This Privacy Notice explains how the personal data of the Wihuri Group companies’ current, past and potential contractors, suppliers, co-operation partners and their employees, directors and representatives (“you” or “Supplier”) may be processed and how the privacy rights of individuals may be exercised. We process your personal data especially to enable cooperation with you and to comply with our contractual obligations, as explained below in more detail.
The controller of the personal data is each of the Wihuri Group company with whom the Supplier has concluded an agreement or is likely to conclude an agreement (“we” or “Wihuri”).
In case you have any questions or requests concerning your personal data or data protection, you may always contact us through the following email address:
dataprotection@wihuri.com
We may periodically update this Privacy Notice by posting a new version of the Privacy Notice on the Wihuri website.
Further Information on the Processing of Your Personal Data
Sources of Your Personal Data
The personal data we process is mainly collected directly from you.
In addition, we may also collect personal data through Wihuri’s own operations and from publicly available sources.
Further, when legally required or permissible, we may receive personal data from third parties relating e.g. to qualification and permission data, any bans on engaging in commercial activities, authorisations to sign and positions of authority.
What Type of Personal Data Do We Process?
The data we process may include especially the following categories of your personal data as an employee, director or representative of a Supplier:
- Contact information, such as email address and phone number,
- Information on your position, such as your job title and the name of the company you represent,
- Information on any meetings between us, including time, place and participants,
- Information relating to product and/or service offers and/or orders, such as what kind of products and/or services you offer,
- Correspondence and other information relating to the maintenance of the supplier relationship with us,
- Financial information,
- Qualification information, such as permissions and permits,
- Information on social security coverage in case of posted workers,
- Information necessary in order to comply with our statutory obligations relating to import and export restrictions and/or sanctions,
- Background check data,
- Information on any occupational accidents under Wihuri’s potential responsibility; and
- Security and log data such as firewall logs, username and other user data.
The personal data we process depends on your relationship with us and may not include all categories of data listed above.
What Are the Purposes and Legal Basis for Processing of Your Personal Data?
We only process personal data when we have a legal justification to do so especially for one of the following purposes:
- Management, assessment, performance, enforcement and/or compliance with our contractual obligations between the Supplier you represent and us, or taking steps prior to entering into such contract, and
- Compliance with our legal or regulatory obligations.
Based on our legitimate interest relating to our relationship between the Supplier you represent and us, we may also process your personal data for the following purposes:
- Maintenance and development of our relationship with the Supplier you represent,
- Maintenance and development of our operations,
- Management of risks relating to our operations,
- Ensuring the physical and information security when your services are provided at our premises and/or networks
- Marketing of our products and/or services.
In some circumstances we may also process your personal data on the basis of your consent.
With Whom May We Share Your Personal Data?
Other Wihuri Group companies: We may transfer your personal data to other Wihuri Group companies involved in the same projects or receiving same products and/or services than us. Some of these companies may act as independent data controllers for the personal data we provide them.
Third parties: We may disclose your personal data to government agencies and regulators, courts and other government authorities where there is a legal obligation to do so. We may also disclose your personal data to external advisors (e.g. lawyers, accountants, auditors etc.).
Service providers and other partners: As part of normal operations Wihuri contracts with third party service providers (e.g. IT systems and support providers etc.). These partners process your personal data only at and according to Wihuri’s instructions to provide the services.
May There Be Any International Data Transfers?
Wihuri operates in a global market. Due to this, your data may be transferred to non-EU/EEA countries too. Because different countries may have different data protection laws than your own country, we take steps to ensure adequate safeguards are in place to protect your data when required. Adequate safeguards that Wihuri Group companies and our partners may use include standard contractual clauses approved by EU Commission.
How Do We Protect Your Personal Data?
Wihuri complies with all applicable data protection legislation and aims to ensure that your privacy is not infringed in any phase of the processing.
We continuously develop and implement administrative, technical and physical security measures to protect your data from unauthorised access and against loss, misuse or alteration. The rights of access to the data are predefined and limited. We also require our service providers to implement all appropriate security measures to protect your personal data.
For How Long Do We Retain Your Personal Data?
We retain your data only for as long as it is necessary for the processing purposes stated above or as long as we have a legal obligation to do so. Please note that the data retention periods may vary by data category. Inaccurate or outdated data is deleted regularly.
If you ask us to remove your personal data, we may still retain your data if necessary for our legitimate business interest, such as to comply with our legal obligations, resolve disputes or to enforce our agreements.
Your Rights and Options
You have the right to access your personal data and to correct your data. In some circumstances you may also have the right to have your unnecessary or inaccurate data deleted, to object to how we use or share your data, to restrict how we process your data, and to have your data transferred to another data controller. When the processing of your personal data is based on your consent, you can always withdraw your consent.
You can exercise these rights by contacting Wihuri’s data protection expert in data protection matters through the contact details set out above.
Even though Wihuri seeks to resolve any privacy related disagreements in co-operation with you, you also have the right to lodge a complaint to a data protection authority about our processing of your personal data. For more information, please contact your local data protection authority.