Updated: 8 May 2019
Oulun Energia’s customer data may be accessed by one or more register controllers belonging to the Oulun Energia group, each of which has separate responsibility for processing of personal data for the register controller's own purposes. These purposes may include delivery of electricity or heat to customers based on a heat or electricity contract made with the customer. Which company is the register controller is determined by which Oulun Energia company the customer has made a contract with (for the delivery of products or services, for example). If you are unsure which company’s customer you are, please contact customer service: firstname.lastname@example.org, tel. 08 55843100.
Register controllers' contact information:
Oulun Energia, business ID: 0989376-5, PO Box 116, 90101 Oulu
Oulun Energia Siirto ja Jakelu Oy, business ID: 2080002-1, PO Box 116, 90101 Oulu
Oulun Sähkönmyynti Oy, business ID: 1703296-5, PO Box 116, 90101 Oulu
Oulun Energia Urakointi Oy, business ID: 2355475-1, PO Box 116, 90101 Oulu
Turveruukki Oy, business ID: 0210307-0, PL 116, 90101 Oulu
Who can I contact in matters related to privacy?
Oulun Energia's data protection officer
Address: PO Box 116, 90101 Oulu
WHAT PERSONAL INFORMATION DO WE COLLECT?
Oulun Energia primarily collects personal data directly from its customers. Personal data is collected in connection with contracts, orders and requests for offers, and through other customer contacts. The registrar may, in some cases, also collect customer data from other data sources, such as energy meters installed to customer facilities, population registers and the customer data register of Suomen Asiakastieto Oy. Information of potential customers is collected in connection with prize draws and promotion events. Information is also collected online using cookies and similar technologies as permitted by current regulations and law.
The following customer data is collected and processed:
- Basic information, such as name, age, gender, date of birth or social security number
- Contact information, such as postal address, e-mail address, telephone number and IP address
- Details of customer support transactions, such as telephone calls between customer and registrar. Oulun Energia also has a recording camera surveillance system at its customer service facility in Kasarmintie 6, 90101 Oulu.
- Product and service usage information, such as information concerning the location where energy is used, information concerning electronic equipment at the location and energy consumption data.
- Data required for invoicing
- Customer’s credit data as permitted and required by law
- Direct marketing permissions and prohibitions
- Data collected using cookies
GROUNDS AND PURPOSES OF PROCESSING OF PERSONAL INFORMATION
Personal data is used for the following purposes:
1. Maintenance of customer relationships and offering of products and services
Personal information of Oulun Energia’s customers is primarily processed to deliver the products and services, such as electricity or electricity network connections, that have been ordered by the customer. Personal data is also used for the maintenance of customer relationships and for invoicing and communication purposes. In this case, the processing of personal data is based on an agreement made between the registrar and the customer.
1.1 Automatic decision-making
Oulun Energia checks the credit record of all prospective customers from Suomen Asiakastieto’s credit register before making an electricity agreement. Checking of the customer’s credit data is based on Oulun Energia’s electricity sales terms and conditions (SME 2014), which are part of the electricity agreement made between the customer and Oulun Sähkönmyynti Oy. Credit information is used in the decision-making process leading to electricity agreement. Credit information is used as specified in the credit information act (2007/527).
Processing of credit data includes automatic decision-making, which is required for granting of electricity agreement. If the credit data check indicates that the prospective customer has poor credit history, and if the prospective customer is not in any of Oulun Energia’s supply obligation areas specified in the electricity market act (588/2013), the prospective customer's application for electricity agreement will be rejected automatically. The applicant is entitled to request that a human operator participates in the decision-making process, has the right to present his or her position on the decision and has the right to contest the decision made by automatic decision-making systems.
Oulun Energia may send information concerning new products, services and Oulun Energia’s operations to its customers, and may request customer feedback. In this case, processing of personal data is based on Oulun Energia’s legitimate interest to provide latest information of Oulun Energia’s operations and to market Oulun Energia’s products and services to the company’s existing customers. The customers are entitled to prohibit marketing communications at any point.
When Oulun Energia targets potential customers with direct online marketing, processing of personal data is based on consent, which the customer is entitled to withdraw at any point. The consent is asked from consumers and it does not concern B2B customers.
3. Development of products and services
Personal data is also processed on a limited scale to improve existing services and to develop new products and services. In this case, processing of personal data is based on Oulun Energia’s legitimate interest to collect information that is essential to the development and improvement of its operations.
Personal data, including recordings from camera surveillance systems, is processed to guarantee safety of customer facilities, to prevent unauthorised access to facilities, to investigate fraud and to ensure the safety of Oulun Energia’s personnel. In this case, processing of personal data is based on Oulun Energia’s legitimate interest to ensure the safety of the company’s facilities and its personnel, and to ensure that the work tasks of Oulun Energia’s personnel are undisturbed.
When processing of personal data is based on Oulun Energia’s legitimate interest (items 2–4), Oulun Energia performs an assessment of the processing of personal data using the so-called balancing test as required by data protection law. The customer is entitled to oppose the processing of personal data based on Oulun Energia’s legitimate interest at any point. For more information, please contact Oulun Energia’s data security officer (see top of this document for contact information).
WHO IS YOUR PERSONAL INFORMATION TRANSFERRED OR PROVIDED TO?
Personal information of Oulun Energia’s customers may be provided to third parties in the following cases:
As required and permitted by law or contractual relationship
To trusted external service providers (such as providers of outsourced customer services) acting on Oulun Energia's behalf who have no right to use the data provided to them independently of Oulun Energia
Within the Oulun Energia consolidated company
When Oulun Energia is involved in corporate mergers
When Oulun Energia believes in good faith that providing the data is required for securing our rights, your rights or those of others, to investigate potential fraud, and to comply with requests received from authorities.
WILL YOUR PERSONAL DATA BE TRANSFERRED OUTSIDE THE EU OR THE EEA?
Personal data may be transferred outside the EU or the European Economic Area (EEA) when Oulun Energia’s trusted service provider operates fully or partly outside these areas. In these cases, appropriate precautions as required by data protection law are taken.
Example: A service provider that participates in implementing our customer services may transfer personal data to the United States in connection with the production of the service. In this case appropriate precautions are implemented using the template contract clauses provided by the European Commission.
HOW LONG WILL YOUR PERSONAL DATA BE STORED?
However, some personal data may be retained after the customer relationship has ended as permitted by the applicable privacy regulations. For example, the Accounting Act (1336/1997) requires that some personal data is retained as part of the company’s accounts for six years counting from the end of the year when the accounting period in question ends.
WHAT RIGHTS DO YOU HAVE?
The Finnish data protection law grants the customer the following rights as a registrant:
Right to access data
The registrant has the right to access personal data collected by us at the registrant's request. The registrant also has the right to request personal data to be corrected or removed within the limits granted by the data protection legislation. Access requests may be sent by e-mail to email@example.com or made through our customer service.
Right to prohibit direct marketing
The registrant has the right to request restricted data processing or oppose the processing of personal data as granted by the data protection legislation. The registrant may prohibit the use of his or her data for direct marketing purposes through Oulun Energia's customer service.
Right to transfer data between systems
The registrant has the right to transfer the registrant's data from one system to another, in other words to receive the personal data in a structured, commonly used format and transfer it to another registrar within the limitations granted by the data protection legislation.
Right to withdraw consent
If processing of personal data is based on the registrant’s consent, the registrant has the right to withdraw consent by notifying customer service. If the registrant is a subscriber of Oulun Energia’s newsletter, the registrant can cancel the subscription at. In this case, no more e-mail marketing messages will be sent by Oulun Energia.
Right to file complaint with controlling authority
The registrant has the right to file a complaint with the national data protection authority (in Finland this is the data protection ombudsman) or to a data protection authority elsewhere in the European Union or the European Economic Area in case the registrant considers that his or her legal rights have been violated.
Requests can be sent to Oulun Energia's data security officer at: firstname.lastname@example.org
Oulun Energia will respond to requests within one month of receiving the request, unless specific reasons call for longer response time. Oulun Energia may also decide to reject the request based on the applicable law and regulations.
HOW DO WE PROTECT YOUR DATA?
Oulun Energia has at its disposal the required technical and organisational data security measures to protect the personal data of our customers from erasure, destruction, misuse or unauthorised access. Access to personal data is only granted to personnel who need access to personal data to carry out their work tasks.
COLLECTING OF ACCESS DATA (COOKIES)
If you need any further information about this privacy statement or how your personal data is processed, please contact Oulun Energia’s data security officer at email@example.com.