Policies and Certificates

Privacy Policy for Website Users

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data at any time when we process your data based on our legitimate interests or for direct marketing purposes. Please see sections 3 and 8.6 of this document for further information.

1 INTRODUCTION

Ensto Oy (“Ensto”) is committed to protecting the privacy and security of your personal information. This privacy policy describes how we collect and use personal information about you, in accordance with the General Data Protection Regulation (GDPR) and Chapter 24 of the Finnish Information Society Code (Electronic Direct Marketing and Cookies).

This policy applies to all users of our website at www.ensto.com (referred to in this document as “visitors”). This policy does not form part of any contract nor does it establish any obligation to provide services. We may update this policy at any time and will make an updated version available to you.

It is important that you read this policy, together with any other privacy policy we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

2 CONTROLLER INFORMATION

Name: Ensto Oy
Address: PL 77/Ensio Miettisen katu 2, 06101 Porvoo, Finland
Contact: Data Protection Responsible, privacy@ensto.com

3 PURPOSES AND LEGAL BASES OF DATA PROCESSING

Purpose	Legal basis
Providing newsletters to visitors	Your consent
Providing chat service to visitors	Your consent
Creating, maintaining and enhancing Ensto group companies’ products, services and stakeholder relationships, and providing services related thereto	Processing is necessary for the purposes of Ensto group companies’ legitimate interests to serve Ensto group companies’ stakeholders, and to market, create and enhance Ensto group companies’ business; and/or Consent
Website and newsletter analytics	Processing is necessary for the purposes of our legitimate interests to market, create and enhance our business and personalise our services and communication
Crisis communication towards visitors	Processing is necessary for compliance with our legal obligations (for example to inform you of any data breaches)
Supporting network and system security	Processing is necessary for compliance with our legal obligations; and/or Processing is necessary for the purposes of our legitimate interests to monitor data traffic and network security
Legal processes and compliance with court orders, and protection of Ensto group companies’ rights	Processing is necessary for compliance with our legal obligations; and or Processing is necessary for the purposes of Ensto group companies’ legitimate interests to protect their intellectual property and other rights against third-party claims or requirements from the authorities
Mergers and acquisitions where we are involved	Processing is necessary for the purposes of our legitimate interests to develop and manage our business
Identification purposes	Processing is necessary for compliance with our legal obligations (for example to make sure personal data are not disclosed to the wrong person)

4 CATEGORIES OF PERSONAL DATA AND THEIR RETENTION PERIODS

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. We may also be required to retain data longer than described below if necessary for an ongoing legal process or to comply with a decision from a court or authority.

Details of retention periods for different aspects of your personal information are available below.

Category of data	Retention period
Name, company information, email, telephone number, relation to Ensto, product information and other data provided in connection with service requests	Retained for 10 years from receipt of request
Newsletter subscriptions and analytics (e.g. about how many times you have opened a marketing email)	Deleted immediately once subscription is cancelled (except to the extent we need to save data to make sure we respect your wish not to receive direct marketing messages from us)
Electronic identification data including IP address and information collected through cookies, device ID, Ensto website analytics, user browser history, user activity details and preferences	Retained as long as required for us to comply with their data security obligations stemming from applicable data protection legislation, especially Articles 33 and 34 of the GDPR
Permissions and consents	Retained for 10 years from the provision of permission/consent Please note that if you, e.g., have opted-out of or withdrawn your consent to receive newsletters or other marketing messages from us, we may need to save certain data longer than 10 years to make sure we respect your wishes
Contact requests and claims	Retained for 10 years from the receipt of your request/claim
Passport or other ID card information	Retained for 6 months from acquiring the information

5 SOURCES OF PERSONAL DATA

Ensto collects your personal data mainly directly from you, but also from the following sources:

• Cookies and other similar technologies. For more information, please see our Cookie Policy.

The provision of personal data is not mandatory but may be required in order for Ensto to provide services and products to you and personalize our marketing and communications to suit you best. In case you do not provide us the data we request, all features of our website might not function as intended.

6 RECIPIENTS OF PERSONAL DATA

• Outside legal counsels
• IT system management service provides
• Information security service providers
• Ensto group companies
• Third party as part of a merger or an acquisition

Please note that while most recipients are located in Finland or elsewhere in the EU or EEA, some of the above-listed recipients may be located or process data in third countries, depending on the person whose data is being processed and the situation at hand. If Ensto and/or its service providers processing data on behalf of Ensto transfer your personal data to countries outside the EU or the EEA, the transfer is subject to standard data protection clauses adopted by the EU Commission or other appropriate safeguards such as binding corporate rules, unless the EU Commission has found that the level of data protection is adequate in the country in question. You can obtain a copy of said safeguards by contacting the contact person referred to in section 2 above.

7 PROFILING

We may use cookies and similar technologies on our website and when we send out newsletters. We do this to collect and analyze website and newsletter analytics, user browser history, user activity details and preferences. Based on our findings we may, for example, provide you with tailored marketing messages. For more information about the cookies we use and how you can choose not to be subject to them, see our Cookie Policy.

8 YOUR RIGHTS

8.1 Right of Access

You have the right to obtain from us confirmation as to whether or not we process your personal data, and, when we do process such data, you have the right to obtain access to your personal data and the following information:

the purposes of processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom personal data have been or will be disclosed, in particular recipients in countries outside the EU and EEA or international organizations;
where possible, the envisaged period for which personal data will be stored or, if not possible the criteria used to determine that period;
the existence of the right to request from us the rectification or erasure of personal data or restriction of processing of personal data concerning you or to object such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from you, any available information as to their source;
the existence of automated decision-making and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you; and
the appropriate safeguards applied to transfers of personal data to countries outside the EU and EEA

You have the right to receive a copy of the personal data undergoing processing as long as the copy does not adversely affect the rights and freedoms of others. For any further copies requested by you, we may charge a reasonable fee based on administrative costs.

8.2 Right to Rectification

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes.

You have the right to have your inaccurate personal data rectified by us without undue delay. You also have the right to have incomplete personal data completed.

We will communicate any rectification of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.3 Right to Erasure (Right to be Forgotten)

You have the right to have your personal data erased by us without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
you object to the processing and there are no overriding legitimate grounds for the processing;
you object to the processing of your personal data for the purposes of direct marketing;
your personal data have been unlawfully processed; or
the personal data have to be erased for compliance with a legal obligation to which we are subject.

Please note that the GDPR recognizes situations where processing may be necessary regardless of the applicability of the abovementioned grounds. We will always inform you separately of such circumstances and our grounds for processing.

We will communicate any erasure of your personal data to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.4 Right to Restriction of Processing

You have the right to restrict the processing of your data in the following situations:

you contest the accuracy of the personal data we process and as a result processing is restricted while the accuracy is verified;
the processing is unlawful, but you oppose to the erasure of the personal data and instead request us to restrict their use;
we no longer need the personal data for the purposes of the processing presented in this document, but the data are required by you for the establishment, exercise, or defence of legal claims; or
you have objected to processing on grounds relating to your particular situation and such processing is legally based on our legitimate interests as presented in this document, and as a result processing is restricted while it is verified whether our legitimate grounds override those of yours.

If your processing has been restricted, we will inform you before the restriction is lifted.

We will communicate any restriction of processing to each recipient to whom we have disclosed your personal information, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients upon your request.

8.5 Right to Data Portability

You have the right to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format (such as XML-format with relevant meta data), and you have the right to transmit such data to another controller, when:

we process your personal data based on your consent; or
we process your personal data because it is necessary for the performance of our contract with you; and
we process such personal data by automated means; and
this right does not adversely affect the rights and freedoms of others.

In the above situation, you also have the right to have your personal data transmitted directly from us to another controller, where that is technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data at any time on grounds relating to your particular situation, if we process your personal data based on our legitimate interests as presented in this document. After such objection, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing and these grounds override your interests, rights and freedoms, or unless we need them for the establishment, exercise or defense of legal claims.

However, if your personal data are processed for direct marketing purposes, you have the right to object to such processing at any time. If you object to direct marketing, your personal data will no longer be used for such purposes.

In case you are a consumer, we will only send you electronic direct marketing, such as email newsletters, if you have given us your consent to do so (i.e. you have opted in to such marketing). You may withdraw your consent at any time as explained below, after which we will no longer process your personal data for electronic direct marketing purposes.

8.7 Right to Withdraw Your Consent

If we process your personal data based on your consent, you have the right to withdraw such consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in case we do not comply with applicable data protection legislation. The Finnish supervisory authority is the Data Protection Ombudsman (Fin: tietosuojavaltuutettu).

9 HOW TO CONTACT US

We are happy to assist you in case you have any questions or concerns over the processing of your personal data or the exercise of your rights. In order for us to provide you with sufficient information and pragmatic advice, we ask you to send your questions or comments in writing to the contact person privacy@ensto.com .

We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.