DATA PROTECTION NOTICE FOR CUSTOMERS AND STAKEHOLDER GROUPS
Kotka Maritime Research Centre ry (business ID 2023333-8), hereafter Merikotka
Address: Keskuskatu 10, 48100 Kotka, Finland
Telephone: (040) 752 4392
Contact person for privacy issues: Anna Kiiski (firstname.lastname@example.org)
2. For what purposes do we process the personal information of data subjects?
In this context, customer refers to the persons belonging to the organisations or other communities with which Merikotka is in a customer relationship or other business-like relationship.
Stakeholder groups refer to the contact persons of those organisations or other communities with which Merikotka is cooperating (e.g. representatives of companies and other communities providing services for Merikotka) or is in some other relationship (e.g. representatives of the media as parties to communications activities).
Merikotka processes the personal information of data subjects for the following purposes (one or more simultaneously):
- Maintenance and analysis of customer or stakeholder relationship
Merikotka may use your personal information for the maintenance, analysis, or improvement of a customer or stakeholder relationship with the company or other community you represent.
- Providing services
Merikotka may use your personal information for the provision of services, if the company or other community represented by you has used our digital services, subscribed to our newsletter, or taken part in our events. The personal information will be used to exercise the rights and obligations based on an agreement or other commitment between Merikotka and the customer.
- Customer communications
Merikotka may use your personal information in their customer communications, for example to send event notifications to you or to ask for your feedback concerning their services.
Merikotka may be in touch with you to notify you of new results and events.
The legal justification for the processing of personal information is Article 6 of the General Data Protection Regulation of the EU and its following sections:
- the data subject has given their consent for the processing of their personal information for one or more purposes;
- the processing of the information is necessary to implement an agreement to which the data subject is party, or to implement pre-contractual procedures at the data subject’s request;
- the processing is necessary for the fulfilment of the controller’s legal obligation; and
- the processing is necessary for the realisation of the legitimate interests of the controller or a third party, unless the interests or basic rights and freedoms of the data subject requiring data protection take priority over such interests.
Merikotka processes your information in order to complete a contract with you (e.g. newsletter subscription).
Merikotka has certain legitimate interests related to the conduct of their business operations, such as the right to promote the sales of their services among customers by means of marketing and sales, and Merikotka may rely on said interest to practice direct marketing by utilising the contact information provided by you.
If the processing of information is not based on a contractual need or legitimate interest, Merikotka may not request your consent for other kinds of personal information processing.
Merikotka may process your personal information if obligated by law, for example on the basis of the retaining requirement of the Accounting Act.
- Which data may we collect?
The personal information collected by Merikotka may include for example the following data and their amendments:
3.1. Basic information of all data subjects
- first and last name
- contact information (mail address, e-mail address, telephone and fax numbers)
- language of services
- technical data submitted by Merikotka users to digital devices (such as computers and mobile devices) and data concerning cookies and other similar technologies
- communications targeted at data subjects and associated activities
- e-mails and on-line conversations
3.2. Information of data subjects taking part in Merikotka events
- date of birth for events where such information is required, e.g. by shipping companies
- essential information concerning the organisation and participation in the event
- dietary information (special information provided voluntarily by the user)
- names and dates of birth of co-travellers when required, e.g. by shipping companies.
- From which sources do we collect personal information?
Most of the data is received at the start of and during a customer or stakeholder relationship as well as from the programs you use to utilise our products and services. Merikotka may also receive personal information from authorities, organisations, public directories and other public sources, such as community web pages and social media channels.
- With whom may we share your personal information?
Merikotka will not hand over, sell, or otherwise give away your personal information to third parties external to the Merikotka research centre, unless otherwise specified below.
Merikotka may share the personal information of participants at Merikotka events with other participants of the same event.
Merikotka may share your personal information with partners with whom Merikotka is managing and implementing research projects.
Merikotka may share your personal information with third parties realising Merikotka services. Such services may include e.g. software services, technical management and analysis of personal data, research activities, marketing, communications, and various campaigns.
The protection of your personal information is important for Merikotka, which is why we will never allow such third parties to use these data for any other purposes than the provision of the service in question, requiring that all parties protect the personal information in accordance with this data protection notice.
Merikotka may share your personal information if so required by a court of law or similar institution.
- Will we transfer your personal information outside of the EU?
In providing their services, Merikotka may use resources and servers located in different parts of the world. Merikotka may therefore transfer your personal information outside of the country where the services are used, and possibly to countries outside of the EU or the EEA, where legislation does not offer any specific protection for personal information, or where data protection legislation may be very different.
In such cases Merikotka will ensure that there are legal grounds for the transfer of the information, and that the user’s personal information is protected according to applicable legislation, for example by using (where necessary) standard agreements approved by relevant authorities and by requiring the use of appropriate technical and practical data protection measures.
- For how long will we process your personal information?
Merikotka will process your personal information in this register for as long as they have some valid justification for the processing, as described in section 2 of the data protection notice, and for a reasonable period of time thereafter. Your information will be processed for at least as long as there is a customer relationship or any other business-like relation in existence between you and Merikotka.
- How can you exercise your personal information rights?
As a data subject, you have different opportunities to influence the processing of your personal information. We request that you get in touch with the contact person mentioned in section 1 when it comes to exercising your rights. Your rights include:
- a) The right to access all personal information collected from you. In practice, this means that we will send you a report of your personal information in the register on the basis of a correct and identifiable request.
- b) The right to request the rectification or deletion of your personal information. If you notice any errors or defects in your information, you may submit a correction request to us.
- c) The right to request the deletion of your personal information. We are obligated to delete your personal information in this register if any of the following conditions is fulfilled and no retainment obligation is constituted by other legislation or authoritative orders:
- the personal information is no longer needed for the original processing purposes;
- you withdraw your consent and no other legal justification exists for the processing;
- you object to the processing because of your personal special circumstances and no justified reason exists for the processing, or you object to the use of your personal information for direct marketing purposes;
- your personal information has been unlawfully processed;
- your personal information must be deleted to fulfill a legal obligation applicable to Merikotka, based on the legislation of the European Union or of Finland.
- d) The right to request the limitation of the processing of your personal information. You may ask that Merikotka limits the processing of your personal information, if:
- you deny the accuracy of the personal information that is in Merikotka’s possession;
- the processing is unlawful and instead of deletion you demand use limitations;
- Merikotka no longer needs the personal information for the purposes of the processing, but you do need it to make, present, or defend a legal claim;
- you have objected to the processing of the personal information while waiting for verification of whether Merikotka’s legitimate interests displace your legitimate interests.
- e) The right to object to the processing of your personal information. If Merikotka is processing your information on the basis of a legitimate interest, you are entitled to object to the processing of your personal information due to your personal special circumstances. All data subjects in this register are entitled to object to the processing of their personal information for direct marketing purposes.
- f) The right to transfer your information from one system to another. If the automatic processing of your personal information is based on consent or agreement, you are entitled to receive the personal information you have submitted to Merikotka in a commonly readable format.
- g) The right to withdraw your consent. If all or some of your personal information are being processed in this register on the basis of your consent, you are entitled to withdraw your consent.
- h) The right to appeal to a supervisory authority. If a disagreement existing between you and Merikotka and related to the processing of your personal information cannot be settled, you are entitled to take the issue to a data protection supervisor.
- Is it necessary for you to give us your personal information?
In order for Merikotka to fulfill the contractual obligations related to the provision of the service, Merikotka must receive and process some of your personal information. Without such information we are unable to provide you with the services that require the processing of personal information.
- Do we carry out profiling?
We are currently not engaged in any profiling that would have legal effects or other consequences for you, as intended in the EU General Data Protection Regulation.
- Which legislation is applied to the processing of the information?
We are a Finnish organisation operating in Finland. Finnish legislation and valid EU legislation, such as the General Data Protection Regulation, will be applied to this data register and the personal information contained therein.