The Ticket Product Selection Privacy Policy

15 March 2018
This Privacy Policy sets forth the information required under the data protection legislation applicable from time to time (including the EU General Data Protection Regulation).

1. Data controllers

In relation to the personal data of an employee, the data controller is the employer that has concluded a service agreement with Edenred Finland Oy regarding personnel benefit services included in the Edenred product selection. Edenred Finland Oy processes the personal data of the employees entered in the employer’s register in order to provide personnel benefits upon the assignment of the employer and/or the employee. Edenred Finland Oy shall be responsible for the technical functioning and reliability of the Edenred product selection services provided by it.

In their capacity as data controllers, employers shall be responsible for the processing of the personal data of their employees, as well as for any queries related to same. All inquiries should primarily be addressed to the person responsible for register matters at each employer. In case an employee of an employer acting as a data controller inquires about the processing of their personal data from Edenred Finland Oy, Edenred Finland Oy shall instruct such an employee to contact their employer.

Edenred Finland Oy shall act as the data controller in relation to the personal data of persons who register as users of the additional services of the Edenred product selection. Such additional services comprise, inter alia, the MyEdenred Service and MyEdenred mobile application. Additionally, Edenred Finland Oy acts as the data controller in relation to the personal data of its own employer clients and of their contact persons. Such specialized services shall be subject to the privacy policies of the relevant specialized services, unless otherwise stated separately.

Edenred Finland Oy’s contact details for its own data subjects, i.e. the natural person customers of the aforementioned services and the contact persons of its employer clients are as follows:

Edenred Finland Oy
Business ID 1057825-2
Elimäenkatu 15, 00510 Helsinki
Telephone: (09) 7594 2848
Email: privacy-fi@edenred.com
Contact person: Riina Saalasti

In case you are uncertain as to who the data controller is in relation to your personal data, you can inquire about the matter from Edenred Finland Oy using the above-mentioned contact information.

2. Categories of personal data being processed

The employers acting as the data controllers shall themselves define the categories of personal data to be processed in relation to their employers and the data to be collected. Employees may request more detailed information regarding the processing of their personal data from their employer and regarding the disclosure of information for instance from Edenred Finland Oy for the purposes of providing the services.

Edenred Finland Oy may process, inter alia, the following information regarding the data subjects in connection with providing its services belonging to the Edenred product selection:

  • Customer details (e.g. name, social security number, address, telephone number, email address, personal ID number)
  • Name of employer
  • Details of the employer company’s contact person
  • Identification information of the Edenred card
  • Identification information for their own online service or mobile account (e.g. user ID)
  • Information pertaining to the customer relationship, such as the products and services being used, as well as the opening and termination dates
  • Information collected in conjunction with customer phone calls and other customer communications
  • Payment transactions, balances and user usage information of the cards and accounts
  • Other information pertaining to the utilisation of the card
  • Data subject’s choices concerning their consent to the processing of their personal data
  • Choices made by the data subject concerning direct marketing
  • Choices made by the data subject concerning electronic direct marketing
  • Location and positioning data used by the mobile application / choices made by the data subject concerning location data
  • Choices made by the data subject concerning the disclosure of address to third parties.

Edenred Finland Oy processes primarily customary personal data concerning the data subjects, and as a general rule does not collect or process any information concerning the data subjects that would be deemed to constitute sensitive or special information. The social security number of a data subject may, nevertheless, be processed in conjunction with the services of the Edenred product selection in payment service activities, or when the unequivocal itemisation of the service user is important for the implementation of the rights and obligations of the user or of Edenred Finland Oy. The social security number shall not be entered needlessly in any documents pertaining to the services of Edenred Finland Oy.

3. Basis for processing personal data and purposes of processing

The purpose of the processing of personal data by Edenred Finland Oy is the carrying out of the services and additional services pertaining to the personnel benefits offered by employers to their employees. For the stated purpose, personal data is processed, inter alia, in order to individualise and identify employees, to provide services and additional services, as well as to market products and services.

Edenred Finland Oy’s Edenred product selection and services comprise the following:

  • Edenred Lounas Solution and Edenred Lounasseteli™ voucher (lunch benefit),
  • Edenred Virike Solution and Virikeseteli® voucher (sports and/or cultural benefit),
  • Edenred Card Solution (Ticket Duo®) (combination card for lunch, sports and cultural benefits),
  • Edenred Työmatka Solution (Ticket Transport®) (commuting benefit).

The processing of personal data carried out by Edenred Finland Oy upon the assignment of the employers acting as the data controllers is based in relation to the personal data governed by the employers upon the implementation of the service agreement between the employer and Edenred Finland Oy, with the employee being the beneficiary intended therein. The employers acting as data controllers shall ensure that the processing is based upon the appropriate lawful basis.

In relation to the personal data governed and processed by Edenred Finland Oy as the data controller itself, such processing is based upon either a) upon the implementation of an agreement concluded between a data subject and Edenred Finland Oy regarding the ordering of additional services, b) upon the implementation of Edenred Finland Oy’s legitimate interests relating to the customer relationship, or c) upon the consent granted by the data subject.

Where the processing by Edenred Finland Oy of the personal data of a data subject is based upon the registration carried out by the data subject into the services and upon the acceptance of the terms of use (for instance, as concerns additional services), the data subject may in such a case be obligated to provide Edenred Finland Oy with defined personal data so as to allow for the ordered services to be provided to the data subject. Edenred Finland Oy may not be able to provide services to the data subjects, in case the data subject fails to provide such information. In case the provision of certain personal data is mandatory for this reason, such information has been indicated as being mandatory, for instance, in the fields reserved for filling in the information.

Upon the assignment of an employer, Edenred Finland Oy processes the personal data of the employer’s employees for the following purposes:

  • Ordering, manufacturing, delivery and loading of benefits onto Edenred cards
  • Ordering and delivery of voucher products
  • Communications related to a product or service ordered by a customer
  • Managing, administration, maintenance and development of a customer relationship
  • Invoicing for products and services
  • Measures that strengthen the customer relationship, such as customer communications and notifications.

In addition to the above, Edenred Finland Oy also processes the personal data governed by it as the data controller for the following purposes:

  • Normal business planning and development
  • Product development, research and development and statistics
  • Marketing of its own, and its group’s products and services, as well as the products and services of its co-operation partners in accordance with the consent of the data subject
  • Collection, organization and analysis of customer data in order to efficiently target sales, advertising and marketing
  • For surveys and market research, customer satisfaction surveys, market surveys and similar measures, in accordance with the consent of the data subject.

4. Regular data sources

The employers acting as data controllers shall themselves determine the regular data sources for the processing of the personal data of their employees.

Edenred Finland Oy obtains data from:

  • An employer that orders a service from Edenred Finland Oy to offer a personnel benefit, in conjunction with ordering a product and during the customer relationship,
  • From the customers themselves during the customer relationship,
  • From notifications made by the customers during the customer relationship,
  • From the registrations made by the customers themselves into the additional services of the Edenred product selection, such as the MyEdenred service,
  • From the account information logged from the use of an Edenred card (e.g. from third parties providing card payment services), and
  • In relation to customers registered for additional services, from the information provided by Edenred Finland Oy’s co-operation partners (such as restaurants or sports centres).

5. Cookie policy

Edenred Finland Oy utilises cookies on its website. Cookies are used to enable the provision of the services as well as to develop the services and improving the general user experience of the services.

Cookies are small text files saved in the terminal devices that the browser saves in the terminal devices in order to identify and re-identify the user. This allows us to identify different browsers and to utilise the information we have received, for instance, to analyse the quantity and behaviour of different browsers visiting our site, including statistical monitoring. The intention is to in this way render the services more user-friendly, better serving and to focus marketing better by displaying content based on the interests of the user. Cookies also allow for the saving of personal settings and specifications as well as improve risk management.

When utilising our website or the services offered on our website, Edenred Finland Oy collects the following information with the aid of cookies:

  • IP address
  • from which site/server and which domain/address the user has accessed the Site
  • to which domain the user transfers to the Site or from the Site
  • what links are being used and what advertisements and content is being viewed
  • the timing of the visit and the time spent on the Site
  • browser type and application type as well as other comparable information

In addition to the cookies used on Edenred Finland Oy’s websites, cookies can be utilised to target marketing also at third party sites. Based on the information collected with the aid of such cookies and other techniques, our advertisements can be directed based on previous online behaviour and other factors to such internet users who are likely to be most interested in our advertisements. In such cases, targeting may utilise also behaviour information collected from sites outside of our website.

In addition to the above-mentioned, we may use cookies to collect information about the efficacy of marketing. For this purpose, we may collect information regarding, inter alia, the following factors:

  • whether the advertisements has been clicked
  • the number of times each advertisements was displayed in the browser
  • whether the advertisements resulted in a purchasing decision

We use both session-specific and permanent cookies. Session-specific cookies are retained for the duration of the session, and the cookies are automatically deleted once the browser is closed. Permanent cookies are retained for a fixed period of time and they are saved on the user’s terminal device after the cessation of the session, unless removed by the user.

You can regulate the use of cookies as well as block or disable them from the settings of the browser used by you.

You should also note that blocking the use of cookies may impact some of the functionalities of the site and after such blocking you may not be able to benefit from all of the features of our site.

6. Disclosure of personal data

The employers acting as data controllers shall themselves determine the manner in which they disclose or transfer their employees’ personal data.

Edenred Finland Oy may from time to time disclose and transfer the personal data it has collected in connection with its services. Edenred Finland Oy discloses or transfers such personal data to the following recipients:

  • to the third parties participating in the provision of its services as its subcontractors;
  • to restaurants and other partners in which the benefits apply;
  • to companies belonging to the same group of companies, located in Finland or abroad
  • in situations involving a change in the ownership structure of the company, and
  • to the authorities in statutory situations, upon their demand

Edenred Finland Oy may disclose and transfer personal data of the data subjects from Edenred Finland Oy’s Edenred customer register for scientific research or for statistical purposes, subject to the provisions of the Finnish Personal Data Act.

All disclosures and transfers of personal data shall only be made under the circumstances and to the extent necessary. In relation to all transfers and disclosures, Edenred Finland Oy shall ensure that the protection of personal data has been appropriately ensured and that the transferees have been appropriately bound to protecting personal data either contractually, or by other means compliant with the applicable legislation.

Personal data shall be retained within the EU region, and it shall not be disclosed or transferred outside of the EU/EEA region.

7. Protecting personal data

As a point of departure, employers acting as data controllers shall themselves be responsible for protecting the personal data of their employees.

Edenred Finland Oy shall for its part be responsible for the protection of the personal data of the employers’ employees when an employer discloses the personal data of its employees for use by Edenred Finland Oy, in order for it to be able to implement a personnel benefit offered by the employer to its employees, along with the services pertaining thereto.

Edenred Finland Oy shall also be responsible for the appropriate protection of the personal data governed by it as a data controller by means of the necessary technical and organizational security mechanisms.

At Edenred Finland Oy, personal data is maintained confidentially. Edenred Finland Oy has instructed its personnel participating in the processing of personal data regarding the correct processing of Personal data and of the confidential nature thereof. We ensure the adequate expertise of the personnel and maintain expertise pertaining to the processing of customers’ information. Access to data processing is restricted to pre-designated persons whose work tasks require that they process personal data. Each designated user has a personal user ID and password. Personal data has been protected from unauthorised use and access to the personal data.

In order to carry out monitoring and supervision of the processing operations, Edenred Finland Oy may from time to time verify log information to the extent the personal data of the service users has been viewed or processed. Edenred Finland Oy’s all employees are bound by a confidentiality obligation either by virtue of legislation or separate confidentiality obligations.

All manual material is retained in a locked space, and access to same is only granted to relevant persons. Appropriate access control has also been arranged for all of such spaces.

The data network and hardware of Edenred Finland Oy and of its subcontractors (if any) housing personal data has been protected with a firewall, passwords and other appropriate technical measures. Databases and back-ups of same are located in locked spaces with appropriate access control and access to the spaces has been restricted.

Users of Edenred Finland Oy’s services are granted a personal right of use to the service. Once the right of use has been affirmed and granted, the users receive personal user IDs that they can use to log into the service. The users must themselves ensure that they retain their user ID and passwords carefully and not allow anyone else to use same, as well as notify Edenred Finland Oy without any undue delay, in case they suspect that their user IDs are being misused.

Our browser applications employ the https protocol in order to protect our applications.

8. Retention of personal data

The employers acting as data controllers shall be responsible for determining the retention periods of the personal data pertaining to their employee’s benefits.

Edenred Finland Oy shall retain the personal data it governs itself as a data controller for at least the duration of the customer relationship. After the cessation, the retention period depends upon the information in question and the intended use of same, but unnecessary information shall always be deleted as soon as it becomes unnecessary. We abide by the statutory obligations regarding the retention of information.

9. Inspection right, correction of data, deletion of data and implementation of same

The employers acting as data controllers shall themselves be responsible for implementing their employee’s inspection right in relation to the personal data governed by them, as well as for the correction of such data. All inspection and correction requests shall be addressed to the employer acting as the data controller.

In relation to the personal data governed by Edenred Finland Oy itself as the data controller, the data subject shall have the right to inspect the information concerning them as well as the right to demand the rectification of any erroneous information. The data subjects shall have the right to have erroneous, unnecessary, deficient or outdated personal data from the point of view of the purpose of the processing corrected, deleted or supplemented.

Furthermore, a data subject shall have the right to demand the deletion of their personal data when there is no longer a lawful basis for the processing of personal data, if the data subject retracts their consent upon which the processing was based, or if the processing was based upon the legitimate interests of Edenred Finland Oy and the data subject has objected to the processing and the processing could no longer be deemed to have been based on a lawful cause.

Data subjects can have their information corrected by submitting a written information correction request to Edenred Finland Oy in the form of a document signed by them, or certified in another manner by contacting Edenred Finland Oy’s customer services. In some cases we may be compelled to request additional information in order to ascertain that the person requesting any actions is entitled to make such requests.

We shall retain the information at least for the duration of the customer relationship. After the cessation, the retention period is dependent upon the information and the intended use thereof, any unnecessary information shall be deleted as soon as it becomes unnecessary. We comply with the statutory obligations in the retention of information.

The rights set forth under this section shall be available to the data subject as of the moment the application of the EU General Data Protection Regulation commences in May 2018.

10. Right to prohibit, retracting consent, restricting processing and implementation of same

The employers acting as data controllers shall themselves be responsible for implementing their employees’ right to prohibit in relation to the personal data governed by them.

As concerns personal data governed by Edenred Finland Oy itself as the data controller, the data subject has the right to prohibit the use of their personal data for direct marketing, market research and polls, professional registers and genealogy by contacting Edenred Finland Oy’s customer service in writing. In case the processing of the personal data of Edenred Finland Oy’s data subject is based upon consent, the data subject shall additionally at any time have the right to retract their consent to the processing by informing Edenred Finland Oy in writing of same to the customer service.

In addition, the data subject shall have the right to demand to restrict the processing of their personal data, for instance in situations in which Edenred Finland Oy no longer has any basis for processing the personal data and they should essentially be deleted, but in lieu of deletion, the data subject wishes only to restrict the processing of the said data by Edenred Finland Oy. The data subject shall have the right to request the restricting of the processing of their personal data by contacting Edenred Finland Oy’s customer service.

The rights set forth under this section shall be available to the data subject as of the moment the application of the EU General Data Protection Regulation commences in May 2018.

11. Right to lodge a complaint with the supervisory authority

The data subject shall have the right to lodge a complaint to the competent supervisory authority in relation to the processing of their personal data, in case the data subject feels that Edenred Finland Oy has not been processing the data subject’s personal data in the manner required under the applicable legislation or implemented the data subject’s requests based on their rights in an appropriate manner.

The rights set forth under this section shall be available to the data subject as of the moment the application of the EU General Data Protection Regulation commences in May 2018.

12. Amendments to the Privacy Policy

We reserve the right to amend this Privacy Policy by announcing the same on Edenred Finland Oy’s website. Please review the content of the Privacy Policy on a regular basis.

13. Availability of the Privacy Policy

The employers shall be themselves responsible for the availability of a privacy policy relating to the processing of their employees’ personal data. Employees may request their employer to provide more specific information regarding the processing of their personal data as well as the disclosure of information, for instance, for the purposes of the provision of Edenred Finland Oy’s services.

The privacy policy devised by Edenred Finland Oy, including the privacy policy concerning the processing of personal data governed by Edenred Finland Oy itself as the data controller, is made available at each of Edenred Finland Oy’s places of business, as well as on its website at www.edenred.fi.

Any separate privacy policies potentially applicable to Edered Finland Oy’s separate services are available in connection with such separate services.

 


 

See also Edenred Finland’s security description.

 

Security description