{"id":77199,"date":"2024-11-04T12:18:01","date_gmt":"2024-11-04T10:18:01","guid":{"rendered":"https:\/\/testi-e2c55b704894.senaatti.fi\/?page_id=77199"},"modified":"2024-11-04T12:18:01","modified_gmt":"2024-11-04T10:18:01","slug":"privacy-statement-of-identity-and-access-management","status":"publish","type":"page","link":"https:\/\/testi-e2c55b704894.senaatti.fi\/en\/privacy-statement-of-identity-and-access-management\/","title":{"rendered":"Privacy statement of Identity and Access Management"},"content":{"rendered":"

[vc_row][vc_column][senaatti_hero heading=”Privacy policy of Senate Group’s Identity and Access Management”][\/vc_column][\/vc_row][vc_row][vc_column][vc_column_text remove_empty_space_above=”true”]<\/p>\n

1. Data controllers and contact information<\/h2>\n

Senate Properties and Defence Properties Finland<\/p>\n

Senate Properties: Lintulahdenkatu 5 A, P.O.Box 237, 00531 Helsinki, Finland
\nE-mail: kirjaamo(at)senaatti.fi<\/p>\n

Defence Properties Finland: Isoympyr\u00e4katu 10, P.O.Box 1, 49401 Hamina, Finland
\nE-mail: kirjaamo(at)puolustuskiinteistot.fi<\/p>\n

Tel: +358 294 830 000<\/p>\n

Data Protection Officer Petri Konttinen, firstname.lastname(at)senaatti.fi<\/p>\n

2. Purpose of the processing of personal data and
\nthe legal basis for the processing<\/h2>\n

The purpose of processing personal data is to manage the access rights of employees of Senate Properties and its subsidiary state unincorporated enterprise Defence Properties Finland to the Group’s information systems. In addition, the system manages the access rights of Senate Properties’ and Defence Properties Finland’s stakeholders (clients and service providers) to the electronic services provided by Senate Group.<\/p>\n

Senate Properties and Defence Properties Finland act as joint controllers in accordance with Article 26 of the GDPR. Processing of data is necessary for the performance of tasks carried out in the public interest by the controllers (Article 6.1e of the GDPR). In respect of Group employees, processing is necessary for the performance of a contract to which the data subject is party. (GDPR Article 6.1b).<\/p>\n

3. Processed personal data and groups of data subjects<\/h2>\n

The system processes data on employees of the Group, employees of the Group’s client organisations, and employees of service providers.<\/p>\n

Following information is stored about employees of Senate Group: name, phone number, e-mail address, organisation, username, the person\u2019s supervisor, job title, address of the place of work, start date of employment, and external ID.<\/p>\n

Following information is stored about customers and service providers employees: name, phone number, e-mail address, organisation, username.<\/p>\n

4. Regular data sources<\/h2>\n

The data of Senate Group\u00b4s employees are obtained from Senate Group\u00b4s personnel systems.<\/p>\n

The data of customers employees are obtained when they register using VIRTU (the user stores the phone number in the system themselves).<\/p>\n

The data of service providers employees are obtained when they register in the system themselves, or Senate Group\u00b4s administrator registers the data on behalf of them.<\/p>\n

Users may supplement their information.<\/p>\n

5. Recipients or categories of recipients of the personal data<\/h2>\n

The Group’s main users, as well as the Group’s service providers who perform system maintenance and support tasks on behalf of the controllers have access to personal data.<\/p>\n

6. Data transfers outside the EU or EEA<\/h2>\n

The data will not be transferred outside the EU or the EEA.<\/p>\n

7. Security of personal data<\/h2>\n

Senate Group has taken the necessary technical and organisational measures to protect personal data against unauthorised access and against accidental or unlawful destruction, alteration, disclosure, transmission or other unlawful forms of processing.<\/p>\n

The data in the system is protected by a firewall and other technical measures. Authentication is required to use the systems.<\/p>\n

System users who have an authentication code to the system can only see their own profile information.<\/p>\n

8. Data retention period and the principles\u00a0for determining it<\/h2>\n

Every three months, the service provider erases the data on persons who have not used the system for two years.<\/p>\n

9. Rights of the data subjects<\/h2>\n

Data subjects may exercise their rights under the General Data Protection Regulation in the following matters:<\/p>\n