Customer information
Purpose of processing data
We process personal data to identify natural persons and to allocate the data reported by lenders to the correct individual.
The purpose of the processing is to ensure that the data in the Positive credit register is correct, and to perform the other tasks of the Tax Administration’s Incomes Register Unit laid down in the Act on the Positive Credit Register.
What data do we process?
In our customer relationship management system, we process the following identifying and contact information about people entered into the Population Information System and having a Finnish personal identity code:
- name
- identifying information, such as personal identity code
- addresses
- non-disclosure for personal safety
- mother tongue and contact language.
In our customer relationship management system, we process the following identifying and contact information about small businesses contained in the Business Information System.
- identifying information (Business ID and personal identity code)
- addresses
- contact language.
Where does the data come from?
We have received the data from the Incomes Register, which shares data with the Positive credit register by virtue of the act on the Incomes Information System (Laki tulotietojärjestelmästä 53/2018). The data has been stored in the Incomes Register from the Population Information System and the Business Information System.
Under the Act on the Positive Credit Register, the Incomes Register Unit has the right to update their data from the Population Information System and check a natural person’s personal data in order to verify its accuracy. The Incomes Register Unit has the right to update and check the Positive credit register’s data on a natural person’s business activities from the Trade Register and the Business Information System.
On what basis do we process data?
We process personal data to comply with the Incomes Register Unit’s statutory obligation (General Data Protection Regulation (EU 2016/679), Article 6(1)(c)). The processing is provided for in the Act on the Positive Credit Register (739/2022).
Disclosure of data
As a general rule, we do not disclose data. Lenders and other businesses with the right of access to data specify the personal identity code of the target person when they request a credit register extract. We respond to the request by sending a credit register extract containing the personal identity code specified in the request and any registered data allocated to the personal identity code in question.
Processors
The operational services of our customer relationship management system are provided by Tietoevry Corporation. The Positive credit register has been implemented on the Microsoft Azure cloud service platform. We use the following service providers for application management services, such as troubleshooting: Innofactor Software Ltd, Gofore Plc, Gofore Verify Oy and Advania Finland Oy. When processing personal data, application management uses a service management system provided by ServiceNow.
Transfer of personal data to third countries
In principle, we do not disclose data to countries outside the EU/EEA. However, in exceptional individual cases, Microsoft may have access to personal data during support and maintenance activities. In data transfer, the transfer basis under the General Data Protection Regulation is the European Commission's decision on the adequacy of data protection under Article 45(1) (Adequacy decision for the EU-US Data Privacy Framework, C(2023) 4745 final) or, where necessary, standard contractual clauses published by the European Commission.
Retention of data
With regard to data retention, we comply with the Tax Administration's information management plan. We retain the data only for as long as necessary for the performance of the Incomes Register Unit's statutory task.
The identifying and contact information of natural persons is deleted no later than 10 years after the end of the year in which the natural person died or was declared dead.
Your data protection rights regarding the processing of personal data
As a controller, the Income Register Unit is responsible for enforcing your data protection rights based on the EU's General Data Protection Regulation. You can make a free-form written request regarding your data protection rights and send it to us to the address below:
POSITIVE CREDIT REGISTER
P.O. BOX 2
FI-00055 Incomes Register
You can find more information about your data protection rights on the website of the Office of the Data Protection Ombudsman.
If you need help in exercising your rights, you can contact our customer service.
Right to view personal data
You have the right to know if we are processing your personal data. You are also entitled to receive a copy of your personal data that we process.
You can submit us a request to view your personal data with the paperform or contact form below.
Right to rectify data
You have the right to request us to rectify your inaccurate or incorrect personal data without any undue delay.
Right to restriction of processing
If you think the data we are processing about you is incorrect, if the data is processed against the law or if you have opposed the processing of your data, you can request us to restrict the processing of your personal data.
Right to file a notification with the supervisory authority
You have the right to file a notification with the Data Protection Ombudsman regarding the processing of your personal data. Further information and instructions on how to file a notification are available on the website of the Office of the Data Protection Ombudsman.