Privacy policy of Senate Properties' and Defence Properties Finlands Identity and Access Management
1. Data controller and contact information
Senate Properties, Lintulahdenkatu 5 A, 00530 Helsinki, Finland
Email: senaatti(at)senaatti.fi
Phone: +358 294 830 000
Data Protection Officer Petri Konttinen, firstname.lastname(at)senaatti.fi
2. Purpose of the processing of personal data (the purpose of use of the system) and the legal basis for the processing
The system manages the rights of employees of Senate Properties and its subsidiary, Defence Properties Finland, to access Senate Group’s information systems. In addition, the system manages the access rights of stakeholders (customers and service providers) of Senate Properties and Defence Properties Finland to the digital services provided by Senate Group. Senate Properties and Defence Properties Finland operate as joint controllers in accordance with Article 26 of the EU General Data Protection Regulation. Personal data processing is necessary in order to comply with the controllers’ statutory obligations Article 6(1)(c) GDPR.
3. Data content of the file system and categories of personal data
Name, phone number, email address, organisation, username.
In addition, the following information is stored about employees of Senate Group: the person’s supervisor, job title, address of the place of work, start date of employment, and external ID,
4. Regular data sources
The personal data of Senate employees comes from Senate’s HR information system automatically, and the data on Defence Properties Finlands personnel comes from Defence Properties Finlands HR information system.
Data on persons from outside Senate Group is obtained from the users themselves if they register in the system using an email. If a user registers using VIRTU, the data is stored in the system automatically (except for the phone number, which the user stores in the system themselves). The controllers register some external persons centrally (when the user gains access to the internal network). Users may then supplement their information.
5. Recipients or categories of recipients of the personal data
The data is available to administrators and the service provider’s designated operators to use in order to provide the service.
6. Data transfers to third countries outside the EU or EEA, information on the applicable security measures and means to obtain copies or information on their content
No data is transferred to countries outside the EU or the European Economic Area.
7. Security principles for the file system
The data in the system is protected using normally available protection methods. The system can only be used with a personal username and password. Access to personal data is restricted to persons who have a justified need for it based on their agreed work duties. Users can only see their own data in the system. The designated administrators of Senate and the service provider have more extensive rights to access the data.
8. Data retention period and the criteria for determining it
Every three months, the service provider erases the data on persons who have not used the system for two years.
9. Rights of the data subjects
Data subjects may exercise their rights laid down in the General Data Protection Regulation (Article 14(2)(c)) in relation to the following:
- Right to access personal data
- Right to have data rectified
- Right to have data erased
- Right to restrict processing
- Right to object
- Right not to be subject to a decision based solely on automated processing.
Data subjects may exercise their rights by submitting a written request to the Data Protection Officer. The data controller implements the data subjects’ requests without undue delay (within a maximum of 1 month, with 3 months reserved for requests concerning several file systems), taking into consideration the nature and grounds for the processing.
In addition, data subjects have the right to file a complaint with the supervisory authority (Office of the Data Protection Ombudsman, Article 14(2)(e)).