Privacy statement

This is a statement on the processing of your personal data pursuant to the EU’s General Data
Protection Regulation (679/2016).

Controller

SS-Työstö Oy
Business ID: 2152283-6
address: Hoikanperäntie 10, 43800 KIVIJÄRVI, FINLAND
Communication regarding privacy matters
Data protection officer
Riitta Sagulin
tel. +358409626936
email address: riitta.sagulin@ss-tyosto.fi

We request that data subjects contact the data protection officer for all questions related to the
processing of personal data and situations related to the exercising of your rights.

Basis and purpose of processing personal data

The legal basis for the processing of personal data is:
- The contractual relationship between the data subject and controller
- The controller’s legitimate interest
Personal data may be used by: marketing, maintining customer partnership.
Data is not used for automated decisionmaking or profiling.

Retention period for personal data

The personal data of the data subject will only be kept for the time necessary to fulfill the purposes
described in this leaflet

The controller may have an obligation to process some personal data belonging to the filing system
for longer than stated above in order to comply with the legislation or authority requirements.

Rights of the data subject

Right to request access to personal data
The data subject has the right to receive confirmation regarding whether personal data concerning
them is being processed and, if it is, the right to receive a copy of their personal data.

Right to rectification

The data subject has the right to request that inaccurate and erroneous personal data concerning them
be rectified. The data subject also has the right to supplement incomplete personal data by submitting
the required additional information.

Right to erasure

The data subject has the right to request erasure of personal data concerning them if
a. the personal data is no longer required for the purposes for which they were collected; or
b. the personal data has been unlawfully processed.
Right to restriction of processing
The data subject has the right to restrict the processing of personal data concerning them if
a. the data subject contests the accuracy of their personal data;
b. the processing is unlawful and the data subject opposes the erasure of the personal data and
requests the restriction of its use instead; or
c. the controller no longer needs the personal data for the purposes of the processing, but it is required
by the data subject for the establishment, exercise or defence of legal claims.

Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time,
to processing of personal data concerning them.

The controller shall no longer process the data subject’s personal data unless the controller
demonstrates compelling legitimate grounds for the processing which override the interests, rights
and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, the data subject has the right to
object at any time to processing of personal data concerning them for such marketing, which includes
profiling to the extent that it is related to such direct marketing.

Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided
to a controller, in a structured, commonly used and machine-readable format and have the right to
transmit this data to another controller.

Right to lodge a complaint with a supervisory authority

The office of the Data Protection Ombudsman, operating under the Ministry of Justice, is the national
supervisory authority for personal data matters. You have the right to bring your case to the
supervisory authority if you consider that the processing of personal data concerning you is in
violation of applicable law.