Record of personal data processing in the Positive credit register and in customer service

The Finnish Tax Administration’s Incomes Register Unit
P.O. Box 325, FI-00052 VERO

Visiting address:
Vääksyntie 4, Helsinki

Processors

The cloud platform is provided by Microsoft.

The certificate service is provided by Digia Plc.

The operational services of the customer relationship management system are provided by Tietoevry Corporation.

The following operators are involved in the provision of application management services: Innofactor Software Ltd, Gofore Plc, Gofore Verify Oy and Advania Finland Oy. Application management processes personal data in a service management system provided by ServiceNow.

The digitisation services are provided by Posti Messaging Oy.

The call system is provided by Elisa Corporation.

Noora Kontro

Hanna-Mari Korva

P.O. Box 325, FI-00052 VERO
National telephone switchboard: 029 512 000

1) Population Information System data

Data subjects are Finnish citizens and foreign nationals residing in Finland and entered in the Population Information System.

2) Business Information System data

Data subjects are private traders entered in the Business Information System.

3) Elinkeinonharjoittajien yhteyshenkilöiden tiedot

Data subjects are contact persons specified by business operators.

After a business has signed up for the Positive credit register as a data notifier, they can specify the following contact persons:

• contact person for sign-up
• contact person for content
• contact person for technical matters
• technical contact person for certificates

When a business applies for a data permission for the Positive credit register from the Incomes Register Unit, they can specify the following contact persons:

• contact person for data permission application
• contact person for content
• contact person for technical matters
• technical contact person for certificates
• person responsible for information security
• person responsible for data protection
• contact person for invoicing

In addition, the notification address provided by the business operator may include personal data.

4) Personal data collected in customer service

Data subjects are persons who have contacted the Positive credit register’s customer service.

5) Personal data collected with observation and feedback forms

Data subjects are persons who have submitted an observation form or a feedback form available on the Positive credit register’s website.

1) Population Information System data

The Positive credit register processes the following personal data:

• name
• identifying information, such as a Finnish personal identity code or a foreign personal ID
• addresses
• non-disclosure order for personal safety reasons
• mother tongue and contact language

The data has been received from the Incomes Information System and shared with the Positive credit register under section 13 a of the act on the Incomes Information System (Laki tulotietojärjestelmästä 53/2018). The Incomes Information System has received the data from the Population Information System.

The Incomes Register Unit has the right to update the data from the Population Information System and to check a natural person’s personal data in order to verify their accuracy.

2) Business Information System data

The Positive credit register processes the following personal data:

• identifying information (Business ID and personal identity code)
• addresses
• contact language

The data has been received from the Incomes Information System and shared with the Positive credit register under section 13 a of the act on the Incomes Information System (Laki tulotietojärjestelmästä 53/2018). The Incomes Information System has received the data from the Business Information System.

The Incomes Register Unit has the right to update and check the Positive credit register’s data on a party with the reporting obligation in the Trade Register and the Business Information System.

3) Contact information of contact persons for businesses

The Positive credit register processes the following personal data on contact persons:

• name
• phone number
• address
• invoice address
• email address

The data has been received from business operators that have signed up for the Positive credit register as data notifiers, applied for a data permission for the Positive credit register from the Incomes Register Unit, or updated the contact information of contact persons after signing up or submitting a data permission application.

4) Personal data collected in customer service

Contacts to customer service are recorded in the Positive credit register if the customer is identified and the customer’s matter requires further investigation.

In this connection, the Positive credit register may process the customer's identifying and contact information, and other information necessary for investigating the matter, such as a description of the matter.

The data has been received from persons who have contacted the Positive credit register’s customer service.

The calls to the Positive credit register’s customer service are recorded. The data saved on a call includes the start and end time, the caller's number, the name of the person who answered the call, and a recording of the call. At the beginning of the call, the customer is notified that the call will be recorded.

5) Personal data collected with observation and feedback forms

The Positive credit register processes the following personal data:

• name
• organisation
• Business ID
• email address
• phone number

1) Population Information System data

The purpose of the processing is to ensure that the data in the Positive credit register is correct, and to perform the other tasks of the Tax Administration’s Incomes Register Unit under the Act on the Positive Credit Register.

2) Business Information System data

The purpose of the processing is to ensure that the data in the Positive credit register is correct, and to perform the other tasks of the Tax Administration’s Incomes Register Unit under the Act on the Positive Credit Register.

3) Elinkeinonharjoittajien yhteyshenkilöiden tiedot

The purpose of the processing is to make decisions on sign-up requests and data permission applications, attend to communications regarding the reporting of data to the Positive credit register and the use of the register’s data, to invoice the credit register extracts, and to perform activities relating to API connections.

4) Personal data collected in customer service

The purpose of the processing is to advise customers, investigate errors and respond to feedback. Call recordings are used to verify the content of the calls afterwards and to ensure the quality of customer service.

5) Personal data collected with observation and feedback forms

The purpose of the processing is to process the observations and respond to feedback.

The processing of the Population Information System and Business Information System data and of the data on business operators’ contact persons is based on the following legal provisions:

• EU General Data Protection Regulation (2016/679), Article 6(1)(c) (compliance with a legal obligation to which the controller is subject)
• Act on the Positive credit register (739/2022)

The processing of personal data collected in customer service or with observation and feedback forms is based on the following legal provisions:

• EU General Data Protection Regulation (2016/679), Article 6(1)(e) (performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)

Data is not disclosed regularly.

The data recorded in the Positive credit register is confidential, with the exception of the name, Finnish Business ID or foreign business ID of a party with the reporting obligation. With the above exceptions, data may be disclosed from the Positive credit register only for the purposes laid down in the Act on the Positive Credit Register and in the Act on the Openness of Government Activities (sections 11 and 12; section 26, subsection 3; section 29, subsection 1, paragraphs 3 and 4).

The Incomes Register Unit can make the name and Finnish Business ID or foreign business ID of a party with the reporting obligation publicly available through electronic information network. However, personal data can be searched for in the electronic information network only through individual searches.

In principle, data is not disclosed to countries outside the EU/EEA. However, in exceptional individual cases, Microsoft may have access to personal data during support and maintenance activities. In data transfer, the transfer basis under the General Data Protection Regulation is the European Commission's decision on the adequacy of data protection under Article 45(1) (Adequacy decision for the EU-US Data Privacy Framework, C(2023) 4745 final) or, where necessary, standard contractual clauses published by the European Commission.

The Tax Administration’s Incomes Register Unit keeps the data in accordance with the Tax Administration's information management plan for as long as necessary for the performance of the Incomes Register Unit's statutory task.

The identifying and contact information of natural persons is deleted no later than 10 years after the end of the year in which the natural person died or was declared dead.

The data of the contact persons reported by business operators is deleted at the latest when the contact person changes or the business operator's sign-up or data permission for the Positive credit register ends.

Call recordings are saved for no more than 6 months.

Observation and feedback forms are stored in the application management’s service management system for no more than 2 years.

Right of access

The data subject has the right to obtain confirmation from the controller as to whether or not the controller is processing personal data concerning them. In addition, the data subject has the right to obtain a copy of any personal data concerning them that is processed by the controller.

If you want to view your personal data, please contact the Positive credit register’s customer service.

Right to rectification

The data subject has the right to request the controller to rectify inaccurate and incorrect personal data concerning them without undue delay.

A representative of a business operator can update the contact persons’ information in the Positive credit register’s e-service.

If you detect an error in your personal data and want it to be rectified, please contact the Positive credit register's customer service.

Right to restriction of processing

The data subject has the right to request that the controller should restrict the processing of data concerning them when the data subject disputes the accuracy of personal data, for example. The processing of the data will then be restricted for a period enabling the controller to verify the accuracy of the data.

If you want to request a restriction of processing, please contact the Positive credit register’s customer service.

Right to oppose processing

The data subject has the right to oppose the processing of personal data concerning them if they have a special reason related to personal circumstances and if the processing of personal data is not based on the performance of the Incomes Register Unit's statutory obligation under Article 6(1)(c) of the General Data Protection Regulation. In such a case, the controller may process the data subject’s personal data only if there is a significant and justified reason for the processing that supersedes the data subject’s rights and freedoms, or if the processing is necessary for the purpose of preparing, presenting or defending a legal claim.

If you want to oppose the processing of your personal data, i.e. request that your data should not be processed at all, please contact the Positive credit register's customer service.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the Data Protection Ombudsman regarding the processing of their personal data.

Further information and instructions on how to make a complaint is available on the website of the Office of the Data Protection Ombudsman.