Data Protection and Privacy Policy

We use your personal data as a representative of your organization to ensure that the obligations and rights related to our organisations' partnership relationship are fulfilled in accordance with legislation and agreements.

Your personal data is used, for example, for the performance of contractual obligations, the development, manufacture and delivery of products and services, business development, quality management, sales and marketing purposes, customer relationship management (CRM), invoicing and other financial activities.

In terms of recruitment, personal data is processed for the receiving and processing of job applications and for the recruitment process to carry out the procedures.

In addition, personal data may be processed, if necessary, in connection with complaints and disputes and legal proceedings. Personal data may also be processed in accordance with the terms of applicable legislation to ensure security, report, investigate and prevent suspected offences, other offences and abuses, and suspicions related to them. The company has a whistleblowing reporting channel for reporting irregularities. Personal data collected through the reporting channel is registered by the company to which the notification applies at any time.

Personal data is not used for automated decision-making or profiling.

The processing of personal data is mainly based on the following legal bases:

• Implementation of relationship agreements and the implementation of prior measures.
• Compliance with legal obligations.
• Our legitimate interest to carry out communications and marketing (including direct marketing and marketing planning) as well as in the management, reporting and planning of customer relationships and the development and safeguarding of the organisation's operations. The processing of personal data related to the manufacture, supply, sale and other contractual relationships of the products and services, as well as marketing related to the recipient's responsibility in the partner organisation, is also based, where applicable, on the legitimate interest of the controller or a third party.
• In terms of recruitment, the primary basis for processing personal data is also the legitimate interest of the controller. When the recruitment process is leading to an employment relationship, the controller may also process the personal data of the job seeker for the purpose of concluding and implementing the employment contract.
• The processing of personal data in the whistleblowing reporting channel is based on compliance with a legal obligation and, where applicable, on a legitimate interest in subsidies and investigates and prevents abuses.
• Consent for processing purposes to which the data subject has given his or her consent.

When we process personal data based on a legitimate interest, we weigh the benefits and potential harms of the processing to the data subjects and have estimated that the rights and interests of the data subjects do not overrule the legitimate interest. The data subject has the right to object to the processing of personal data based on a legitimate interest by providing a reason related to his or her particular situation. In this case, we will assess whether, despite objections to processing, there is a substantially important and legitimate reason that supersedes the interests, rights and freedoms of the data subject, or whether the processing is permitted on other grounds under the GDPR. However, the data subject always has the right to object to the processing of personal data for direct marketing purposes. Upon request, we will provide further information regarding this processing and the right of objection.

The controller mainly processes the following types of personal data:

(a) Name, position/job title* and company/organisation/unit information, address*, telephone number*, e-mail address and other contact details
b) Business offers, invitations to tender, orders, billing history, products and services you use, and other information related to our partnership.
(c) Information you provide for communication and marketing through our mutual contacts, studies, surveys, etc. methods.
(d) Technical datasets such as information on the dates, duration and potential costs of contacts and contact channels.
(d) Job applications, CVs and other documents and information provided by the job seeker in connection with job applications and recruitment, as well as information on potential references and other materials generated during the recruitment process, such as any suitability assessments.
e) Photographs, CCTV footage, user IDs and other information related to access control, the use of information technology and the security of our offices. CCTV is subject to a separate privacy policy, which is available from company’s offices with CCTV.
(g) reports of suspected infringements and misconduct through the Whistleblowing reporting channel and information relating to their investigation.

* Optional personal data. Other personal data is necessary, for example, for the customer relationship or for compliance with legal obligations and for other purposes described in this privacy policy.

We will retain your personal data for as long as it is necessary for the purposes specified in this Privacy Policy, after which the data will be deleted. The criteria for retention periods for the main categories of personal data are described below.

• As a rule, personal data is processed for as long as required by a customer or other partnership relationship, and the data subject is a contact person, after which it is deleted no later than 2 years after the last contact.
• Marketing contact information and other marketing-related personal data will be processed as long as we target marketing to the data subject or data subject is in contact with certain services or products, and the data subject has not objected to the processing of personal data for direct marketing or, if direct marketing is based on consent, withdrawn their consent.
• Personal data processed on the basis of legal obligations is stored for as long as required by law.
• The personal data of the job seeker is stored during and after the recruitment process for as long as is necessary to fulfil the controller's rights and obligations and to answer any questions and requirements, but no longer than 1 year after the completion of the recruitment process. With the data subject's consent, personal data may be stored, for example, for future recruitment processes.
• Notifications made via whistleblowing channel will be processed for the time required for the investigation and possible follow-up.

By way of derogation from the general rules described above, personal data may be stored for longer if it is needed, for example, in connection with a complaint or similar matter or a trial.

Upon request, we will provide additional information on the retention periods and practices of personal data.

We collect your personal data through direct contacts and publicly available sources, as well as information from our own employees or other representatives of our organisation.

The personal data of jobseekers are collected mainly from the data subject himself or herself. With the data subject's consent, personal data may also be collected from other sources, such as the service provider carrying out the suitability assessment or references reported by the job seeker or other third parties.

In the Whistleblowing reporting channel, personal data is mainly obtained from the declarant. In addition, personal data may also be collected from other sources in accordance with the legal conditions and the process of processing notifications.

We use cookies on our website to improve and personalize the user experience and to analyse the use of our website. Some cookies are necessary to enable the core functions of our website. Non-essential cookies can be disabled at any time in our website's Cookie Settings or by changing your browser settings. In this document, you will find detailed information on how you can do this.
We may use cookies to collect, for example, the following information:
Information about the use and browsing of website features, the page from which the user has accessed our website, the model of the device, a unique device and/or cookie identifier, a data collection channel (internet browser, mobile browser, application), browser version, session time and duration, and operating system.

The user has the possibility to block the use of cookies by adjusting their browser settings. If a user blocks the use of cookies on this website, some services or sections of the website may not function correctly.

A cookie is a small text file that is stored in your browser when you visit a website. Cookies are used to enable visitors to perform different activities on the website and to collect limited information about visitors to improve the user experience of the website.

This site uses the HubSpot marketing automation system. HubSpot uses cookies to collect information about how users use our website. We use the information collected by HubSpot cookies to create analytical reports, improve our website and support our marketing activities. For more information, see the full HubSpot Privacy Policy

On our website, we use different types of cookies:
Session cookies are stored on your device during a browser session. These session cookies expire at the end of a browser session (normally when a user leaves the browser).
Fixed-term cookies have a predetermined lifespan. Depending on the cookie, lifespan can vary from up to one day to two years.

First-party cookies are cookies set by our website when you visit. Third-party cookies are cookies set by someone other than the one responsible for our website. These third-party cookies may be set through elements of other websites on our website, such as images, social media extensions or site analytics.

We use third-party cookies from the following service providers:

Google
Google Ads
Google Analytics
Google Tag Manager
Linkedin
Lead feeder

User tracking
We use Leadoo’s tracking service to follow what users are doing on the site and combine this behavioral data with other data we can gather from e.g. chat interactions. Leadoo uses etag tracking in order to hook together the same users behavior over several sessions – in practice this works similarly to cookie based tracking. Please check out Leadoo Marketing Technologies Ltd’s Privacy Policy (https://leadoo.com/privacy-policy/) for more information on what is tracked and what your rights are. Leadoo works as the Processor and we work as the Controller for the data in terms of GDPR. You can stop the tracking by emptying your browser’s cache after the visit. For more on how Leadoo works as a GDPR compliant processor, see https://leadoo.com/privacy-policy-processor/ 

These platforms use both first-party and third-party cookies, as well as similar technologies to identify the site visitor or enable site analytics.

Many websites use third-party cookies to understand and track how you browse different websites. Third-party cookies found on our website are subject to the privacy policies of that third party. Their privacy policies provide additional information on the other purposes for which third parties may use the data.

In order to control which cookies are used and to determine how cookies can be used when you visit our website, we have divided the cookies we use into four different categories. These categories are defined on the basis of cookies and the purposes of the data collected by cookies.

Necessary cookies
These cookies are needed to ensure that our websites work safely and in the right way, therefore these cookies cannot be disabled on our systems.

Essential cookies enable the basic functions of the website and are usually set based on your choices regarding the functions, for example in matters such as privacy settings and the filling out of forms.
We do not need your consent to set these cookies, but you can still disable them by changing your browser settings. However, this affects the operation of the website, which means that some necessary functions may not work. Read more about necessary cookies

Functionality cookies
We use cookies that are not mandatory for the functionality of the website. In general, it is set based on the information provided on the website to personalize and optimize the user experience. Learn more about functional cookies

Analytics cookies
These cookies help us understand how visitors experience the site and allow us to improve the user experience. We also use cookies to report website usage statistics. Read more about analytics cookies

Marketing cookies
We don't run ads on this website. We use these cookies to make the content on the site as interesting and useful as possible for each user. Common uses of cookies include, for example, adapting content to the user. Read more about marketing cookies

The user has the ability to block the use of cookies by adjusting their browser settings. If a user blocks the use of cookies on this website, some sections of the website may not function correctly.

You can edit the cookie settings by clicking the "Cookie Settings" button. You can then select the desired cookie category or de-select from the desired cookie category, then click "Update Settings". You may need to refresh your web page for the settings to take effect. You may also need to change your browser settings and manually delete cookies to clear your device from previously set cookies.

Browser settings
Alternatively, most web browsers allow most cookies to be managed using browser settings. You can find more information on how to manage cookies in your browser from your browser's own website. Below you will find instructions on how to manage cookie settings for the most popular browsers:

Google Chrome
Microsoft Edge
Mozilla Firefox
Microsoft Internet Explorer
Opera
Apple Safari

If you block cookies
If you block all cookies in your browser settings, the functionality and performance of our website may be impaired by certain features that depend on cookies. Blocking cookies can therefore cause the website not to function properly, and some necessary functionalities may not work at all.

Personal data may be transferred and disclosed within Norrhydro Group in accordance with the purposes described in this Privacy Policy and the requirements of data protection legislation.
Different third parties may be used in the processing of personal data. We have taken care of the agreements required by data protection legislation with these parties.
Personal data may be disclosed to the authorities in accordance with the legal conditions. We may also need to disclose personal data in emergencies or other unexpected situations in order to protect people or property. In addition, we may need to disclose personal data if a company is involved in legal proceedings or other dispute resolution proceedings or mergers and acquisitions.
Personal data will not be transferred outside the EU or EEA.

The security of personal data and the confidentiality, integrity and usability of the data shall be ensured by appropriate technical and administrative measures. Data and service are protected through firewalls, physical device protection, access control, permissions, encryption technologies, and active monitoring, among other things. Personal data is protected from unauthorized access and unlawful or accidental data processing.
Manually maintained materials are located in premises where unauthorized access is denied.

You have all rights to your personal data in accordance with data protection legislation. However, the application of the data subject's rights in each individual situation depends on the purpose and situation of the processing of personal data.
You have the right, in accordance with applicable data protection legislation, to:
(a) to be informed about the processing of your personal data;
(b) have access to your personal data and check the personal data we process concerning you
(c) require the rectification of inaccurate and inaccurate personal data and the supplementing of the data;
(d) require the erasure of your personal data;
e) withdraw your consent and object to the processing of your personal data to the extent that the processing of your personal data is based on your consent
(f) object to the processing of your personal data on grounds relating to your particular situation to the extent that the processing of your personal data is based on our legitimate interest. The controller may refuse to carry out a request for objection on the grounds laid down by law. However, the data subject always has the right to object to the processing of their personal data for direct marketing purposes and profiling related to direct marketing
(g) receive your personal data in digital form and transfer that data to another controller, provided that you have provided that personal data to us yourself, we process such personal data on the basis of a contract or your consent, and the processing is carried out automatically;
(h) require restrictions on the processing of your personal data;

We may ask you to refine your request and verify your identity before processing the request. We may refuse to comply with your request on the basis of applicable law. If the request cannot be accepted, we will notify you of the refusal in writing.

You must send requests for your rights in writing or by e-mail using the following contact information:

Data Privacy Request – Contact Information
PL 8075
96200 Rovaniemi
Finland

dataprotection(at)norrhydro.com

Contact information on data protection issues related to the notification channel:
The processing of personal data related to the reporting channel is particularly confidential and limited only to persons and entities designated for the processing and process of clearing the notifications. In order to ensure confidential processing of notifications, please contact the following party primarily with regard to requests for data subjects' rights related to the reporting channel or other data protection issues: dataprotection(@)norrhydro.com
You also have the right to lodge a complaint with the competent supervisory authority or with the supervisory authority of the EU Member State where your place of residence or place of work is located, if you consider that we have not processed your contact details in accordance with applicable data protection legislation.
You can find the contact details of the Office of the Data Protection Ombudsman here: the Office of the Data Protection Ombudsman.

We continuously develop our services and operations and may periodically amend this Privacy Policy in the event of a change in the manners or purposes of processing personal data. We encourage you to periodically review this privacy policy to detect changes. The latest version is available on the company’s website.

This Privacy Policy was published on 11 November 2021.