How We Process Your Personal Data

Protecting your personal data is important to us. This page describes, at a general level, how we collect, process and protect personal data, the legal bases for the processing, and your rights as a data subject. At the end of this page, you will find privacy notices for specific target groups, which describe in more detail the processing of personal data in each situation. In the event of a conflict, the register-specific privacy notice shall take precedence.

Kuka vastaaWho is responsible for processing your personal data?

The controller of your personal data is Balanco Oy (Business ID 2699983-6), Robert Huberin tie 16 C, 15100 Vantaa.

For all matters concerning personal data, you can contact:

• Person responsible for data protection matters: Niia Ylilammi, tietosuoja@balanco.fi
• General data protection matters: tietosuoja@balanco.fi

Whose personal data do we process?

We process personal data concerning persons interacting with us in different roles. We operate primarily with companies and organisations, but the information of a person representing or acting on behalf of a company or organisation, such as a decision-maker, contact person or representative, is also personal data to which data protection legislation applies. Information concerning and describing only a company, such as a Business ID or line of business, is not, however, personal data.

We process personal data concerning, among others, the following groups:

• current and potential customers, suppliers and cooperation partners (companies and organisations), as well as their decision-makers, contact persons and representatives
• website visitors and users of electronic services
• job applicants

Where do we obtain personal data?

We collect personal data primarily directly in connection with a customer relationship or other interaction, for example when you complete a contact form, subscribe to a newsletter or enter into an agreement with us. Data is also generated through the use of our services and electronic transactions.

Where necessary, we supplement the data using reliable external sources, such as company and contact information services and credit information companies. In addition, we obtain customer due diligence information required under anti-money laundering legislation from service providers when legislation requires the fulfilment of customer due diligence (KYC) obligations.

On what basis do we process personal data?

We always process personal data on a lawful basis. Balanco’s most common legal bases for processing are:

Contract: when processing is necessary for the performance of an agreement entered into with you or the company or organisation you represent, or in order to take steps prior to entering into such an agreement.

Legal obligation: when processing is necessary for compliance with an obligation based on law, such as obligations relating to accounting, the prevention of money laundering or reporting to authorities.

Legitimate interest: when processing is necessary for the purposes of the legitimate interests pursued by Balanco or a third party and does not infringe the rights of the data subject. This forms the basis, for example, for managing customer relationships, marketing, customer communications, business development, fraud prevention and preparing internal reports for business management purposes.

Consent: in certain situations, we separately request your permission, such as for the use of cookies other than strictly necessary cookies or for publishing photographs taken at events. You may withdraw your consent at any time, and withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We do not make automated decisions that would have legal or other significant effects on the data subject. However, we may use profiling and analysis in developing our services, managing customer relationships and marketing. You have the right to object to profiling for direct marketing purposes at any time.

We may also process personal data for statistical purposes, in which case the data is aggregated in such a way that an individual cannot be identified from the result. Such anonymised statistics do not constitute personal data.

To whom do we disclose personal data?

Personal data is processed only by those Balanco employees whose duties require it. We also use external service providers that process personal data on our behalf and in accordance with our instructions. Each service provider processes personal data only to the extent necessary for carrying out the service provider’s duties. Appropriate data processing agreements have been concluded with all service providers.

Personal data may also be disclosed to other companies within the Balanco Group and to cooperation partners for the provision and development of services and for managing customer relationships.

We disclose data to third parties only when necessary for the provision of services, compliance with legal obligations, responding to a request from an authority or handling legal claims. Personal data may also be transferred in connection with a merger, acquisition or sale of a business.

Do we transfer data outside the EU or EEA?

As a general rule, we process personal data within the EU and EEA. Some of the service providers we use are located or operate partly outside the EU and EEA, in which case data may be transferred to third countries.

In such situations, we always ensure that appropriate safeguards are in place for the transfers. As the primary safeguard, we use the Standard Contractual Clauses (SCC) approved by the European Commission or transfers to countries whose level of data protection has been deemed adequate by the Commission (an adequacy decision). Transfers to the United States may also make use of the EU–U.S. Data Privacy Framework (DPF).

Standard Contractual Clauses (SCC) approved by the European Commission

How long do we retain data?

We retain personal data only for as long as necessary to fulfil the original purpose of processing or to comply with legal obligations. At the end of the retention period, we delete the personal data or convert it into an anonymous form from which an individual can no longer be identified.

The length of the retention period is determined primarily by the purpose and legal basis of the processing. Data relating to a customer relationship is retained for the duration of the customer relationship and, after it ends, for as long as necessary, for example, due to contractual liabilities, accounting obligations or potential legal claims. Material based on legal obligations, such as accounting records and information relating to the prevention of money laundering, is retained for the period required by legislation. Processing of personal data based on consent continues only for as long as the consent remains valid.

More detailed retention periods are described in the register-specific privacy notices. We regularly assess retention periods to ensure that data is not retained for longer than necessary. If personal data is required for the establishment, exercise or defence of a legal claim, the data may be retained for as long as necessary for handling the claim.

Data Security

We protect personal data through appropriate technical and organisational measures. Access to personal data is granted only to persons who need the data to perform their duties. Personnel processing personal data have received training and instructions concerning data protection. Personnel and service providers are bound by confidentiality obligations.

Personal data is stored in locked premises appropriate to the level of protection required for the data, and access to the premises is controlled. Electronically stored data is protected through access rights management, user identification, data encryption, protection of data communications, firewalls and other information security software, data backups, as well as the collection of log data and monitoring of information security events.

Your Rigths

You have the following rights in relation to your personal data:

Right of access: You may request confirmation as to whether your data is being processed and obtain a copy of the data being processed and information about the details of the processing.

Right to rectification: You may request that inaccurate or incomplete data be corrected.

Right to be forgotten: You may request the deletion of your data when there is no longer a valid basis for continuing the processing. The right is not absolute, and legal obligations, for example, may require the retention of data.

Right to restriction of processing: You may request that processing be restricted in certain situations, for example while the accuracy of the data is being verified.

Right to data portability: When processing is based on consent or a contract and is carried out by automated means, you may receive your data in a structured and machine-readable format for transfer to another controller.

Right to object: You may object to the processing of your personal data when the processing is based on a legitimate interest and you have a particular reason relating to your personal situation. You may always object to direct marketing without any particular reason.

Right to withdraw consent: If the processing is based on your consent, you may withdraw it at any time.

We may ask you to provide information to verify your identity before fulfilling your request. Exercise your rights by sending a written request to tietosuoja@balanco.fi. As a general rule, we respond to requests within one month.

Right to Lodge a Complaint

If you consider that the processing of your personal data is not appropriate, you may lodge a complaint with the Data Protection Ombudsman (https://tietosuoja.fi/en/home).

Changes to This Page

We may update this page as necessary, for example when legislation or our operating practices change. We will separately inform data subjects of material changes concerning the processing of personal data. The current version is always available on our website.

Privacy Notices

More detailed information on the processing of personal data in different situations can be found in the following notices: