Lahti Energy – Privacy statement of visitors at Kymijärvi power plants

Updated 10 February 2025

This privacy statement describes how we at Lahti Energy collect and process personal data about our visitors at Kymijärvi power plants and the visitor centre.

1 Controllers and contact details in matters of data protection

Lahti Energy Ltd (080487-1)

If you have any questions or comments about the processing of your personal data or the privacy statement, you can contact us using the following contact details:

Lahti Energy Ltd / Data protection matters

Kauppakatu 31
Postal address: P.O. Box 93, 15140 Lahti
Tel. 029 000 8000

Contact details of Lahti Energy Group’s Data Protection Officer:

Tel. 029 000 8000
Email: tietosuojavastaava@lahtienergia.fi

2 Purposes of use and grounds for processing your personal data

As a security clearance facility, we have a legal obligation to collect and process our visitors’ information for visitor management in accordance with the safety management system to protect facilities, areas, people, and property, and to ensure the security of the facility and manage security threats. This information includes, for example, data on the completion of safety orientation.

The collection of personal data is mandated by laws such as:

3 Personal data processed and source of the data

We process the following data about visitors and Lahti Energy’s employees who host the visit:

Visitors’ name, employer/company/organization and contact information, such as phone number
The name, employer/company/ organization and contact information, such as email and phone number, of the person responsible for the visitor group
Confirmation that the visitor has familiarized himself/herself with Lahti Energy’s safety instructions and completed the safety orientation.
The date of the visit
The start and end times of the visit
Name, email and phone number of the host of the visit

The personal data processed is collected before and during the visit from the visitor, the person responsible for the visitor group, and/or the host of the visitor. Other sources of information are used within the limits prescribed by the law.

4 Parties to whom we transfer and disclose data and transfer of data outside the EU or EEA

We don’t transfer your personal data, and we don’t transfer them outside the EU or EEA. Data may be disclosed with legal proceedings or official processes to the authorities, for example the police.

We use service providers, such as security company, to implement visitor management. We sign an agreement on the processing of personal data with all our service providers that act as processors. We require that our partners process personal data only to the extent that it is necessary to provide the service.

5 Protection and storage of personal data

The data is stored in data processing systems in which technical and software measures are used to ensure information security and to control the use of data.

Personal data is retained for as long as necessary to fulfil Lahti Energy’s rights and obligations and to respond to any possible claims. We retain the data related to visits for 7 days. We retain the data related to safety orientation (including name, employer, phone number) for 3 months after the end of the calendar year in which the visit took place.

6 Automated decision-making

Personal data is not used for any automatic decision-making that would have legal or similar effects on the data subject.

7 Your rights as a data subject in relation to data processing

As a data subject, you have the following rights:

Right of inspection and the right to demand the rectification and erasure of data

You have the right to receive information about the processing of your personal data, to inspect the data about you stored in the personal register as well as the right to demand the rectification of incorrect data and the erasure of data.

Right to object and right to restrict processing

You have the right to object to or request the restriction and transfer of the processing of your data.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the competent supervisory authority if you believe that the EU General Data Protection Regulation has not been complied with in the processing of your personal data.

Please deliver the requests about your rights as a data subject to the address mentioned in section 1.