1. PRIVACY POLICY / CUSTOMER
(Date 8.5.2026)
1.1. Data Controller
Aaltovoima Oy / Aaltovoima Teollisuus Oy / Aaltovoima Pohjoinen Oy
Linnoitustie 3, 02600 Espoo
1.2. Person responsible for data protection matters
Sara Kervinen, HR Manager
040 123 9817
sara.kervinen@aaltovoima.fi
1.3. Description of the privacy policy
This privacy policy, in accordance with Articles 13 and 14 of the General Data Protection Regulation (679/2016/EU) and the Data Protection Act (1050/2018), explains how the controller processes personal data related to the management of the customer relationship of a business customer.
1.4. Purpose and legal basis for processing personal data
The personal data of business customers is processed for the management and analysis of the customer relationship, the provision and personalization of the controller's services, business development and planning, as well as marketing, distance selling and opinion and market research. In addition, personal data is processed for customer communication, which is carried out electronically and in a targeted manner.
Personal data may be processed in a manner permitted by applicable legislation for the marketing purposes of the companies belonging to the controller's group at any given time and of partners carefully selected by the controller (including direct marketing, distance selling and opinion and market research). The data will only be disclosed to partners for purposes that support the business customer register and are not incompatible with the purposes of processing the register.
The legal basis for the processing of personal data is the legitimate interest in managing the business customer relationship and the implementation of the related contractual relationships.
1.5. Personal data processed
Identification and contact information of the data subject, such as name, contact information for the workplace (postal address, telephone number, e-mail) and information regarding the data subject's position, title and role.
- Information related to marketing and promotional activities, such as direct marketing permits and prohibitions, marketing measures
- Information related to corporate customer relationships or substantive connections, such as customer number, customer relationship start and end information and method, information related to customer relationship management and contact (e.g. order and cancellation information, feedback and customer service event records), billing and collection information.
- Information related to the management of electronic services, such as newsletter subscriptions and cookies containing personal data, as well as information related to the service of the identified user, such as information about the features of the service. Username and password
- Changes to the data of the data subject in the personal data categories identified above.
1.6. Regular sources of the register
Personal data is collected from the data subject himself, from various services that the data subject uses, and in connection with various marketing measures. Personal data can also be collected and updated from the registers of the controller's partners, the trade register, and from companies and authorities that provide services related to personal data.
1.7. Data transfers and transfers
Personal data is processed outside the company only by contractual partners. The contracts specifically address data protection and the processing of personal data. In principle, personal data may only be disclosed for purposes that support the business purpose of the corporate customer register and where the purpose of use of the data is not incompatible with the purposes of use of this register.
Customers' personal data will not be disclosed, except in accordance with the requirements of the law, or in situations where the disclosure of data is mandatory for the implementation of the interests and rights of an employee.
If the controller sells or otherwise organizes its business, the data may be disclosed to buyers in connection with corporate reorganizations.
Data will not be transferred outside the European Union or the European Economic Area unless there is an immediate need for the transfer, for example due to the technical implementation of the service. In such cases, the controller will ensure the level of data protection as required by law and will also ensure a high level of data protection through agreements.
1.8. Data protection
Databases containing personal data are protected by technical means, such as firewalls and passwords. Storage takes place in locked premises and access to the premises is restricted. Manually maintained and processed materials are located in premises that are inaccessible to unauthorized persons.
Technical solutions are kept up to date and updated regularly, either in the form of automatic or manual updates. Virus protection is in place and deviations are responded to. Deviations detected by the firewall are also responded to.
1.9. Data retention period
The data subject's personal data is only stored for as long as it is necessary to fulfill the purposes specified in this privacy policy or until we receive a request to delete it.
1.10. Data subject rights
You have the right to check what personal data has been collected about you and to influence how we use it. You have the following rights within the framework of applicable legislation:
Right of inspection – you have the right to check what data we have collected about you or to obtain confirmation that there is no personal data concerning you in our register. You can also make us a request for correction or completion if your data is incorrect, inaccurate or incomplete.
Right to object – if you feel that we do not have the right to process your personal data or that we have processed it unlawfully, you can object to the processing of your data. We will process your request as soon as possible.
Right to be forgotten – the data subject has the right to request the deletion of personal data within the limits and in accordance with applicable data protection legislation.
Right to complain – If you feel that we are violating applicable legislation in the processing of personal data, you have the right to file a complaint with the Data Protection Ombudsman. Instructions for filing a complaint can be found at https://tietosuoja.fi/yhteystiedot
1.11. Use of cookies
Our websites contain cookies, as we want to offer you practical, easy and reliable services on the internet. Cookies are used to store small files on your device, e.g. your computer or smartphone. The length of time it remains on your device depends on the type of cookie. On our websites, cookies do not contain personal data and cannot be used to identify a visitor.
Cookies are intended to improve user convenience (when you enter your username and password, they are remembered so that you do not have to enter the same information multiple times during a session) and user experience (we use cookies to learn how visitors reach our website so that we can improve our services. For example, Google Analytics helps us analyze how visitors use our website, and it also allows us to track our website traffic).
You can always modify your personal settings in your browser and prevent the use of cookies.
1.12. Changing the Privacy Policy
We are developing our privacy practices and as a result, it may be necessary to change this Privacy Policy. Changes may also be based on changes in legislation. If the changes are significant or if we intend to use the information for purposes other than those stated here, we will notify the data subjects of the changes.
If you have any questions regarding the matter, please contact sara.kervinen@aaltovoima.fi
2. DATA PROTECTION STATEMENT / JOB APPLICANT AND EMPLOYEE
(Date 8.5.2026)
2.1. Data Controller
Aaltovoima Oy / Aaltovoima Teollisuus Oy / Aaltovoima Pohjoinen Oy
Linnoitustie 3, 02600 Espoo
2.2. Data Protection Officer
Sara Kervinen, HR Manager
040 123 9817
sara.kervinen@aaltovoima.fi
2.3. Description of the data protection statement
This data protection statement, in accordance with Articles 13 and 14 of the General Data Protection Regulation (679/2016/EU) and the Data Protection Act (1050/2018), explains how the controller processes personal data related to job applicants and employees.
2.4 Purpose and legal basis for processing personal data
Job applicant data is processed for the purpose of the recruitment process and related matters. In addition, the data is processed to implement applicant communications. Job applicant data is processed at the request of the job applicant and in applicant communications, the controller has a legitimate interest in informing about current issues and providing, among other things, information related to job search and life.
Employee personal data is processed in connection with the management of employment matters and related employer obligations. In addition, the data is processed to implement employee communications. The basis for processing the data is the legitimate interest arising from the employment relationship between the employee and the controller and legislation related to the management of employer obligations. The processing of specific personal data requires the employee's consent.
The data in the register is used:
- To manage the recruitment process
- For applicant communication
- For employment management
- For monitoring working hours and absences
- For employee contact
- For payment of wages and salaries
- For managing fringe benefits (including telephone, car, sports or lunch benefits)
- For recruitment
- For fulfilling statutory obligations (including taxation, insurance, Kela)
- For arranging occupational health care
- For exercising the rights of the data subject
- For compiling statistics on the controller's activities and planning
Personal data may be processed for the above-mentioned purposes in companies belonging to the same group as the controller.
2.5. Personal data processed by job seekers
- Basic information about the person, for example, first and last names, contact information and nationality.
- Educational information, for example, degrees, special skills, qualifications, competencies,
- Language skills, etc.
- Work experience, for example, work history and references, work permit.
- Information related to job search and employment, for example, job search status, wishes regarding job duties and workplace location, possible information related to personal and suitability assessments, photo and usability information, possible areas of interest related to job search.
- Other information related to job search, for example, driver's license information
2.6. Personal data processed employees
The register only processes personal data that is necessary for the purpose of use, which include
- information related to the job search process (job application, education, work experience, qualifications, other information provided by the employee)
- identification and contact information (first and last name, address, telephone number, email address, date of birth and personal identification number, gender) and other information necessary for identification, e.g. a copy of the identity card
- employment contract and other agreements related to the employment relationship (start and end date of the employment relationship, nature of the employment relationship, fringe benefits)
- information related to monitoring working hours and absences (sick leave, annual leave, other absences)
- trade union information (information collected with the employee's consent and is necessary, e.g. for the union for the settlement of membership fees)
- information containing the content, development and performance of work tasks
- information related to compensation paid on the basis of the employment relationship (cash salary,
- benefits, bonuses, taxation information, travel and expense reimbursements, employer contribution information)
- information related to occupational health care, such as the employee's health status (information collected from the employee himself or herself or otherwise with his or her written consent and the processing of the information is necessary)
- taxation, occupational health and insurance information
- information related to work tools and equipment
- information related to the termination of the employment relationship (contracts, work certificate)
- changes/log information of previous, individualized information
2.7. Regulated sources of the register
Personal data concerning job applicants and employees is mainly collected from them. In addition, data is collected from the systems used to manage the employment relationship and employer obligations. With the consent of the job applicant or employee, data can also be collected from elsewhere. Permission is not required to obtain a person's credit information or criminal record information to determine the person's reliability. However, the controller must inform the person in advance of the acquisition of such information.
2.8. Disclosure and transfer of data
Personal data is processed outside the companies belonging to the group only by contractual partners. The agreements specifically address data protection and the processing of personal data. In principle, personal data may only be disclosed for purposes that support the mission of the job seeker or employee register, and where the purpose of the data is not incompatible with the purposes of this register.
The personal data of job seekers and employees will not be disclosed, except in accordance with the requirements of the law, or in situations where the disclosure of data is mandatory for the implementation of the employee's interests and rights.
If the controller sells or otherwise organizes its business, the data may be disclosed to buyers in connection with corporate restructuring.
Data will not be transferred outside the European Union or the European Economic Area, unless there is an immediate need for the transfer, for example due to the technical implementation of the service. In such cases, the controller will ensure the level of data protection as required by law and will also ensure a high level of data protection through agreements.
2.9. Data protection
Databases containing personal data are protected by technical means, such as firewalls and passwords. Storage takes place in locked premises and access to the premises is restricted. Manually maintained and processed materials are located in premises that are inaccessible to unauthorized persons.
Technical solutions are kept up to date and updated regularly, either in the form of automatic or manual updates. Virus protection is in place and deviations are responded to. Deviations detected by the firewall are also responded to.
2.10. Data retention period
We retain personal data for the period required by the purpose of the processing, as long as the law requires us to do so or until we receive a request to delete it. All information related to job search is retained in our register for 2 years from the last action or contact. All information related to the employment relationship is retained for the period required by law.
2.11. Rights of the data subject
You have the right to check what personal data has been collected about you and to influence how we use it. You have the following rights within the framework of applicable legislation:
Right of inspection – you have the right to check what information we have collected about you or to obtain confirmation that there is no personal data about you in our register. You can also make us a request for correction or completion if your information is incorrect, inaccurate or incomplete.
Right to object – if you feel that we do not have the right to process your personal data or that we have processed it unlawfully, you can object to the processing of your information. We will process your request as soon as possible.
Right to be forgotten – the data subject has the right to request the deletion of personal data within the limits and in accordance with applicable data protection legislation.
Right to complain – If you feel that we are violating applicable legislation in the processing of personal data, you have the right to file a complaint with the Data Protection Ombudsman. Instructions for filing a complaint can be found at https://tietosuoja.fi/yhteystiedot
2.12. Use of cookies
Our websites contain cookies, as we want to offer you practical, easy and reliable services on the internet. Cookies are used to store small files on your device, e.g. your computer or smartphone. The length of time it remains on your device depends on the type of cookie. On our websites, cookies do not contain personal data and cannot be used to identify a visitor.
Cookies are intended to improve user convenience (when you enter your username and password, they are remembered so that you do not have to enter the same information multiple times during a session) and user experience (we use cookies to learn how visitors reach our website so that we can improve our services. For example, Google Analytics helps us analyze how visitors use our website, and it also allows us to track our website traffic).
You can always modify your personal settings in your browser and prevent the use of cookies.
2.13. Changing the Privacy Policy
We are developing our privacy practices and therefore, it may be necessary to change this Privacy Policy. Changes may also be based on changes in legislation. If the changes are significant or if we intend to use the information for purposes other than those stated here, we will notify the data subjects of the changes.
If you have any questions regarding this matter, please contact sara.kervinen@aaltovoima.fi
