Alva-yhtiöt Oy Privacy Policy
Updated on June 11, 2020
Compliance with data protection principles and secure processing of customer personal data is important to us in the handling of our company’s customers’ personal information. We operate transparently in matters related to data protection.
Through this privacy notice, we provide information about our practices regarding the collection, use, and retention of registered individuals’ information. Additionally, we outline the rights of individuals registered in this register.
We may update this privacy notice as necessary due to changes in our operations, the development of our services, or changes in legislation.
Data Controller
Alva-yhtiöt Oy, Business ID: 1071200-1
Mailing Address: P.O. Box 4, 40101 Jyväskylä
Phone: 014 366 4000
Website: www.alva.fi
Contact Person
Toni Luhti
Phone: +358503446566
Mailing Address: Alva-yhtiöt Oy, P.O. Box 4, 40101 Jyväskylä
Email: tietosuoja (at) alva.fi
Register Name
Alva-yhtiöt Oy Customer Register. Registered individuals include customers and potential customers of Alva-yhtiöt Oy.
Purpose and Legal Basis for Processing Personal Data
Alva-yhtiöt Oy, as the data controller, and partners authorized by Alva-yhtiöt Oy by agreement, process the personal data of customers and potential customers in accordance with data protection legislation for the following purposes:
- Managing and improving the customer relationship between Alva-yhtiöt Oy and its clients.
- Customer and stakeholder communications
- Maintenance, provision, development, and delivery of products and services offered by Alva-yhiöt Oy, as well as the execution of internal and external tasks related to these products and services
- Fulfillment of responsibilities related to contractual relationships
- Receipt of payments, payment supervision, and collection actions
- Marketing and advertising of products and services, including remote sales
- Internal reporting and reporting to authorities
The processing of personal data by Alva is also based on other mandatory legal obligations, such as:
- Regarding the contractual relationship between the registered party and Alva-yhtiöt Oy,
- Based on the legitimate interest of Alva-yhtiöt Oy, including situations where Alva-yhtiöt Oy utilizes the registered party’s information for marketing its products and services, or processes data within the Alva corporate group, or in collaboration with a third party involved in service provision
- With the consent of the registered party, given when the registered party has granted consent for electronic marketing or other consent explicitly requested by Alva-yhtiöt Oy
Contents of the Register
The following information is collected in the register:
- Name
- Age or year of birth
- Personal identification number or business identification number
- Address
- Customer number
- Gender
- Preferred language of service
- Contact details, such as phone numbers, email address, and other contact information
- Customer’s given consents and prohibitions regarding direct marketing
- Recorded phone calls, emails, and chat messages as well as other communication related to customer service interactions between customers and Alva-yhiöt Oy
- Information related to customer service experience
- Data from customer surveys
- Participation in campaigns and contests
- Other information obtained with the customer’s consent that is necessary for the implementation of the agreed-upon service
- Information related to customer contracts (contract subject, duration, contract prices, billing address, possible representative information, product information, contact person information, notice of termination)
- Information related to customer’s use of services, including service events and fault reports
- Information related to customer’s payment behavior and banking information
- Information about the use of energy and water, information about usage locations and connections
- Information about devices located at usage locations
- Energy and water consumption data
- Security and safety information related to the customer for logging into electronic services, such as username and PIN code
- Device information, such as IP address and other information derived from cookies
- Permission information, such as marketing permissions”
Regular Data Sources
The register is updated based on information provided by customers in connection with requests for quotes, orders, contracts, or other relevant contacts, as well as energy and water consumption data obtained from energy and water consumption meters installed at the customer’s sites.
Information about potential customers is obtained through raffles, competitions, events, and telephone sales.
Information about customers and potential customers may also be obtained from other companies within the Alva group, considering the non-discrimination principles of electricity market legislation.
Register information may also be collected and updated from external sources, such as the register of Suomen Asiakastieto Oy or from other register keepers providing address, update, and similar services.
Information is also collected and updated using cookies and similar technologies in accordance with the applicable regulations.
Information is also updated based on the rules of information exchange in the electricity markets.
All contacts from customers and potential customers to Alva-yhtiöt Oy can be recorded and used for verifying customer contacts and developing services, handling complaints, and other similar purposes.
Regular Disclosures of Data and Transfer of Data Outside the EU or the European Economic Area
Information from Alva-yhtiöt Oy’s customer register is not disclosed to external parties without the consent of the registered individual, except for other companies within the Alva group, recipients acting on behalf of Alva-yhtiöt Oy, or third parties participating in the provision of a service.
Alva may also disclose information when it involves reorganization of business operations, such as selling, merging, or other corporate restructuring, in which case personal data may be disclosed to potential or actual buyers and their advisors. In accordance with applicable legislation, information may also be disclosed to authorities.
Transfer of personal data outside the European Union or the European Economic Area is carried out only in accordance with the procedures prescribed by data protection legislation, such as by using model contractual clauses approved by the European Commission.
Retention of Data
The registered individual’s information is retained only for as long as necessary to fulfill the purposes defined in this privacy notice.
The most significant legal retention obligation is the consumer customer’s obligation to correct billing, which determines a retention period of ten years.
Principles of Register Protection and Management of Risk to Registered Individuals
Information in the customer register is collected into databases that are protected by firewalls, passwords, and other technical means. We can also protect personal data by rendering it unidentifiable (pseudonymization). Access to the data is granted only to personnel employed by Alva-yhtiöt Oy or authorized agents who need the information for their tasks. Alva-yhtiöt Oy requires its staff and partners to commit to keeping customer information confidential and to handle personal data securely.
In the processing of personal data, Alva-yhtiöt Oy is guided by the goal of processing customer information in a way that does not pose a risk to the registered individual. As risk management measures, Alva-yhtiöt Oy conducts regular risk monitoring and assessment, impact assessments related to data processing, and regular training of personnel.
In the event of a data security breach, the risk to the registered individual is assessed. If there is a high risk to the rights and freedoms of the registered individual, the registered individual will be informed of the data security breach.
Cookies
When using our services or visiting our website, the Alva group may collect information from your device using cookies or similar technologies. Our website may also contain cookies or similar technologies from third parties. You can read more about the use of cookies here: www.alva.fi/en/information-about-cookies/
Rights of Registered Individuals
Right of Access and Right to Inspection of Data
The registered individual has the right to inspect the information concerning them and to receive a copy of the information in paper or commonly used electronic format. A request for information can be made by contacting Alva-yhtiöt Oy’s customer service according to the contact information provided at the end of this notice.
Right to Rectification of Data and Restriction of Processing
The registered individual has the right to correct their information by providing incomplete or incorrect information with explanations to Alva-yhtiöt Oy’s customer service according to the contact information provided at the end of this notice. If desired, the registered individual can also update their own information through Alva group’s electronic service platform Monitor, within the limits enabled by the electronic service channel. In certain situations, the registered individual also has the right to request the restriction of processing.
Right to Data Portability
The registered individual has the right to transfer the information they have provided themselves to another system. In the energy market, providing services always requires a contract, during which necessary information is transferred to the new system. A request for data transfer can be made by contacting Alva-yhtiöt Oy’s customer service according to the contact information provided at the end of this notice.
Right to Erasure of Data
The registered individual can request the deletion of their data. For consumer customers, data can be deleted at the earliest ten years after the termination of the contract. The ten-year retention obligation is based on the consumer customer’s obligation to correct billing, which determines a retention period of ten years.
A request for data deletion can be made by contacting Alva-yhtiöt Oy’s customer service according to the contact information provided at the end of this notice.
Right to Object to Automated Decision-Making, Including Profiling