Lahti Energia

Privacy statement of Lahti Energy’s partner and site register

Updated on 31 May 2022

This privacy statement describes how we at Lahti Energy collect and process personal data about employees and independent contractors working at Lahti Energy’s sites as well as about the decision-makers and contact persons of contractors.

1 Controllers

Lahti Energy Ltd (080487-1) and Lahti Energia Sähköverkko Oy (2075131-1)

Each Lahti Energy Group company, as the controller, maintains its own register for the following entities and is responsible for processing in its own operations for the purposes and on the legal bases specified in this privacy statement.

2 Contact details in matters of data protection

Lahti Energy Ltd/Data protection matters
Kauppakatu 31
Postal address: P.O. Box 93, 15140 Lahti
Tel. 029 000 8000

Contact details of Lahti Energy Group’s Data Protection Officer:

Tel. 029 000 8000
Email: tietosuojavastaava@lahtienergia.fi

3 For what purposes and on what basis do we process your personal data?

The processing of personal data is based on the law (e.g. the Occupational Safety and Health Act, the Tax Assessment Procedure Act, the Tax Administration’s decision on the disclosure obligation related to construction, the Aliens Act, the Security Clearance Act, Article 32 of the General Data Protection Regulation) or Lahti Energy’s legitimate interest (e.g. monitoring and measuring work performance, ensuring safety, crime prevention). The personal data is used to fulfil statutory obligations and rights as well as obligations and rights based on employment, piecework and other contracts, for occupational safety, other safety and crime prevention as well as for monitoring and measuring quality and work performance, such as:

  • managing site, contractor and employee information and handling obligations on Lahti Energy’s own sites;
  • managing Lahti Energy’s statutory obligations, e.g. fulfilling the obligations required by the Occupational Safety and Health Act, the Act on the Individual Tax Number and the Tax Number Register and the Act on the Contractor’s Obligations and Liability when Work is Contracted Out, as well as preventing activities endangering national or public security in accordance with the Security Clearance Act;
  • identification of persons at the site by the project supervisor;
  • reporting to the Tax Administration and the supervisory authority;
  • site-specific orientation and access permit checks for persons and, if necessary, contacts; and
  • testing and development of services and systems.

4 What kind of personal data do we process and where do we collect the data from?

The register contains the following information on subcontractor employees and independent contractors working at Lahti Energy’s sites or performing tasks related to Lahti Energy’s assignments, as well as on the decision-makers and contact persons of contractors/subcontractors.

  • Basic information of the employee and contractor, such as name, contact details (postal address, email, phone number), individual tax number, home country, nationality, date of birth or personal identity code, employer and site-specific access permit information.
  • Name, employer and contact details (postal address, email, phone number) of the decision-makers and contact persons of contractors.
  • With regard to foreign workers, the information required in accordance with the Aliens Act (sections 86a, 86b, 72) and the Act on Posting Workers to ensure the right to work (such as a residence permit) and to fulfil the reporting obligation.
    • Information required by the Occupational Safety and Health Act:
    • the person’s first and last name, date of birth and individual tax number;
    • the start and end date of working on the site;
    • the name and business ID of the employee’s employer or a corresponding foreign identifier; and
    • the name and contact details in Finland of the representative referred to in section 8 of the Act on Posting Workers.
  • Information related to the employee’s access permit:
    • the competence card information provided by the employee during orientation;
    • the open and score feedback given by the employee on orientation;
    • information on the validity of the orientation;
    • access information on access-controlled gates and doors;
    • the validity period of the access permit and right to work;
    • identifiers attached to the access permit;
    • in the case of a driving authorisation, the images recorded by the system of the front of the vehicle when passing through the gate;
    • the validity period of the waiting time; and
    • other reasons limiting the duration of the access permit.
  • Information required by the Act on the Contractor’s Obligations and Liability when Work is Contracted Out, such as information on the applicable collective agreement, certificates of employee’s pension insurances taken out and of pension insurance premiums paid, and certificates on the determination of employees’ social security.
  • Information processed on the basis of the Tax Administration’s decision on the disclosure obligation related to construction and the Tax Assessment Procedure Act:
    • identifying details concerning the party under disclosure obligation and a contact person with contact details;
    • site location;
    • identifying details concerning the employee, the start date and estimated end date for the work the employee carries out on the site;
    • insurance information on foreign employees;
    • information on whether an employee has an employment contract, is an agency contract worker, self-employed, trainee or a voluntary worker;
    • identifying details concerning the employer and the employer’s representative or contact person with contact details;
    • identifying details on the party using agency-hired labour; and
    • information on contractors and their employees that is processed on the basis of a contract.

Security clearance information in accordance with the Security Clearance Act on the persons subject to the clearance, such as name, personal identity code, email address, statement on the clearance.

The data in the register is regularly collected from the data subject’s employer, the data subject or the contractor. Personal data may also be collected and updated from public and private registers. The Finnish Security and Intelligence Service collects information from data sources in accordance with the Security Clearing Act in order to conduct a security clearance.

5 To whom do we transfer and disclose data? Do we transfer data outside the EEA?

The data in the register is regularly disclosed in accordance with the requirements of the law to the authorities and other parties, such as

  • the tax authorities;
  • the occupational safety and health authorities;
  • the Employment and Economic Development Office (information and assurance on a foreign employee in accordance with section 72 of the Aliens Act) and the name of a foreign employee and the applicable collective agreement to the shop steward, health and safety representative; and
  • the Finnish Security and Intelligence Service (in accordance with the Security Clearance Act, e.g. when applying for a clearance and making notifications in accordance with the Act).

Lahti Energy may also disclose data to its partners in order to fulfil contractual or legal obligations.

To manage the data in the partner and site register, Lahti Energy uses an external service provider whose service is used to store the data. We enter into an agreement on the processing of personal data with all service providers and require our partners to process personal data only to the extent that it is necessary to provide the service in question.

Personal data will not be transferred outside the EEA.

6 How do we protect data and how long do we store it?

The data contained in the register is protected by firewalls, passwords and other technical means. The data in the register can only be accessed by specified persons to the extent required by their duties. We ensure data protection through data processing agreements concluded with the service providers that process the personal data.

Personal data is stored for as long as is necessary due to the purpose of use of the personal data or legal obligations. For example, lists in accordance with the Occupational Safety and Health Act are stored for six years from the end of the year in which the site was completed. The contractor stores the data collected in accordance with the Act on the Contractor’s Obligations and Liability when Work is Contracted Out for at least two years after the end of the work related to the contract in question. In accordance with the Security Clearance Act, the statement related to the security clearance shall be destroyed within six months of the receipt of the statement.

7 Your rights as a data subject in relation to data processing

Requests concerning the rights of data subjects must be sent to the address mentioned in section 2. As a data subject, you have the following rights:

  • Right of inspection and the right to demand the rectification and erasure of data
    • You have the right to inspect the data about you stored in the personal register as well as the right to demand the rectification of incorrect data and the erasure of data.
  • Right to object and right to restrict processing
    • You have the right to object to or request the restriction and transfer of the processing of your data.
  • Right to lodge a complaint with the supervisory authority
    • You have the right to lodge a complaint with the competent supervisory authority if you believe that the EU General Data Protection Regulation has not been complied with in the processing of your personal data.