Data controller

Name: Oral Hammaslääkärit Ltd
Business ID: 2863321-3
Postal and street address: Linnoitustie 6 B, FI-02600 Espoo, Finland
Tel.: +358 (0)10 400 3010 (switchboard)

Contact person in matters concerning the register

Name: Sanna Elomaa
Email: tietosuojavastaava@oral.fi

Name of the register

Oral Group’s corporate customer and decision-maker register

Legal basis for the processing of personal data

The processing of personal data is based on Oral’s legitimate interest (for example, direct marketing) and agreements between Oral and its corporate customers.

Purpose of the processing of personal data

Personal data in the register is processed for the following purposes:

• the management, maintenance, development and analyses of contractual relationships between Oral and its corporate customers as well as creating statistics concerning these relationships
• customer communications
• direct marketing (including electronic newsletters)
• targeted online advertising
• profiling data subjects to improve the accuracy of targeted adver-tising
• performing opinion and marketing surveys
• arranging sales and marketing events
• arranging marketing competitions and prize draws
• planning and developing Oral’s business operations and services

Categories of data subjects

The decision-makers and contact persons of existing and potential corporate and community customers

Data content of the register

The register may contain the following personal data:

• name
• title, profession, position or role in the company
• company name
• contact details (postal address, email address and telephone num-ber)
• age, year of birth, sex, native language and service language
• LinkedIn profile details
• consent and prohibitions regarding direct marketing
• areas of interest (for example, the data subject’s professional areas of interest) and profiling data
• data related to communications (for example, email messages, online discussions, electronic service forms, chat messages and recordings of phone calls)
• data concerning marketing and sales promotions (for example, marketing efforts targeted to the data subject and participation in events)
• possible additional information provided directly by the data subject

Regular sources of the register’s data

The data is primarily collected directly from the data subject, for example, by telephone, online, in meetings or upon using other services or entering into the contract and during the contractual relationship.

Personal data can also be collected from and updated by means of publicly available data sources such as company websites, the Finnish Trade Register, other public and private registers and various service providers (for example, Suomen Asiakastieto Oy and Bisnode Finland Oy).

Regular disclosure of data

The personal data is not regularly disclosed to third parties.

Oral may use external service providers to perform tasks related, for example, to marketing. In these cases, Oral is committed to ensuring that the service provider shall process the personal data only to the extent necessary for the purposes of providing the service.

Transfer of data outside the EU or EEA

The personal data is not transferred outside the European Union or the European Economic Area.

Principles of register protection

The register’s data is stored in data systems that use technical and programmatic measures to ensure the sufficient level of data security. Each person using the register has a personal user ID and password to access the system. Only designated people have access to the data in the register to the extent necessary for the purposes of performing their tasks.

Data retention period

The personal data in the corporate customer register is retained for the duration necessary for the purposes of the register, while considering the statutory retention periods (as defined in the Accounting Act and the Tax Prepayment Act, for instance). The default retention period is five (5) years after the termination of the customer relationship/contractual relationship (except insofar as is required to be longer by law.).

The personal data in the decision-maker register is retained permanently to the extent allowed by law. Oral shall regularly assess the necessity of retaining the data, and in addition, Oral shall take care of such reasonable measures to ensure that no personal data related to the data subjects that are obsolete, inaccurate or incompatible with the purpose of the processing of the personal data are stored in the register.

Rights of the data subject

Right of access 
A data subject has the right to inspect what personal data on him/her has been stored in Oral’s marketing register. The inspection request must be submitted to the contact person of the register in writing.

Right to request the rectification of data 
A data subject has the right to request the rectification of inaccurate or incomplete personal data concerning him/her. The rectification request must be submitted to the contact person of the register in writing.

Right to request the erasure of data
A data subject has the right to request the erasure of personal data concerning him/her in the register unless there is a legal basis for the retention of the data. The erasure request must be submitted to the contact person of the register in writing.

Right to request the restriction of the processing of personal data and the right to object to the processing of personal data
A data subject has the right to request the restriction of and to object to the processing of his/her personal data. The restriction request and objection concerning the processing of personal data must be submitted to the contact person of the register in writing.

Right to withdraw consent regarding the processing of personal data
If the processing of personal data is based on the data subject’s consent, the data subject has the right at any time to withdraw his/her consent regarding the processing of personal data. The consent can be withdrawn by submitting a written request to the contact person of the register.

Right to prohibit using personal data for the purposes of direct marketing
A data subject has the right to prohibit using personal data concerning his/her for the purposes of direct marketing and marketing or opinion surveys. Such prohibition may be given, for example, by unsubscribing from the mailing list according to the instructions provided in our marketing e-mails or by submitting a written request to the contact person of the register.

Right to prohibit profiling
A data subject has the right at any time to prohibit using personal data concerning him/her for the purposes of profiling. Such prohibition may be given by submitting a written request to the contact person of the register.

Right to data portability
To the extent the data has been provided directly by the data subject and the processing thereof is based on the data subject’s consent, the data subject has the right to acquire such information in a machine-readable form and the right to transmit this data to another controller. This can be performed by contacting the contact person of the register in writing.

Right to lodge a complaint to the supervisory authority
A data subject has the right to lodge a complaint concerning failures in the processing of personal data to the supervisory authority (Data Protection Ombudsman).

 

Updated: 1 June 2022