Business customer register

Controller
Oy Hangö-Hanko Logistics Ab (Business ID: 1849046-6) Hemming Elfvingintie 5, 10960 Hangö, Finland.

Contact for registration
Bo Isaksson bo.isaksson@hankologistics.fi
+358 (0)40 0896073

Legal basis for processing
Legitimate interest

Purpose of processing personal data
The register is used to maintain the organisation's B2B customer register, to manage, archive and process customer orders and to maintain customer relationships.

It may also be used for service development, statistical purposes and to provide more personalised and targeted content on our digital services. Personal data is processed within the limits permitted and required by the GDPR.

The data in the register can be used for targeted advertising within the organisation without disclosing personal data to third parties. The organisation may use partners to maintain customer and service relationships, in which case some data may be transferred to the partner's servers for technical reasons.

The data is processed only for the purpose of maintaining the customer relationship through technical interfaces.

The organisation has the right to publish information from the customer register in electronic or written form, unless the customer explicitly objects. Publication may include, for example, address labels for direct marketing or similar purposes. The customer has the right to object to such publication by contacting customer service or the contact person responsible for the register by e-mail.

Vehicle and mobile phone registers

Last update: 29 November 2024

Controller
Oy Hangö-Hanko Logistics Ab (Business ID: 1849046-6)
Hemming Elfvingintie 5, 10960 Hangö, Finland.

Contact
Bo Isaksson
bo.isaksson@hankologistics.fi
+358 (0)40 0896073

Legal basis for processing
Agreement

Purpose of processing
The legal basis is data-driven and can be a legitimate interest of the controller or a contract. The purpose is to monitor vehicles and mobile devices registered in the system. The monitoring allows route planners and terminal staff to gain an insight into the current status and location of vehicles.

Route planners can anticipate and react to vehicle schedules, monitor delays, vehicle failures or other anomalies and optimise fleet utilisation, reduce idling and environmental impacts.

If the terminals are busy, terminal staff can see the vehicles arriving, their schedules and the number of goods to be unloaded or loaded.

Users can view detailed information on the fleet and terminals through the service. Only designated persons based on their job function or position are entitled to process personal data obtained through mobile tracking.

Legitimate interest
The controller needs to process personal data in order to carry out its business tasks. The processing may not always be based on legal obligations or contracts with the individual.

The balancing of interests has shown that the legitimate interest is the appropriate legal basis, taking into account the nature and scope of the processing and the rights and freedoms of data subjects. It is assessed that the processing will not cause serious harm to the rights of data subjects.

Categories of personal data
Persons using mobile devices or vehicles owned by the controller. Data: mobile phone number, registration number, name, employer.

Recipient
The controller's own staff and, where appropriate, service providers. Data are processed using tracking and mapping software. Data will not be disclosed without a legal basis (Act on the Protection of Privacy in Working Life 759/2004). Data may be disclosed to the police only in specific cases in connection with a criminal complaint.

Consent
Processing is based on legitimate interest and consent is not required. In the case of subcontracted workers, consent is given on the basis of a contract.

Contents of the register
The register contains the following information:

- First name and surname

- Employers / transport companies

- Personal mobile phone number

- Vehicle registration number

- Carrier number, if any

- GPS positioning data

Regular data sources
Information is obtained from the individual or employer and via a tracking service or mobile device.

Retention period
Data is kept for 10 + 1 years after the end of employment.

Disclosure of information
Information is not regularly disclosed to third parties. Monitoring is carried out through a separate monitoring programme.

Transfer outside the EU/EEA
Data is not regularly transferred outside the EU/EEA. In such cases, standard contractual clauses (SCCs) and safeguards such as pseudonymisation and, where appropriate, transfer impact assessment (TIA) are used. If the provider has signed up to the EU-US Privacy Shield Framework, this will be used as a legal basis for the duration of the Framework.

Protection Policy A: Manual data
The register exists only in electronic format.

Security Policy B: Electronic records
Only authorised persons with a need for work management, supervision, payroll or other work-related processing have access. The register is stored on a secure server in Finland. Applicable data protection legislation will be respected.

Automated processing and profiling
No automated decision-making or profiling is performed. The monitoring will not have negative consequences for the data subject.

Right of access
The data subject has the right to check what information is stored about him or her. Requests should be made in writing to the customer service or contact person in Swedish or English. The request must be signed or sent from an identifiable e-mail address.

Right to object
The data subject has the right to object to processing for marketing purposes by contacting customer service.

Right to data portability
Data subjects have the right to have their data transferred to another service by requesting it from the contact person.

Right of rectification
Inaccurate, unnecessary, incomplete or outdated information must be rectified. Requests must be made in writing, signed or sent to a verified e-mail address.

The request must specify what information needs to be corrected and why. Corrections will be made without delay. The person who provided or received the incorrect information shall be informed. If the information is refused, a written decision shall be issued, stating the reasons for the refusal. The matter may be referred to the data protection authority.

Right to restriction of processing
The data subject has the right to request restriction of processing, for example if the data are inaccurate. Please contact the person responsible.

Right to erasure
The data subject may request the inspection, rectification or erasure of his or her data. If the person is a contact person of the company, the data cannot be deleted during this period.

Right to complain
If you believe that your data has been processed unlawfully, you can lodge a complaint with the supervisory authority in your country.

Contact details of the Data Protection Officer in Finland:
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki
Telephone: +358 29 566 6700
Registry: +358 29 566 6768
tietosuoja@om.fi
www.tietosuoja.fi

Other rights
You have the right to object to the use of your data for direct marketing purposes, to request anonymisation or complete deletion after termination of employment.