electronic services, customer service and communications, please read the Privacy Statements for Matkahuolto Passenger Services and Parcel Services.

Oy Matkahuolto Ab
Customer Service Centre
P.O. Box 100
00101 Helsinki
Tel. 020 710 5000
tietosuoja@matkahuolto.fi

2. Personal data collected for prize draws or competitions

Personal data is collected from participants in prize draws and competitions organised by Matkahuolto, the processing of which is necessary for the implementation of the prize draw or competition, the selection of the winner and the delivery of any prizes. Depending on the subject of the prize draw or competition, the following personal data will be processed:

Name and contact details, such as name, email address, telephone number, street address, postal code and district
Identifying information about participation, such as the date of participation
Version, settings, identifier and browsing data of the hardware and browser used
Your choice of language

3. Basis for and purposes of the processing of personal data

In connection with prize draws and competitions, we collect information to be enable to conduct the prize draw, contact the winner of the prize draw and award the participants of the prize draw or competition. The information you provide at any given time (e.g. personal data, responses to surveys or polls, web browsing data) may be combined with your customer data if you are registered as a user of our electronic services. The data may be used for Matkahuolto’s business development, marketing, customer service and statistics. If you have not enabled our electronic services or do not participate in the prize draw or competition through your online account, we will not combine the personal data collected in connection with your use of our various services, in which case your data will only be processed for the purposes of the prize draw or competition in question.

The legal basis for the processing of personal data is the performance of the contract, i.e. the acceptance of the conditions of participation in the prize draw/competition.

Processing is also based on consent, and the purpose of processing based on consent is always clearly stated when consent is sought.

4. Electronic direct marketing

We will not use your personal data for the purposes of direct electronic marketing without your prior consent. If you have given your consent to direct electronic marketing, you have the right to withdraw your consent at any time and prohibit Matkahuolto from using personal data for direct electronic marketing. You can prohibit the use of your personal data for direct electronic marketing by contacting Matkahuolto’s Customer Service Centre.

Matkahuolto does not need to ask for your consent to direct electronic marketing if the information has been obtained on the basis of a previous customer relationship and in connection with a previous purchase. Information obtained on the basis of a previous customer relationship will only be used for the direct marketing of products or services belonging to the same product group and only for direct marketing by Matkahuolto. Even in such a situation, you have the right at any time to prohibit Matkahuolto from using your personal data for direct marketing purposes.

5. Regular sources of data

Matkahuolto collects information from the data subject in connection with participation in a prize draw or competition.

6. Transfers of personal data

Matkahuolto may transfer personal data to processors for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance or other data processing tasks. When transferring personal data to processors, we ensure, through contractual arrangements, that the party that processes personal data on our behalf does so only in accordance with the written instructions issued by us and exclusively for the purposes indicated in this privacy statement. We also ensure that access to personal data is limited to persons who need to access it for work-related reasons.

No personal data will be transferred outside the European Union or the European Economic Area. To receive more information on possible transfers of personal data and the applicable transfer criteria, please contact the customer service indicated in section 1 of this privacy statement.

7. Personal data protection policy

Manually processed data is kept in locked rooms at Matkahuolto outlets.

Electronic data is stored in a database that may only be accessed by specifically designated staff members of the controller or a party acting on its behalf, who need to access such data for work-related reasons, have received adequate training and are bound by a statutory or contract-based non-disclosure obligation.

The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are protected through technical means.

All the data communications between the browser and the server environment are encrypted. [Rivityskohta]Access to servers and applications is restricted through role-based access control management.

8. Storage period and erasure of personal data

The data of the participants in a prize draw will be kept for three months after the end of the prize draw. In accordance with the Lottery Tax Act, we will keep the data of the winners for the current year and the following five years. We will keep the data contained in our accounting records for the current year and the following six years.

9. Rights of data subjects

The EU General Data Protection Regulation guarantees data subjects a number of rights that they can exercise to determine how their personal data is processed. [Rivityskohta]Where processing is based on consent, you have the right to withdraw your consent. You can withdraw your consent by contacting tietosuoja@matkahuolto.fi. In addition to the right to withdraw consent, you have the following rights under the General Data Protection Regulation:

Right of access: The data subject has the right to receive a confirmation from Matkahuolto as to whether Matkahuolto processes his/her personal data and the right to check such data. Matkahuolto may request the data subject to formulate his/her request in more detail regarding the procedure for the delivery of the data, etc.

Right to correct personal data: The data subject has the right to correct any errors in the personal data processed by Matkahuolto or complete any incomplete data. When requesting a correction, the data subject needs to be aware that all information cannot be changed retroactively by such a request.

Right to be forgotten: If there is no longer any legal basis for the processing of personal data or the statutory or contractual provision obligating Matkahuolto to retain personal data ceases to apply, the data subject has the right to demand that Matkahuolto erase his/her personal data and Matkahuolto is required to comply with the request.

Limitation of processing: In certain cases stipulated by law, the data subject may have the right to demand that Matkahuolto limit the processing of his/her personal data.

Right to transfer personal data: Subject to certain statutory provisions, the data subject may have the right to receive from Matkahuolto the personal data concerning him or her in Matkahuolto’s possession in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from Matkahuolto.

The data subject may check and correct his/her personal data using the electronic services provided by Matkahuolto, such as the mobile application, or by contacting Matkahuolto’s Customer Service Centre mentioned in section 1 of this privacy statement. Any requests for the erasure, transfer or limitation of the use of the personal data or objection to direct marketing must be submitted to Matkahuolto’s Customer Service Centre.

Matkahuolto will take prompt action in response to the data subject’s request and will provide the data subject with information on the exercise of rights normally within one month of receipt of the request.

Additionally, the data subject has the right to lodge a complaint concerning the processing of personal data by Matkahuolto with the data protection authority. Any complaint must be filed with the competent authority, in Finland with the Data Protection Ombudsman in accordance with the instructions they provide. Address of the Data Protection Ombudsman’s website: http://www.tietosuoja.fi.

10. In conclusion

Matkahuolto reserves the right to update and revise this privacy statement. Matkahuolto will notify any changes in the processing of personal data in an appropriate manner. Matkahuolto is not generally obliged to individually notify data subjects of any changes, for example, when the provision of such information proves impossible or would require unreasonable effort (for instance, when there are no up-to-date contact details on the data subject). Therefore, the data subjects are occasionally encouraged to check this statement for any changes.