Ensto Privacy Notice

1 Introduction

Your privacy is important to us. This privacy notice aims to give you a general idea on how we at Ensto Group collect, store, use and disclose your personal information whenever you purchase or use our products and services, visit our website, or work or otherwise interact with one of our local Ensto group companies. This privacy notice also aims to spell out the conditions that govern how we process and protect that information and the rights you have in relation to your personal data.

Please note that this privacy notice is not an exhaustive description of how we process your personal data. We may process your personal data in various circumstances and have therefore, for your convenience, prepared this general privacy notice to cover the most essential information that applies to all our processing activities. In case you are looking for more detailed information, we have also prepared separate and comprehensive privacy policies for each category of circumstances when we process your data. You may find links those privacy policies at the bottom of this page.

It is important that you read this at least this privacy notice, but preferably the specific privacy policy applicable to your particular situation, so that you are aware of how and why we are using your personal data. Please note that this policy does not form part of any contract to provide services to you or other parties. We may update this policy at any time in accordance with applicable data protection laws and will make an updated version available to you.

We have divided this privacy notice into different sections, so that you may easily find the information that interests you the most:

1. Introduction
2. Controller information
3. Purposes and legal bases of data processing
4. Categories of personal data and their retention periods
5. Sources of personal data
6. Recipients of personal data
7. Profiling
8. Your rights
8.1 Access
8.2 Rectification
8.3 Erasure (right to be forgotten)
8.4 Restriction of processing
8.5 Data portability
8.6 Object
8.7 Withdrawing your consent
8.8 Complaints
9. How to contact us

Please note that you have the right to object, on grounds relating to your particular situation, to the processing of your personal data at any time when we process your data based on our legitimate interests. Please see sections 4 and 8.6 of this document for further information.

2 Who Processes Your Personal Data?

2.1 Companies within the Ensto Group

Your personal data may be processed by one or more companies within the Ensto Group. Such company or companies may act as the controller(s) of your personal data, meaning that they decide what data is collected about you, how it is collected and for what purposes. In case they do not act as controllers, they may act as processors, meaning that they process your personal data on the controller’s behalf.

For example, if you are:

Ensto Oy’s customer or partner, the controller of your personal data is Ensto Oy;
Ensto Finland Oy’s customer, the controller of your personal data is Ensto Finland Oy;
Ensto Sweden AB’s potential customer, the controller of your personal data is Ensto Sweden AB;
Ensto France SAS’s employee, the controller is Ensto France SAS;
looking for career opportunities at, e.g., Ensto UK Ltd, it acts as the controller of the job application and other related data you have provided them in connection with your application;
interested in career opportunities within the Ensto Group in general, your data may be processed by multiple Ensto Group companies in a number of countries, each acting as a controller; or
just visiting our website, the controller is Ensto Oy.

Please consult the privacy policy applicable to your particular situation for more detailed information privacy@ensto.com.

2.2 Other Organizations Processing Your Personal Data

On occasion, we engage third parties outside the Ensto Group to process your personal data, either on our behalf or as controllers, depending on the situation. Please find a list of such third parties below, all of which may not apply to your particular case:

Outside legal counsels
Tax and other relevant authorities
Auditors
IT system management service providers
Information security service providers
Telephone service providers
Event organizers
Suitability test providers
Business partners: distributors, suppliers and vendors, business-to-business customers in case you have permitted us to use you/your company as reference
Third party as part of a merger or an acquisition
Travel agencies, flight/ferry companies, hotels etc.
Leasing companies
Occupational health service providers
Recruiting companies
Temporary staffing companies
Training companies
Survey companies
Outsourced accounting and/or payroll companies
Other cooperation partners (such as suppliers)

2.3 Location of the Processing of Your Data

Please note that while most of the parties processing your personal data (either within or outside the Ensto Group) are located in Finland or elsewhere in the EU or EEA, some of those parties may be located or process data in third countries, depending on the person whose data is being processed and the situation at hand. If we and/or our service providers processing data on our behalf transfer your personal data from a country within the EU or the EEA to countries outside the EU or the EEA, the transfer is subject to standard data protection clauses adopted by the EU Commission or other appropriate safeguards such as binding corporate rules, unless the EU Commission has found that the level of data protection is adequate in the country in question. You can obtain a copy of said safeguards by contacting the contact person referred to in Section 2.1.

3 How to Contact Us

We are happy to assist you in case you have any questions or concerns over the processing of your personal data or the exercise of your rights. In order for us to provide you with sufficient information and pragmatic advice, we ask you to send your questions or comments in writing to the contact person indicated above in Section 2.1.

We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

4 Why We Process Your Data?

We only process your personal data when it is necessary and when we have legal grounds to do so. Depending on your particular situation, we may process your personal data for example for the following purposes:

Purpose	Legal Basis
Creating, maintaining and enhancing Ensto group companies’ products, services and stakeholder relationships, and providing services related thereto	Processing is necessary for the purposes of our legitimate interests to market, create and enhance our business, undertake risk assessments, undertake stakeholder due diligence, personalise our services and communication, update stakeholder details and preferences, execute logistics and transfer data to companies within and outside the Ensto Group to better serve our stakeholders and allocate our resources; and/or Processing is necessary for the performance of our contract with you (for example performance of R&D services) or in order to take steps at your request prior to entering into a contract; and/or Your consent
Providing products and services and stakeholder management	Processing is necessary for the performance of our contract with you (for example to deliver agreed goods); and/or Processing is necessary for the purposes of our legitimate interests to execute risk assessments, undertake stakeholder due diligence, personalise our services and communication, market, execute logistics and transfer data to companies within and outside the Ensto Group to better serve our stakeholders and allocate our resources
Complying with contractual obligations	Processing is necessary for the performance of our contract with you
Business management and planning	Processing is necessary for the purposes of our legitimate interests to handle claims and solve disputes, undertake accounting obligations, undertake auditing obligations as well as strategic planning and resource analysis
Organizing meetings and events	Processing is necessary for the purposes of our legitimate interests to create, enhance, and market our business and communicate with stakeholders; and/or Processing is necessary for our legitimate interests to recruit new employees, communicate and share information with employees and recruitment candidates, protect our well-being, improve workplace conditions and job satisfaction, and/or Your consent
Stakeholder communications and surveys	Processing is necessary for the purposes of our legitimate interests to market, to create and enhance our business, and to personalise our services and communication
Crisis communication	Processing is necessary for compliance with our legal obligations (for example to inform you of any data breaches)
Complying with legal obligations	Processing is necessary for compliance with our legal obligations (for example to keep proper and accurate books and to provide occupational health care and arrange for required insurances)
Supporting network and system security	Processing is necessary for compliance with our legal obligations; and/or Processing is necessary for the purposes of our legitimate interests to monitor data traffic and network security
Identification purposes	Processing is necessary for compliance with our legal obligations (for example to make sure personal data are not disclosed to the wrong person)
Direct marketing of Ensto group companies’ products and services (including newsletters), informing of events organized or attended by Ensto group companies such as fairs	Processing is necessary for the purposes of our legitimate interests to market, create and enhance our business and personalise our services and communication; and/or Your consent
Recruitment and selection of employees	Processing is necessary for the purposes of our legitimate interests to recruit new employees and to establish recruitment candidates’ reliability; and/or Your consent; and/or Processing is necessary in order to take steps at your request prior to entering into a contract
Providing newsletters and chat services to website visitors	Your consent
Website and newsletter analytics	Processing is necessary for the purposes of our legitimate interests to market, create and enhance our business and personalise our services and communication

Please find more detailed information in the privacy policy applicable to your situation.

5 What Data Do We Process and How Long Is Your Data Stored?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. We may also be required to retain data longer than described below if necessary for an ongoing legal process or to comply with a decision from a court or authority.

Most typical personal data and their retention periods are listed below, but please consult the privacy policy applicable to your situation for more detailed information.

Data subject	Data	Retention Periods
Employees and job applicants	Name, title and contact information: home address, home and work telephone number, private and work email, date pf birth, gender, education and training details, CV	Employees: retained for 10 years from the end of employment relationship Recruitment candidates: deleted with the application either upon completion of the recruitment process or, with the candidate’s consent, 12 months thereafter
	Permissions and consents	Employees: retained for the duration of employment relationship.
	Photographs	Employees: retained for the duration of employment relationship or, with the employee’s consent, as long as his/her photograph is used for Ensto Group’s presentation and marketing materials Recruitment candidates: if photograph is provided by the candidate, it is deleted with the application either upon completion of the recruitment process or, with the candidate’s consent, 12 months thereafter
	Suitability test results	Employees: deleted within 12 months after testing is completed Recruitment candidates: deleted upon completion of the recruitment process or, with the candidate’s consent, 12 months thereafter
Customers, partners, and potential customers	Name of stakeholder, name and title of contact persons/representatives of stakeholder, Ensto group companies’ contact person, and contact details of the aforementioned: address, telephone number, email, permissions and consents, contractual details including goods and services provided, contact requests and claims, payment history	Retained for 10 years from the last communication related to the stakeholder relationship Please note that if you, e.g., have opted-out of or withdrawn its consent to receive newsletters or other marketing messages from us, we may need to save certain data longer than 10 years to make sure we respect your wishes
	Photographs	Deleted immediately after the termination of stakeholder relationship, unless used for historical research or for the purposes of protecting our intellectual property rights against third-party claims or for requirements from the authorities. In the latter case photographs are used as proof/statement of use of our brands. When photographs are stored for said purposes, they are appropriately protected, and their use is limited for the purposes of historical research and protection of rights
	Newsletter or other	Deleted immediately once subscription is cancelled (except to the extent we need to save data to make sure we respect your wish not to receive direct marketing messages from us)
Website visitors	Name, company information, email, telephone number, relation to Ensto, product information and other data provided in connection with service requests, permissions and consents	Retained for 10 years from receipt of request / provision of permission/consent Please note that if you, e.g., have opted-out of or withdrawn your consent to receive newsletters or other marketing messages from us, we may need to save certain data longer than 10 years to make sure we respect your wishes
	Newsletter subscriptions and analytics (e.g. about how many times you have opened a marketing email)	Deleted immediately once subscription is cancelled (except to the extent we need to save data to make sure we respect your wish not to receive direct marketing messages from us)
	Electronic identification data including IP address and information collected through cookies, device ID, Ensto website analytics, user browser history, user activity details and preferences	Retained as long as required for us to comply with their data security obligations stemming from applicable data protection legislation, especially Articles 33 and 34 of the GDPR

6 What Are the Sources of the Personal Data We Process?

We collect your personal data mainly directly from you. However, we may collect personal data also from the below-listed organizations and sources, among others:

Ensto Group companies
Recruiting companies
Companies providing credit reference information
Professional social networking channels and social media channels
Temporary staffing companies
Cookies and other similar technologies
External contact lists obtained from customers, suppliers, distributors, vendors and other business partners as well as during seminars, events, and exhibitions

Please find more detailed information in the privacy policy applicable to your situation. Also, please note that depending on the situation, we may be required to request your consent prior to collecting your data, in which case the consent will be asked from you separately. We may also be required to inform you of any information collected from the above sources and will then let you know accordingly of any such information prior to using it in any decision-making concerning you.

The provision of personal data is not mandatory but may be required in order for us to provide services and products to you or enter into a contract with you, communicate with you or personalize our marketing and communications to suit you best. Once you have entered into a contract with us, the provision of personal data may also be an implicit contractual requirement in order for us to comply with its contractual and legal obligations. In case you do not provide us with the data we request, we might not be able to do business with you, contact you, or recruit you, and may be prevented from complying with our obligations, and thus we may be forced to terminate our contractual or other relationship with you.

7 Profiling

We may use cookies and similar technologies when we send out newsletters and marketing messages to collect and analyze analytics, user browser history, user activity details and preferences. Based on our findings we may, for example, provide you with tailored marketing messages. For more information about the cookies we use and how you can choose not to be subject to them, see our Cookie Policy.

We may ask employees to participate in occupational personality tests to assess, for example, personal behavioral preferences, i.e. how you like to work. We may also use third party recruiting tools when recruiting new employees. It is not compulsory to take party in any such test. The tests and tools previously mentioned often generate reports on the results automatically. We will share any reports generated with you and you will have a chance to provide your views on the results either orally or in writing.

8 Your Rights

8.1 Right of Access

You have the right to obtain from us confirmation as to whether or not we process your personal data, and, when we do process such data, you have the right to obtain access to your personal data and the following information:

the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom personal data have been or will be disclosed, in particular recipients in countries outside the EU and EEA or international organizations;
where possible, the envisaged period for which personal data will be stored or, if not possible the criteria used to determine that period;
the existence of the right to request from us the rectification or erasure of personal data or restriction of processing of personal data concerning you or to object such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from you, any available information as to their source;
the existence of automated decision-making and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you; and
the appropriate safeguards applied to transfers of personal data to countries outside the EU and EEA

You have the right to receive a copy of the personal data undergoing processing as long as the copy does not adversely affect the rights and freedoms of others. For any further copies requested by you, we may charge a reasonable fee based on administrative costs. In case you have participated in a suitability test, we will provide you with the test results free of charge upon your request.

8.2 Right to Rectification

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us or during the recruitment process.

You have the right to have your inaccurate personal data rectified by us without undue delay. You also have the right to have incomplete personal data completed.

We will communicate any rectification of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.3 Right to Erasure (Right to be Forgotten)

You have the right to have your personal data erased by us without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
you object to the processing and there are no overriding legitimate grounds for the processing;
you object to the processing of your personal data for the purposes of direct marketing;
your personal data have been unlawfully processed; or
the personal data have to be erased for compliance with a legal obligation to which we are subject.

Please note that the GDPR recognizes situations where processing may be necessary regardless of the applicability of the abovementioned grounds. We will always inform you separately of such circumstances and our grounds for processing.

We will communicate any erasure of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.4 Right to Restriction of Processing

You have the right to restrict the processing of your data in the following situations:

you contest the accuracy of the personal data we process and as a result processing is restricted while the accuracy is verified;
the processing is unlawful, but you oppose to the erasure of the personal data and instead request us to restrict their use;
we no longer need the personal data for the purposes of the processing presented in this document, but the data are required by you for the establishment, exercise, or defence of legal claims; or
you have objected to processing on grounds relating to your particular situation and such processing is legally based on our legitimate interests as presented in this document, and as a result processing is restricted while it is verified whether our legitimate grounds override those of yours.

If your processing has been restricted, we will inform you before the restriction is lifted.

We will communicate any restriction of processing to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.5 Right to Data Portability

You have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format (such as XML-format with relevant meta data), and you have the right to transmit such data to another controller, when:

we process your personal data based on your consent; or
we process your personal data because it is necessary for the performance of our contract with you; and
we process such personal data by automated means; and
this right does not adversely affect the rights and freedoms of others.

In the above situation, you also have the right to have your personal data transmitted directly from us to another controller, where that is technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data at any time on grounds relating to your particular situation, if we process your personal data based on our legitimate interests as presented in this document. After such objection, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing and these grounds override your interests, rights and freedoms, or unless we need them for the establishment, exercise or defense of legal claims.

8.7 Right to Withdraw Your Consent

In the limited circumstances we process your personal data based on your consent, you have the right to withdraw such consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, in case you feel we are not complying with applicable data protection legislation.