Privacy Notice

  • BACKGROUND
  • IDENTITY AND CONTACT DETAILS OF THE CONTROLLER – CONTACT DETAILS OF THE DATA PROTECTION OFFICER
    • Processing for which Edenred Finland acts as controller
    • Contact details of the Data Protection Officer
    • Contact requests
  • PROCESSING PURPOSES
    • Management of Lunch, Recreational and Commuting benefits
    • The use of MyEdenred Website and/or MyEdenred App
    • The promotion of Edenred Finland’s products and services
    • The use of the Edenred Website, social networks and contact that is not part of the other processing
  • RIGHTS OF USERS
    • Preamble
    • Access
    • Rectification
    • Erasure
    • Right to restriction of processing
    • Notification obligation regarding rectification or erasure of personal data or restriction of processing
    • Right to data portability
    • Right to object
    • Automated individual decision-making, including profiling

BACKGROUND

Version 2.0, date of publication December 31, 2020

Edenred Finland attaches great importance to the protection of personal data it processes in the course of its activities. This privacy notice applies to the processing of beneficiary’s personal data carried out by Edenred Finland as a controller.

Processing means all operations applied to data that directly or indirectly helps identify a natural person, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

This Privacy Notice is intended to provide the data subjects with the information required by the applicable regulations and in particular by Regulation (EU)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation or “GDPR”).

IDENTITY AND CONTACT DETAILS OF THE CONTROLLER – CONTACT DETAILS OF THE DATA PROTECTION OFFICER

Processing for which Edenred Finland acts as controller

Edenred Finland Oy, a limited liability company whose registered office is located at Elimäenkatu 15, 00510 Helsinki, Finland and registered under the Business ID 1057825-2 (hereinafter “Edenred Finland”) is responsible for the processing of personal data as part of its activities.

In simple terms, the data processing operations carried out by Edenred Finland as a controller are as follows:

  • The management of Lunch, Recreational and Commuting benefits;
  • The use of the website https://MyEdenred.fi and/or the mobile application MyEdenred Finland (hereinafter collectively referred as ‘MyEdenred’)
  • The promotion of Edenred Finland’s products and services;
  • The use of the website https://edenred.fi (hereinafter referred to as the ‘Edenred Website’), of social networks, and contact not covered by other data processing operations;
  • Security;
  • Statistics.

The persons whose personal data are processed by Edenred Finland in its capacity as controller are hereinafter referred to individually as the ‘User’ or collectively as the ‘Users’.

Contact details of the Data Protection Officer

Elimäenkatu 15, 00510 Helsinki, Finland
Email: DPO.Finland@edenred.com
Tel.: +358 9 7594 2848

Contact requests

For any request relating to the processing of personal data, and more specifically to the exercise of the rights referred to in section ‘rights of users’ of this privacy notice, the User may contact:

Edenred Finland Oy
Elimäenkatu 15
00510 Helsinki
DPO.Finland@edenred.com
Tel.: +358 9 7594 2848

Contact forms are also made available to Users via the Help & Support FAQ accessible on the Edenred Website.

PROCESSING PURPOSES

Management of Lunch, Recreational and Commuting benefits

1) Purpose and legal basis

Edenred Finland processes personal data for purposes relating to the management of a digital benefit or paper voucher benefit issued by Edenred Finland, under the brands Lounari, Virike and Työmatka (hereinafter the ‘Solution’).

Management of lunch, recreational and commuting benefits generally covers the following processing activities:

  • The management of load orders for the Solution;
  • Issuing the Solution and providing them to the employees that have been granted by their employer to the Solution (hereinafter the ‘Beneficiaries’);
  • The provision and activation of the card/wallet (physical and digital means, or digital-only means) allowing Beneficiaries to use the Solution (hereinafter the ‘Edenred Card’);
  • The notification to the Beneficiaries every time the Solution is loaded, and about the approaching expiry date, the available balance and the transactions made using the Solution;
  • The provision of information regarding the use of the Solution to the Beneficiaries in electronic or paper form;
  • The secure use of the Solution including the provision of various means to block the Edenred Card in case of loss, theft or unauthorized use;
  • The processing of transactions made using the Solution following the “first in, first out” principle and reimbursement of merchants affiliated to the Edenred Finland’s network who have accepted them as payment.

The aforementioned processing is necessary for the performance of a contract between Edenred Finland and the companies granting access to the Solution to the Beneficiaries or for the execution of pre-contractual measures taken at their request.

In addition to above, Edenred Finland has certain legal obligations that it must fulfil in respect to the management of the Solution as a service provider. Therefore, the processing is also necessary for compliance with legal obligations to which Edenred Finland is subject. In this regard, the relevant legal obligations arise from the following legislation (as amended from time to time): Tax Administration Act (503/2010), Tax Administration’s detailed guidance on the acquisition of benefits in kind to personnel through targeted means of payment (VH/481/00.01.00/2020), the Income Tax Act (1535/1992) and the Accounting Act (1336/1997).

2) Data source

The personal data processed are collected by Edenred Finland when:

  • the employer orders the Solution for the Beneficiaries;
  • the Beneficiaries themselves use the Solution;
  • the individuals authorised by the employers use the Client Portal available on Edenred Finland’s website or communicate with Edenred Finland as part of the management of the Solution;
  • the individuals authorised by the merchants affiliated to the Solution’s network use the Merchant Portal available on Edenred Finland’s website or communicate with Edenred Finland as part of the management of the Solution.

3) Categories of data processed

The personal data collected from the employer concerning the Beneficiaries include:

  • identification information: last name, first name, social security number;
  • professional information: company name;
  • contact information: postal address, email address, phone number;
  • data relating to the Solution associated with a Beneficiary of the Solution: benefit and load parameters like start date, end date, amounts, frequency, quantity, face value, validity period, point of distribution/delivery.

The personal data collected from the Beneficiaries concerning the use of the Solution include:

  • data relating to transactions made using the Solution;
  • data relating to incidents that may occur while using the Solution.

4) Data recipients

The personal data are exclusively intended for:

  • the individuals and organisations in direct contact with Edenred Finland requiring the data as part of the management of the Solution;
  • the employers of the Beneficiaries as part of the management of the Solution for members of their staff;
  • the Beneficiaries as part of the management of their Solution;
  • the authorities that require such data, including the Tax Administration.

Personal data will not be shared with third parties.

The processors of Edenred Finland include, where appropriate:

  • For the hosting of information systems: DXC TECHNOLOGY FRANCE SAS, a French company whose registered office is located at 92400 Courbevoie (France), Place des Corolles, Tour Carpe Diem CS40075, RCS Nanterre 315 268 664, Siret 315 268 664 00143;
  • For the issuing of Edenred Cards, the management of personal accounts/wallets and for the authorisation of transactions: PREPAY TECHNOLOGIES Ltd, an English company whose registered office is located at London W2 6HY (United Kingdom), Sheldon Square 3, Company Number 04008083, FCA Reference Number 900010;
  • For personalization of Edenred Cards: THALES DIS DANMARK A/S, a Danish company whose registered office is located at 2750 Ballerup (Denmark), Borupvang 1B, CVR 16882194;
  • For the delivery of Edenred Cards: MATKAHUOLTO OY, a Finnish company whose registered office is located at 00101 Helsinki (Finland), PO Box 100, Business ID 0111393-9;
  • For the management of paper vouchers: HANSAPRINT OY, a Finnish company whose registered office is located at 20100 Turku (Finland), Kauppiaskatu 5, Business ID 1023181-4;
  • For email communication services: LIANA TECHNOLOGIES OY, a Finnish company whose registered office is located at 90100 Oulu (Finland), Kansankatu 53, Business ID 2854471-2;
  • For SMS communication services: ARENA MESSAGING OY, a Finnish company whose registered office is located at 40101 Jyväskylä (Finland), PO Box 159, Business ID 2081915-2;
  • For the Virtual Customer Service “Ella”: FRONT AI OY, a Finnish company whose registered office is located at 00180 Helsinki (Finland), Lapinlahdenkatu 16, Business ID 2990106-4;
  • For application development and support: EDENRED SA, a French company whose registered office is located at 92130 Issy-les-Moulineaux (France), Boulevard Garibaldi 14-16, Be Issy building, RCS Nanterre 493 322 978, Siret 493 322 978 00021;
  • For application development and support: PGS SOFTWARE SA, a Polish company whose registered office is located at 50-086 Wrocław (Poland), ul. Sucha 3, Registration number 0000304562;
  • For application development and support: BEL SOLUTIONS OY, a Finnish company whose registered office is located at PO Box 59, 02601 Espoo (Finland), Business ID 1906872-6.

5) Data transfers outside the EU/EEA

The processing does not involve any transfer of personal data to a country that is not a member of the European Economic Area.

6) Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling, which would produce legal effects or similarly significant effects.

7) Retention period

Personal data are archived, and access is limited as soon as they are no longer required for the management of the Solution.

Personal data are kept for a period of 7 years after the closure of the employee’s file or the company granting the Solution and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

The use of MyEdenred

1) Purpose and legal basis

Edenred Finland processes personal data of Users of MyEdenred in order to enable the User to create a personal account that gives access to the balance of the Solution as well as to the history of transactions made using Edenred Card (hereinafter the ‘MyEdenred Personal Account’). The User can manage Edenred Card through the MyEdenred Personal Account as well as manage the User’s profile and rectify, if necessary, personal data.

MyEdenred also allows Users to locate affiliated merchants accepting the Edenred Card as payment. In addition, MyEdenred allows the User, if he/she consents, to receive promotional communications.

This processing is based on the User’s prior consent given by registering on MyEdenred. Prior to giving consent, the data subject shall be informed thereof.

The use of MyEdenred is in no way subject to the acceptance of any form of promotional communication.

The User has the right to withdraws consent and therefore delete his MyEdenred Personal Account at any time, by contacting Edenred Finland. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

2) Data source

The personal data concerned are collected by Edenred Finland in connection with the Users of MyEdenred registering and using MyEdenred.

3) Categories of data processed

The personal data processed by Edenred Finland include, as the case may be:

  • identification information: last name, first name, username, password;
  • contact information: postal address, email address, phone number;
  • electronic identification data: IP addresses, cookies;
  • data relating to the Solution: load parameters like requested amounts or frequency;
  • data relating to the behaviour and habits of Users when using MyEdenred;
  • data relating to incidents that may occur while using MyEdenred.

4) Data recipients

The personal data are exclusively intended for:

  • the individuals and organisations in direct contact with Edenred Finland requiring the data to manage MyEdenred;
  • the Users of MyEdenred.

Personal data will not be shared with third parties.

The processors of Edenred Finland include:

  • For the hosting of information systems: DXC TECHNOLOGY FRANCE SAS, a French company whose registered office is located at 92400 Courbevoie (France), Place des Corolles, Tour Carpe Diem CS40075, RCS Nanterre 315 268 664, Siret 315 268 664 00143;
  • For email communication services: LIANA TECHNOLOGIES OY, a Finnish company whose registered office is located at 90100 Oulu (Finland), Kansankatu 53, Business ID 2854471-2;
  • For SMS communication services: ARENA MESSAGING OY, a Finnish company whose registered office is located at 40101 Jyväskylä (Finland), PO Box 159, Business ID 2081915-2;
  • For application development and support: EDENRED SA, a French company whose registered office is located at 92130 Issy-les-Moulineaux (France), Boulevard Garibaldi 14-16, Be Issy building, RCS Nanterre 493 322 978, Siret 493 322 978 00021;
  • For application development and support: PGS SOFTWARE SA, a Polish company whose registered office is located at 50-086 Wrocław (Poland), ul. Sucha 3, Registration number 0000304562;
  • For application development and support: REDLAND FINLAND OY, a Finnish company whose registered office is located at 00120 Helsinki (Finland), Hietalahdenranta 5c D, Business ID 2078268-7.

5) Data transfers outside the EU/EEA

The processing does not involve any transfer of data to a country that is not a member of the European Economic Area.

6) Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling, which would produce legal effects or similarly significant effects.

7) Retention period

Personal data is deleted as soon as the User withdraws consent or at latest 7 years after the last load or transaction relating to the solution.

The promotion of Edenred Finland’s products and services

1) Purpose and legal basis

Edenred Finland processes personal data of Users of MyEdenred to promote its own products and/or services.

This processing is based on the User’s consent that he gives in advance by checking the opt-in box specifically dedicated to such processing. Prior to giving consent, the data subject shall be informed thereof.

The use of the Solution and/or of MyEdenred is in no way subject to the acceptance of any form of promotional communication.

The User has the right to withdraw his consent at any time.

It is as easy for the User to withdraw as to give consent. To withdraw his consent, the User may simply uncheck the box used to confirm his opt-in. This box is in his/her MyEdenred Personal Account provided for Users on MyEdenred, where a User can manage his/her account.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

An unsubscribe link is included in each electronic communication sent to the User.

2) Data source

The personal data concerned are collected by Edenred Finland when the Users of MyEdenred register and use MyEdenred.

3) Categories of data processed

The personal data processed by Edenred Finland include, as the case may be:

  • identification information: last name, first name;
  • contact information: postal address, email address, phone number;
  • electronic identification data: IP addresses, cookies;
  • data relating to the Solution: load parameters like requested amounts or frequency;
  • data relating to the behaviour and habits of Users when using MyEdenred.

4) Data recipients

The personal data are exclusively intended for:

  • the individuals and organisations in direct contact with Edenred Finland requiring the data to promote the products and/or services of Edenred Finland;
  • the Users of MyEdenred.

Personal data will not be shared with third parties.

The processors of Edenred Finland include:

  • For the hosting of information systems: DXC TECHNOLOGY FRANCE SAS, a French company whose registered office is located at 92400 Courbevoie (France), Place des Corolles, Tour Carpe Diem CS40075, RCS Nanterre 315 268 664, Siret 315 268 664 00143;
  • For email communication services: LIANA TECHNOLOGIES OY, a Finnish company whose registered office is located at 90100 Oulu (Finland), Kansankatu 53, Business ID 2854471-2;
  • For SMS communication services: ARENA MESSAGING OY, a Finnish company whose registered office is located at 40101 Jyväskylä (Finland), PO Box 159, Business ID 2081915-2;
  • For application development and support: EDENRED SA, a French company whose registered office is located at 92130 Issy-les-Moulineaux (France), Boulevard Garibaldi 14-16, Be Issy building, RCS Nanterre 493 322 978, Siret 493 322 978 00021;
  • For application development and support: PGS SOFTWARE SA, a Polish company whose registered office is located at 50-086 Wrocław (Poland), ul. Sucha 3, Registration number 0000304562;
  • For application development and support: REDLAND FINLAND OY, a Finnish company whose registered office is located at 00120 Helsinki (Finland), Hietalahdenranta 5c D, Business ID 2078268-7.

5) Data transfers outside the EU/EEA

The processing does not involve any transfer of data to a country that is not a member of the European Economic Area.

6) Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling, which would produce legal effects or similarly significant effects.

7) Retention period

Personal data are archived, and access is limited as soon as the User withdraws his consent or deleted at latest 7 years after the last load or transaction relating to the solution.

The use of the Edenred Website, social networks and contact that is not part of the other processing

1) Purpose and legal basis

Edenred Finland processes the personal data of the Users of the Edenred Website as well as any User who deals with the company through any of the offered channels to administer the website and to fulfill the requests of the Users (legitimate interests).

Edenred Finland processes the personal data of the Users of social networks who follow the pages of Edenred Finland and who publish personal data designated as public or who come into contact with Edenred Finland through these social networks to fulfill the requests of the Users (legitimate interests).

This processing is necessary for the legitimate interests pursued by Edenred Finland, whose legitimate interest is to meet the expectations of Users as effectively as possible.

2) Data source

The personal data concerned are collected by Edenred Finland when Users browse the Edenred Website and/or when they contact Edenred Finland via:

  • Edenred Website
  • Edenred Finland’s pages on social network
  • any other available communication channels of Edenred Finland

3) Categories of data processed

The personal data processed by Edenred Finland include, as the case may be:

  • identification information: last name, first name;
  • professional information: company name, role in the company;
  • contact information: postal address, email address, phone number;
  • electronic identification data: IP addresses, cookies;
  • data relating to the behaviour and habits of Users when using the Edenred Website;
  • personal data designated as public on social networks.

4) Data recipients

The personal data are exclusively intended for:

  • the individuals and organisations in direct contact with Edenred Finland requiring the data for the management of the Edenred Website and/or the communication channels offered by Edenred Finland and/or Edenred Finland’s pages on social networks, and to respond to the requests made;
  • the Users of the Edenred Website and/or communication channels offered by Edenred Finland and/or Edenred Finland’s pages on social networks;

They are not shared with third parties.

The processors of Edenred Finland include, as the case may be:

  • For the hosting of information systems: DXC TECHNOLOGY FRANCE SAS, a French company whose registered office is located at 92400 Courbevoie (France), Place des Corolles, Tour Carpe Diem CS40075, RCS Nanterre 315 268 664, Siret 315 268 664 00143;
  • For services communications: LIANA TECHNOLOGIES OY, a Finnish company whose registered office is located at 90100 Oulu (Finland), Kansankatu 53, Business ID 2854471-2;
  • For SMS communication services: ARENA MESSAGING OY, a Finnish company whose registered office is located at 40101 Jyväskylä (Finland), PO Box 159, Business ID 2081915-2;
  • For application development and support: EDENRED SA, a French company whose registered office is located at 92130 Issy-les-Moulineaux (France), Boulevard Garibaldi 14-16, Be Issy building, RCS Nanterre 493 322 978, Siret 493 322 978 00021;
  • For application development and support: REDLAND FINLAND OY, a Finnish company whose registered office is located at 00120 Helsinki (Finland), Hietalahdenranta 5c D, Business ID 2078268-7;
  • For application development and support: FENIX SOLUTIONS OY, a Finnish company whose registered office is located at 20520 Turku (Finland), Lemminkäisenkatu 59, Business ID 2273220-2.

5) Data transfers outside the EU/EEA

The processing does not involve any transfer of data to a country that is not a member of the European Economic Area.

6) Decision based exclusively on automated processing, including profiling

The processing does not involve any decision based exclusively on automated processing, including profiling, which would produce legal effects or similarly significant effects.

7) Retention period

The personal data of Users with whom Edenred Finland has no contractual relationship are kept, and access to these data is limited, for a period of 5 years from the last contact.

The personal data of Users with whom Edenred Finland has a contractual relationship are kept, and access to these data is limited, for a period of 7 years and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

RIGHTS OF USERS

Preamble

Edenred Finland may not refuse to comply with Users’ requests under this section ‘rights of users’ unless it can demonstrate that it is unable to identify the User concerned.
The identification of the User may in particular be carried out by means of a copy of his identity document.

As soon as possible and at the latest within one month from the receipt of the request, Edenred Finland provides the User exercising one or more of the rights referred to below, with information on the measures taken following the request. The one-month period can be extended by two months, given the complexity and the number of requests. In the latter case, Edenred Finland informs the User of the extension and the reasons justifying it.

When the User makes his request in electronic form, the information is provided by Edenred Finland electronically where possible and unless the User requests otherwise.

If Edenred Finland does not respond to the User’s request, it shall promptly inform the User, at the latest within one month from receipt of the request for reasons of this refusal and the possibility for the User to lodge a complaint with the Data Protection Authority and to file a judicial recourse.

The requests under this Article V shall be free of charge except where a User’s requests are manifestly unfounded or excessive, in particular because of their repetitive nature. In the latter case, Edenred Finland may require the payment of reasonable fees that take into account the administrative costs related to these requests or refuse to act on them.

Where Edenred Finland has reasonable doubts concerning the identity of the User making the request, it may request the provision of additional information necessary to confirm the identity of the data subject.

The User has the right to lodge a complaint with the Data Protection Authority (DPA) (Art. 77 GDPR). A form is available on the website of the DPA, the Office of Data Protection Ombudsman (Tietosuojavaltuutetun Toimisto): https://tietosuoja.fi

Access

The User has the right to obtain from Edenred Finland confirmation as to whether or not the personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients outside the European Economic Area or in international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from Edenred Finland rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
  • the right to lodge a complaint with the Data Protection Authority;
  • the existence, as the case may be, of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
  • where the personal data are not collected from the data subject, any available information as to their source;

Where the personal data are transferred to a country outside the European Economic Area or to an international organisation, the User shall have the right to be informed of the appropriate safeguards relating to the transfer.

The User has the right to obtain, free of charge, from Edenred Finland a copy of the personal data being processed. This right, however, may not affect the rights and freedoms of others, including the trade secrets of Edenred Finland or its intellectual property rights.

Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
Edenred Finland may require the payment of reasonable fees based on the administrative costs, fixed at 25 EUR, for any additional copies requested by the data subject.

Rectification

The User shall have the right to obtain, free of charge, from Edenred Finland the rectification of inaccurate personal data concerning him or her, without any undue delay.

Taking into account the purposes of the processing, the User shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Erasure

The User shall have the right to obtain from Edenred Finland the erasure of personal data concerning him or her without undue delay and Edenred Finland shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the User withdraws consent on which the processing is based and where there is no other legal ground for the processing;
  • the User objects to the processing pursuant hereto;
  • the personal data have been unlawfully processed;
  • the personal data must be erased for compliance with a legal obligation to which Edenred Finland is subject;
  • the personal data have been collected in relation to the offer of information society services to children.

Where Edenred Finland has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, Edenred Finland, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the User has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation which requires processing to which Edenred Finland is subject;
  • establishment, exercise or defence of legal claims;
  • for statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing.

Right to restriction of processing

The User shall have the right to obtain from Edenred Finland restriction of processing where one of the following applies:

  • the accuracy of the personal data is contested by the User, for a period enabling Edenred Finland to verify the accuracy of the personal data;
  • the processing is unlawful, and the User opposes the erasure of the personal data and requests the restriction of their use instead;
  • Edenred Finland no longer needs the personal data for the purposes of processing, but they are required by the User for the establishment, exercise or defence of legal claims;
  • the User has objected to processing based on Edenred Finland’s legitimate interests pending the verification whether these interests override those of the User.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the User’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

A User who has obtained restriction of processing shall be informed by Edenred Finland before the restriction of processing is lifted.

Notification obligation regarding rectification or erasure of personal data or restriction of processing

Edenred Finland shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance herewith to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Edenred Finland shall inform the data subject about those recipients if the data subject requests it.

Right to data portability

Subject to the rights and freedoms of third parties, the Users shall have the right to receive the personal data concerning them, which they have provided to Edenred Finland, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Edenred Finland, where:

  • the processing is based on consent, or on a contract; and
  • the processing is performed using automated means.

In exercising his or her right to data portability, the User shall have the right to have the personal data transmitted directly from Edenred Finland to another controller, where technically feasible.

The exercise of the right to portability of personal data is without prejudice to the provisions on the right to erasure. This right shall not apply to processing necessary for the performance of a task carried out in the public interest.

Right to object

Where personal data are processed for direct marketing purposes, the User shall have the right to object at any time to processing of personal data concerning him for such marketing, which includes profiling to the extent that it is related to such direct marketing.

When the User objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

The User shall have the right to object, on grounds relating to his specific situation, at any time to processing of personal data concerning him which is based on legitimate interests pursued by Edenred Finland.

Edenred Finland shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User or for the establishment, exercise or defence of legal claims.

Automated individual decision-making, including profiling

The User shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or similarly significantly affects him, except when the decision:

  • is authorised by the regulations to which Edenred Finland is subject and which also lays down suitable measures to safeguard the User’s rights and freedoms and legitimate interests; or
  • is necessary for entering into, or performance of, a contract between the User and Edenred Finland; or
  • is based on the explicit consent of the User.

In the last two cases, Edenred Finland shall implement suitable measures to safeguard the User’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of Edenred Finland, to express his point of view and to dispute the decision.