Privacy statement - Parcel services

Statement updated 13 June 2023

Oy Matkahuolto Ab
Business identity code 0111393-9
(Hereinafter “Matkahuolto” or “We”)

This privacy statement describes how Matkahuolto processes the personal data of its customers that Matkahuolto collects in connection with the parcel services it provides and the delivery of official license documents.

Parcel Services means the shipping of goods in Finland by Matkahuolto and the handover of consignments to consignees. Delivery of official license documents means the delivery of official licenses undertaken by Matkahuolto to its designated pick-up points and government offices in Finland as well as the handover of such license documents to recipients at Matkahuolto’s designated outlets.

Matkahuolto is the controller of the personal data processed by it in connection with the provision of Parcel Services. As the controller, Matkahuolto is responsible for all the personal data that it processes in connection with Parcel Services. As data protection is about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto, in its capacity as the controller, only collects personal data to the extent necessary to be able to offer you first-rate services.

A more detailed description of the ways in which your personal data is processed and the purposes of such processing is provided in this privacy statement. When we process your personal data for the purposes described below, you are the data subject referred to in the privacy statement and have, for example, the rights laid out in section 9.

In connection with the processing of personal data as part of the provision of official services, Matkahuolto serves as the processor of personal data. When delivering official license documents, Matkahuolto is not in a position to exercise any independent decision-making powers as to the means and purposes of the processing of personal data; instead, Matkahuolto acts in accordance with the instructions and guidelines issued by the controller.

If you would like more information about how your personal data is processed in connection with the passenger services provided by Matkahuolto or by carriers acting on our behalf, please refer to Matkahuolto’s Privacy Statement for Passenger Services.

If you would like more information about how your personal data is processed by Matkahuolto or by carriers and agents acting on our behalf, when providing assistance services to people with reduced mobility and disabilities at bus stations in accordance with EU Regulation No. 181/2011, please refer to the Privacy Statement for Assistance Services.

Some of Matkahuolto’s service outlets have recording camera surveillance, and customer information is also stored on camera surveillance recordings. For more information on the processing of personal data collected through camera surveillance, see Matkahuolto’s Privacy Statement for Camera Surveillance.

What is described in this privacy statement only applies to the ways in which Matkahuolto or the parties acting on its behalf process data. Please note that Matkahuolto’s electronic services may contain links to third-party websites or social network services and that Matkahuolto has no control over the activities of such third parties, and is not responsible for the privacy policies of such third-party services or their content. Therefore, we recommended that you read the privacy and data protection terms of such third-party services.

Oy Matkahuolto Ab
Customer Service Centre
P.O. Box 100
00101 Helsinki
tietosuoja@matkahuolto.fi

2. What data do we process?

In connection with Parcel Services, Matkahuolto process the personal data of the consignors and consignees of the consignments or their representatives or persons authorised by them (data subjects), when such processing is necessary to enable Matkahuolto to provide services to data subjects and to develop its services. In connection with the provision of Parcel Services, Matkahuolto may process the following personal data:

full name of the consignor (or his/her representative) and the consignee (or his/her representative);
registration information required for any electronic customer account, such as username (email address), password, or other unique identifier;
demographics such as age, gender, title or profession, mother tongue;
information required for the dispatch of the arrival notice to the consignee, such as telephone number, email address and/or street address, as applicable
- delivery address of the consignment, as applicable
- information on the content of the consignment, as applicable
- the suffix of the personal identity code of an authorised representative of the consignee to verify his/her identity at the time of pick-up, as applicable
- invoicing or payment information, as applicable
customer relationship information, such as your contacts with Matkahuolto customer service, including recorded customer service calls and customer feedback you provide;
information you provide for surveys;
any changes to the foregoing information, as applicable.

When you register as a user of Matkahuolto electronic services, you may be asked to enter, for example, the following personal data: name, contact information, date of birth, telephone number, chosen password and, if applicable, additional billing information, such as a billing address and/or bank details. In addition, you can voluntarily provide Matkahuolto with information about, for example, your interests.

When you use Matkahuolto electronic services, we may collect metadata related to your use of the services, such as, where you accessed the services, the duration of your visit, the amount of data transferred, the type of web browser, IP address, operating system and user interface, as well as the browser version and language. If you visit the electronic services without registering or logging in, Matkahuolto will only process the above metadata. These metadata cannot be used to identify an individual user unless you register or log in to the service. These data are collected with the help of cookies or other similar technologies. For more information about Matkahuolto’s cookie policies, see our cookie statement (https://www.matkahuolto.fi/tietosuojaseloste-evasteet ).

3. Purposes and legal bases for the processing of personal data

Purposes of processing personal data

In its capacity as the controller, Matkahuolto processes personal data for the purposes of providing the service, meaning sending and receiving addressed consignments, sending arrival notices and crediting COD payments as well as for the positive identification of individuals.

Additionally, Matkahuolto processes personal data for the purposes of managing, administering, developing and analysing customer relationships, for example, for the provision of customer service and customer communications, for the purposes of investigating possible misconduct, filing or defending any legal claims, as well as for direct marketing purposes to the extent permitted by law and in accordance with section 4 of this Privacy Statement.

Legal basis for the processing of personal data

In its capacity as the controller, Matkahuolto processes personal data when necessary for the performance of a contract to which the data subject is party. In the absence of a contract between Matkahuolto and the data subject, as is the case for parcel recipients, Matkahuolto processes personal data based on its legitimate interest in providing the service. Additionally, the processing of personal data may be necessary for the fulfilment of Matkahuolto’s statutory obligations (Road Transport Agreements Act 345/1979).

When you register as a user of Matkahuolto electronic services, you are obliged to provide certain personal data for the purposes of the processing specified in this privacy statement, except in certain cases where the provision of data is not necessary, as specifically indicated (e.g. disclosure of interests). Failure to provide personal data may prevent us from fulfilling our contractual obligations, which may result in, for example, you not being able to create a customer account for our electronic services or us not being able to provide you with the services described in this statement.

How do we merge customers’ personal data?

Matkahuolto merges personal data collected in connection with the use of our various services in order to provide you with services that are more user-friendly. However, your information collected in connection with the use of various services will only be combined if you have registered as a user of electronic services and use several services, such as sending parcels, or otherwise deal with Matkahuolto through your electronic customer account, in which case the merging of your data is based on your consent.

If you have not enabled Matkahuolto electronic services or accessed services through your electronic customer account, we will not merge the personal data collected in connection with your use of various Matkahuolto services, in which case your data will only be processed as described in the privacy statements of individual services or other Matkahuolto privacy statements.

Data subject’s obligation to provide proof of identity

The Road Transport Agreements Act imposes detailed requirements as to the minimum information that the consignor or carrier is required to enter in the shipping document. The delivery or disclosure of this information to Matkahuolto is based on the obligations laid down in the Road Transport Agreements Act.

Shipments to be handed over in person can only be handed over to the recipient, in which case the recipient’s identity card will be checked. When picking up such a shipment at a service point, the suffix of the personal identity code will be recorded. Distributed parcels will be handed over to the person at the address and the identity will be verified in the case of a shipment for which the “To be collected in person” extra service has been selected.

If the consignee (or his/her authorised representative) of a “To be collected in person” shipment refuses to provide proof of identity when requested and give the suffix of his/her personal identity code to Matkahuolto, Matkahuolto is unable to verify the consignee’s or his/her representative’s identity and will therefore not release the consignment.

Other consignments picked up at service points are handed over to the recipient based on the pick-up code provided, in which case no ID or authorisation is needed.

4. Electronic direct marketing

Matkahuolto will not use your personal data for the purposes of direct electronic marketing without your prior consent. If you have given your consent to direct electronic marketing, you have the right to withdraw your consent at any time and prohibit Matkahuolto from using personal data for direct electronic marketing. You can prohibit the use of your personal data for direct electronic marketing by contacting Matkahuolto customer service.

Matkahuolto does not need to ask for your consent to direct electronic marketing if the information has been obtained on the basis of a previous customer relationship and in connection with a previous purchase. Information obtained on the basis of a previous customer relationship or a previous purchase transaction will only be used for the direct marketing of products or services belonging to the same product group and only for direct marketing by Matkahuolto. Even in such a situation, you have the right at any time to prohibit Matkahuolto from using your personal data for direct marketing purposes.

5. Regular sources of data

Matkahuolto collects information from the data subject when sending and collecting parcels and at other times when the data subject interacts with Matkahuolto, either through its physical or digital channels. Matkahuolto may also collect information from you when you participate in marketing campaigns or customer feedback surveys.

The information may be disclosed to Matkahuolto by the consignor, Matkahuolto’s partner or a company or online shop whose shipments are carried by Matkahuolto.

When handing over consignments, Matkahuolto verifies the identity of the consignee or his/her authorised representative if the consignment is not handed over against a pick-up code. In this connection, Matkahuolto receives personal data directly from the data subject: in order to positively verify the identity of the recipient or his/her authorised representative, Matkahuolto records the suffix of the data subject’s personal identity code (for consignments subject to the “To be collected in person” extra service).

6. Transfers of personal data

Matkahuolto may transfer data subjects’ personal data to third parties acting as processors for the purposes described in this privacy statement, as explained below. When transferring personal data, Matkahuolto ensures, for example, through contractual arrangements, that the processor of personal data processes such data only in accordance with the written instructions issued by Matkahuolto and exclusively for the purposes indicated in this privacy statement. Also, Matkahuolto ensures that access to personal data is limited to persons who need to access it for work-related reasons.

Matkahuolto’s delivery chain in Finland (partner carriers and distributors) and service network (dispatch and pick-up points): Matkahuolto may transfer personal data to its partners and subcontractors in the delivery chain to the extent they need such data to carry out the duties assigned to them, such as the carriage, handover and distribution of parcels and dispatch of arrival notices or customer satisfaction surveys.
Processors of personal data: Matkahuolto may transfer personal data to processors for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance or other data processing tasks.

The data is primarily stored in the territory of the Member States of the European Union or the European Economic Area, but processors outside the EU or EEA may have access to personal data when providing their services to Matkahuolto. In cases where such disclosure of information occurs, Matkahuolto must ensure that the European Commission has determined that there is an adequate level of protection of personal data in the country in question, use standard contractual clauses or other equivalent arrangements approved by the European Commission and comply with other appropriate safeguards for the disclosure or transfer of personal data outside the EU or EEA. A copy of the applicable safeguards is available on request from Matkahuolto.

However, in connection with international deliveries, information may also be disclosed outside the EU and EEA depending on the country in which the consignor and its partners or subcontractors are based.

The Road Transport Agreements Act and relevant international logistics agreements impose detailed requirements as to the minimum information that the consignor or carrier is required to enter in the shipping document. This information contained in the shipping document is regularly disclosed by Matkahuolto to its partners in the delivery chain in connection with consignments destined to other countries. The categories of personal data disclosed in this context are as follows:

full name of the consignor (or his/her representative) and the consignee (or his/her representative);
information required for the delivery of the consignment, such as the consignee’s telephone number, e-mail address and/or street address, as applicable;

Additionally, the acknowledgement by the consignee (or his/her authorised representative) is re-transmitted to the consignor in accordance with the transport agreement.

Personal data is also disclosed to competent authorities, such are border authorities and the customs subject to the authorities’ statutory right of access to information.

Matkahuolto submits the information in encrypted format over a secure technical interface.

In addition to the above, Matkahuolto will disclose personal data to third parties in the cases set forth below:

Matkahuolto may disclose your personal data to third parties if you have given your consent.
Matkahuolto may disclose your personal data as required by the competent authorities or other competent parties or as required by applicable law, in accordance with current legislation.
If Matkahuolto sells, buys, merges, or otherwise reorganises its business, Matkahuolto or a party acting on its behalf may disclose your personal data to the buyers and their advisors.

7. Personal data protection policy

Manually processed data is kept in locked rooms at Matkahuolto outlets. Electronic data is stored in a database that may only be accessed by specifically designated staff members of the controller or a party acting on its behalf, who need to access such data for work-related reasons, have received adequate training and are bound by a statutory or contract-based non-disclosure obligation.

The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are protected through technical means. All the data communications between the browser and the server environment are encrypted. Access to servers and applications is restricted through role-based access control management.

8. Storage period and erasure of personal data

Matkahuolto or a processor of personal data, who carries out the processing of such data on behalf of Matkahuolto in connection with Parcel Services, retains the personal data of data subjects in accordance with applicable legislation for only as long as the retention of data is necessary to achieve the purpose of the processing of personal data.

Matkahuolto determines the storage periods of personal data according to the following criteria:

Your personal data will be retained for the duration of your active customer relationship. The activity of your customer relationship is determined on the basis of your use of Matkahuolto electronic services or your communication with Matkahuolto.
Information about your direct marketing consent will be deleted if you withdraw your marketing consent or object to the processing of your personal data for direct marketing purposes.
Your data will be deleted if you have requested the deletion of your data and Matkahuolto has no other basis for processing your personal data.

The communication sections of some of Matkahuolto services, such as your public feedback, will still display your pseudonym and related content even after your customer relationship has ended.

In addition, Matkahuolto may be required to retain some of your personal information in order to comply with accounting or other mandatory legislation even after the end of your customer relationship or other basis for processing personal information.

As a rule, the personal data processed in connection with Parcel Services is retained in Matkahuolto’s operational systems for 18 months, after which the data is archived. As the maximum period allowed for filing action under the Road Transport Agreements Act is three years, Matkahuolto archives all the data related to Parcel Services for at least three years. Access to archived data is closely restricted.

The suffix of the consignee’s personal identity code (or that of his/her personal representative) is retained for 18 months.
Personal data forming part of accounting information is retained for the period of time required under accounting legislation.

When Matkahuolto no longer needs the personal data for the original purposes, the data is erased from Matkahuolto’s and its processor’s IT systems and other files, or irrevocably anonymised.

9. Rights of data subjects

The EU General Data Protection Regulation guarantees data subjects a number of rights that they can exercise to determine how their personal data is processed. The data subject may exercise the following rights in respect of Matkahuolto insofar as Matkahuolto serves as the controller of personal data.

Right of access: The data subject has the right to receive a confirmation from Matkahuolto as to whether Matkahuolto processes his/her personal data and the right to check such data. Matkahuolto may request the data subject to formulate his/her request in more detail regarding the procedure for the delivery of the data, etc.
Right to correct personal data: The data subject has the right to correct any errors in the personal data processed by Matkahuolto or complete any incomplete data. When requesting a correction, the data subject needs to be aware that all information cannot be changed retroactively by such a request. For example, the contents of the decisions concerning the data subject’s applications cannot be changed. Specific appeal procedures exist for such decisions as explained in each individual decision.
Right to be forgotten: If there is no longer any legal basis for the processing of personal data or the statutory or contractual provision obligating Matkahuolto to retain personal data ceases to apply, the data subject has the right to demand that Matkahuolto erase his/her personal data and Matkahuolto is required to comply with the request.
Limitation of processing: In certain cases stipulated by law, the data subject may have the right to demand that Matkahuolto limit the processing of his/her personal data.
Right to transfer personal data: Subject to certain statutory provisions, the data subject may have the right to receive from Matkahuolto the personal data concerning him or her in Matkahuolto’s possession in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from Matkahuolto.
Right to object to the processing of one’s personal data: Additionally, subject to certain conditions, the data subject may have the right to object to the processing of his/her personal data in situations in which processing is based on Matkahuolto’s legitimate interest, and Matkahuolto is required to comply with such a request unless Matkahuolto demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Direct marketing and the right to forbid the processing of personal data for direct marketing purposes: The data subject has the right to forbid the processing of his/her personal data for direct marketing purposes.
If the data subject has given his/her consent to receiving direct marketing material from Matkahuolto, he or she may cancel such consent at any time.

If you have registered as a user of Matkahuolto’s electronic services, you can check and correct your information in the electronic services provided by Matkahuolto. If you have not registered as a user of the electronic services, or if you do not want to use the electronic services to check or correct your information, you can check and correct your information by contacting Matkahuolto Customer Service Centre referred to in section 1 of this privacy statement. Any requests for the erasure or transfer of the data or any objection to direct marketing must always be submitted to the Matkahuolto Customer Service Centre.

Matkahuolto will take prompt action in response to the data subject’s request and will provide the data subject with information on the exercise of rights normally within one month of receipt of the request.

Additionally, the data subject has the right to lodge a complaint concerning the processing of personal data by Matkahuolto with the data protection authority. Any complaint must be filed with the competent authority, in Finland with the Data Protection Ombudsman in accordance with the instructions they provide. Data Protection Ombudsman’s website.

10. In conclusion

Matkahuolto reserves the right to update and revise this privacy statement. Matkahuolto will notify any changes in the processing of personal data in an appropriate manner. [Rivityskohta]Matkahuolto is not generally obliged to individually notify data subjects of any changes, for example, when the provision of such information proves impossible or would require unreasonable effort (for instance, when there are no up-to-date contact details on the data subject). Therefore, the data subjects are occasionally encouraged to check this statement for any changes.