Privacy Statement – The Professionals of Business and Technology

This Privacy Statement (hereinafter referred to as the “Statement”) describes how the Professionals of Business and Technology collects, processes, and discloses personal data in connection with the membership and its management and the provision of member services, or in connection with the personal data of potential members obtained at events or otherwise, as well as in its operations with different stakeholders.

Data Controller: The Professionals of Business and Technology (“the Association”) is responsible for ensuring that your personal data is processed in accordance with this Statement and the applicable data protection laws.

The Association’s contact information: Address: Ratavartijankatu 2 a, 00520 Helsinki, Telephone: +358 20 155 880

E-mail: tietosuoja@tradenomi.fi

The personal data of the Association’s members and persons related to them, applicants for membership, persons who have participated in or registered for events or who have otherwise contacted the Association, and former members is processed in the register. In addition, the personal data of the contact persons of the organisations involved in the operations of the Association and its shop stewards (“Data Subject”) is processed.

We only collect and process personal data that is necessary for the operation and development of our operations and the establishment and/or management of our membership.

We process your personal data for the following purposes:

• Managing the membership, union activities, advocacy, and the implementation of member services:

We process personal data primarily for managing the membership, union activities, advocacy, the implementation of member services, and other agreed matters, as well as for the collection of membership fees. The processing of personal data is based on the membership between you and us (agreement) and the Association’s statutory obligation to keep a member register.

• Member and stakeholder communications and marketing:

We may process your data to inform you about our operations and member benefits and to provide you with membership-related services. We may also process your personal data for research concerning advocacy, member services, and other topics and member surveys. On these grounds, we can also contact you for a maximum of 3 years after the end of your membership. The processing of personal data is based on the membership and our legitimate interest in providing information as part of the service and in marketing our other services to you.

• Service development, data security, and internal reporting:

We also process your personal data to ensure the data security of the member services and the website, to improve the quality of the member service and the website, and to develop the member services.

We may also compile internal reports on the basis of personal data for our internal use for the appropriate management and development of our operations. In these cases, the processing of personal data is based on the membership and our legitimate interest in ensuring the appropriate data security of the member services and our website and in obtaining sufficient and appropriate information for the development of the member services and the management of our operations.

• Compliance with the law:

We may process your personal data in order to fulfil our legal obligations, e.g. regarding accounting or in order to fulfil legal requests for data from authorities (e.g. tax authorities).

• Other purposes for which you have consented:

We may also process your personal data for other purposes if you have consented to such processing, e.g. when subscribing to a newsletter.

The personal data and contact information of the Association’s members and other necessary information related to membership is processed in the register. This data includes:

• Basic personal data and contact information and education information of the Data Subject, such as:
  • First and last name, social security number, address, telephone number and e-mail address and membership number, native language, education information
• Membership information and membership fee information, such as:
  • Membership information and history (membership type, start date and end date, reason for termination, possible membership of an unemployment fund, membership of associations, name of the person who recommended membership, the Data Subject’s memberships in the Union’s networks, the Data Subject’s invoicing information and history of membership fees)
• Workplace information and history of the Data Subject, such as:
  • Employer’s name, business ID, name of the workplace, start date and end date of employment, industry, collective agreement sector, position in the employment relationship
• Positions of trust and data on participation in the Union’s operations, such as:
  • Participation of the Data Subject in the Union’s management duties or positions of trust, registration for Union events
• Data related to the management of the membership, its possible creation, and communication, such as:
  • The Data Subject’s communication with various advisory services and any descriptions and measures of employment disputes and related information, such as processors’ notes and information provided by the Data Subject. Call recordings that callers are informed about at the beginning of calls. Other possible communication in matters related to membership recruitment, for example. Information about possible unemployment and contact information.
• Marketing permissions and prohibitions and order information, such as:
  • The various means and contents of communications permitted by the Data Subject, including direct marketing and publication and other service subscriptions made by the Data Subject, such as holiday home bookings and product orders
• Electronic communication identification data, such as:
  • IP address, login time, browser information, operating system, country, cookies necessary for the functionality of the services, recorded call data. Newsletters opened and clicked by the Data Subject.
• Profiling data (see section 10 for more information), such as:
  • Membership group (e.g. student member), targeted member communications based on customer profiles
• Information collected in connection with the use of our website, such as:
  • Information collected in connection with the use of our website, e.g. user IDs, passwords, identification data, log data, information collected from the website using cookies or similar technologies (device ID and type, operating system, and application settings) and other information specified on a case-by-case basis based on your consent

We may collect your personal data in different ways. As a rule, we collect and process personal data that:

• You have provided to us when you are in contact with or interacting with us, such as when you become a member or participate in our events
• Is generated in connection with your visit to the website, e.g. when you log in to member pages or open newsletters
• Is obtained from other sources, to the extent permitted by applicable laws, such as the Trade Register, the Population Information System, the Business Information System, or Posti’s address information system, as well as employers and possibly the unemployment fund

You are not obliged to provide us with your personal data, but if you choose to not do so, we may not be able to provide you with our services.

The personal data processed digitally is protected and stored in the Association’s System, to which access is restricted only to persons who need the data in order to perform their duties. These persons have personal usernames and passwords. An agreement has been concluded with the system supplier, which requires the data to be protected in accordance with the requirements of the General Data Protection Regulation.

Paper documents are stored locked away and are only accessible to persons who need them for their duties.

We may disclose personal data to third parties:

• To the extent permitted or required by law, such as submitting membership fee information to the Tax Administration for taxation purposes in electronic format
• For the implementation of a request for data made by a competent authority or the disclosure of information for the purposes of legal proceedings
• When our partners process personal data on our behalf and in accordance with our instructions. We always ensure the appropriate security and processing of your personal data through agreements; our key contractual partners are:
  • Vitec Avoine Oy – member register system
  • Membri Oy – IT services
  • Most Valuable Player Oy – Backoffice services for membership fees
  • SJM Group Oy
  • Asianajotoimisto Aika
• To the Association’s partners (e.g. If Vahinkovakuutusyhtiö Oy, Confederation of Unions for Professional and Managerial Staff in Finland Akava) in order to implement measures and services related to the Association’s membership. These services and measures include magazine subscriptions, the collection of membership fees, membership of an unemployment fund, and the workplace operations of the Federation of Professional and Managerial Staff YTN and the Negotiation Organisation for Public Sector Professionals JUKO, including the information required for shop steward activities.
• When we believe that disclosure is necessary to exercise our rights, protect your security or the security of others, investigate misconduct, or respond to a request from an authority
• With your consent to the parties whom the consent concerns, such as to our partners for the purpose of offering member benefits

Data is disclosed for direct marketing purposes and electronic direct marketing only with the written or electronic consent of the Data Subject, which can be revoked at any time.

For the processing of personal data, the Association may also use other service providers that are located outside the European Union or the European Economic Area (e.g. the Mailchimp newsletter application) or that may transfer data to a certain extent outside the European Economic Area (e.g. Vitec Avoine Oy, Novellus Palvelut Oy). Personal data is always transferred outside the European Union or the European Economic Area on one of the following lawful bases:

• The European Commission has decided that the relevant recipient country ensures an adequate level of data protection
• The Association has implemented appropriate safeguards for the transfer of personal data using standard data protection clauses approved by the European Commission. In this case, the Data Subject is entitled to receive a copy of these standard clauses by contacting the Association as described in the Contacts section
• The Data Subject has given explicit consent for the transfer of their personal data, or there is another lawful basis for transferring personal data.

Access to personal data is not granted beyond what is necessary for the provision of the services. The transfer of personal data outside the European Union or the European Economic Area is always based on the applicable legislation on the processing of personal data and is carried out in accordance with that legislation.

The retention periods are defined in the Association’s archiving plan and the data is stored accordingly. For example, a member’s personal data is stored in the register for as long as the Data Subject is a member of the Association. After the termination of the membership, personal data will be stored for a maximum of ten years after the termination of the membership on the basis of the Association’s legitimate interest, i.e. to defend against possible legal claims (KKO 2017:15). Personal data may also be stored for longer if applicable legislation or the Association’s contractual obligations towards third parties require a longer storage period.

As part of the processing of personal data, the Association may carry out automated profiling of the Data Subject. As a result of profiling, the Data Subject receives communications that are better targeted, such as up-to-date labour market information for their own collective agreement sector.

Profiling is carried out on the basis of the content of the communications selected by the Data Subject, the services used, the openings and clicks of newsletters, and the membership history using statistical methods.

The Data Subject has the right to prohibit or allow the processing of their personal data for direct marketing purposes at any time.

In addition, the Data Subject has the right, in accordance with applicable data protection legislation, to:

• receive information about the processing of their personal data;
• have access to their data and review the personal data processed by the Association;
• demand the rectification and completion of inaccurate or incorrect personal data;
• demand the erasure of their personal data;
• withdraw their consent and object to the processing of their personal data to the extent that the processing of personal data is based on the Data Subject’s consent;
• object to the processing of their personal data on grounds relating to their particular personal situation to the extent that the legitimate interest of the Association is the basis for the processing of personal data;
• receive their personal data in a machine-readable format and transfer those data items to another data controller, providing that the Data Subject has provided the personal data to the Association themselves, the Association is processing the personal data based on the Data Subject’s consent, and the processing is conducted automatically; and
• demand the restriction of the processing of their personal data.

The Data Subject must request the implementation of the above-mentioned right in accordance with the Contacts section of this Privacy Statement. The Association may request the Data Subject to specify their request in writing and to verify the identity of the Data Subject prior to processing the request. The Association may reject the request on the grounds provided in relevant legislation.

Every Data Subject has the right to lodge a complaint with the competent supervisory authority or the supervisory authority of the member state of the European Union in which the Data Subject has their place of residence or workplace if the Data Subject considers that their personal data has not been processed in accordance with applicable data protection legislation.

Requests concerning the exercise of the Data Subject’s rights, questions about this Privacy Statement, and other contacts must be made by e-mail to the Data Protection Officer at tietosuoja@tradenomi.fi. The Data Subject may also contact us personally or in writing at the address below:

The Professionals of Business and Technology

Data protection officer

Ratavartijankatu 2, 00520 Helsinki

The Association reserves the right to update this Statement. The currently valid Statement can be found at tradenomi.fi/tietosuoja. This Privacy Statement was last updated on 30 August 2024.