Oneforce information notice

The OneForce platform (Edenred core model of the Salesforce CRM) aims at managing all of Edenred's interaction processes with the various corporate leads, merchants, corporate clients and users/beneficiaries, increase operational efficiency for Edenred staff and improve the customer experience through a 100% digital experience. In order to answer all these needs, some of your personal data needs to be processed when you interact with Edenred. Your personal data may also be processed for other purposes such as your use of MyEdenred or managing your benefits, for which you can find the privacy notices at Privacy Notice (edenred.fi)

Identity of the data controller

Edenred Finland Oy, whose head office is located at Elimäenkatu 15, 00510 Helsinki, Finland, is the data controller of your personal data processed in OneForce for the purpose(s) defined hereafter.

Purposes of the processing

Your personal data is processed by Edenred Finland Oy within the following framework:

• Customers’ management for the purpose of case management and follow-up (through notably Customer Care’s activity and Sales representative’s support)
• Tool’s support and maintenance for the purpose of troubleshooting management within OneForce 

Categories of personal data concerned

Edenred Finland Oy, as data controller, informs you that, through OneForce and for the purposes listed above, it collects and processes your personal data related to:

• Account data, e.g.: status of the account, name of the linked Corporate client’s account, extranet username, etc. 
• Activity data, e.g. portal last connexion date, extranet last connexion, extranet status, extranet registration date, etc.
• Civil status, e.g.: contact name, first name, last name, etc.
• Contact information, e.g.: email address, etc.
• Financial information (read only), e.g.: partial PAN, etc.
• Interactions with Edenred, e.g.: case priority, case origin, case number, description of the case, etc.
• Official documents, where applicable
• Organizational information, e.g.: name of Edenred’s business unit related to the user record, etc.
• Life information, where applicable
• Preferences information (optional category of personal data)
• Product information (information linked to the Edenred’s products) e.g.: category of asset linked to the User, name of the card(s), Card activation/expiration date, etc.
• Professional life information, e.g.: employer linked to the User, professional postal address, etc.
• Technical ID, e.g. Account ID, Asset operational system ID, Cardholder operational system ID, Owner ID, record ID in CRM tool, etc. 

Legal basis of the processing

Those personal data processing activities are legally grounded on:

• The performance of a contract within the framework of Customers management, for the purpose of case management and follow-up (through notably Customer Care’s activity and Sales representative support)
• Edenred’s legitimate interest, which is to implement a CRM tool in order to rationalize an efficient interaction process with the various corporate leads, merchants, corporate clients and users/beneficiaries and increase operational efficiency for Edenred staff. This legal basis applies within the framework of tool’s support and maintenance, for the purpose of troubleshooting management within OneForce

Recipients of the personal data

Your personal data will be accessible to the authorized employees of Edenred Finland Oy including:

• Customer care: employees and subcontractors providing customer service, managing User requests.
• Local admin: Edenred technical and business local administrators
• Business manager: Edenred Finland Oy’s legal representative

Each of them has dedicated access rights according to the scope of their need to know.

Your personal data will not be disclosed to third parties except, as necessary, to the following companies, expressly authorized by Edenred Finland Oy for the performance of the service provided;

• Edenred SE, which performs support, maintenance for OneForce
• SalesForce, as the SaaS solution provider
• OwnBackup, as the SaaS solution provider for archiving and back up tool
• Microsoft, as the SaaS solution provider for Office 365 (notably for event/agenda and mailing management
• Medallia, as the SaaS solution provider for Customer Experience enhancement
• Hubspot, as the SaaS solution provider for marketing automation and CMS
• FrontAI, as the SaaS solution provider for chatbot AI (called Ella)

• And the authorities that require such data for their purposes, including the Tax Administration.

You may always request specific information regarding which recipients have received your personal data.

Transfer of the personal data

Edenred Finland Oy ensures that your personal data collected within the OneForce framework will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, in this case, standard contractual clauses (article 46 of the GDPR).

Retention of the personal data

Your personal data is retained for a duration of 1 year after the end of the service contract signed between the Corporate client and Edenred Finland Oy. If you leave the employment of the Corporate client, your data will be retained as long as you have a valid card (up to 24 months which corresponds with the card validity period). 

For legal reasons, some personal data are kept for a period of up to 7 years after the closure of your file or of the Corporate client granting the Solution and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.
Once this duration period is reached your personal data will be deleted or anonymized.

Exercise of rights for the data subject

In accordance with the applicable regulation, you are entitled to access, rectify, and erase your data. Under certain circumstances and the conditions set forth in the applicable law, you also have a right to object to and obtain restriction of the data processing activity.

You can exercise your rights, by filling in the relevant form accessible here or by writing to Edenred Finland Oy – Elimäenkatu 15, 00510 Helsinki, Finland.

When we do not have the legal possibility to assist you in exercising your rights because of the data being under the power of one of the platforms mentioned above, the data controller is that respective platform, and their respective privacy policy applies. For any other type of requests or complaints, you can contact the Data Protection Correspondent by sending an email to dpo.finland@edenred.com. 

We also remind you that you can lodge a complaint about the processing of your personal data with your local personal data protection authority, such as Tietosuoja.