Beneficiary information notice

Management of lunch, recreational, commuting, massage and wellbeing benefits

Edenred Finland processes personal data for purposes relating to the management of a digital benefit or paper voucher benefit issued by Edenred Finland, under the brands Lounari, Virike and Transport (hereinafter the ‘Solution’). Personal data regarding employees that have been granted the Solution by their employer (hereinafter the ‘Beneficiaries’) may also be processed in MyEdenred, or OneForce, for which you can find the respective privacy notices at Privacy Notice (edenred.fi).

Identity of the data controller

Edenred Finland Oy, whose head office is located at Elimäenkatu 15, 00510 Helsinki, Finland, is the data controller of your personal data processed for the purpose(s) defined hereafter.

Purposes of the processing

Management of lunch, recreational and commuting benefits generally covers the following processing activities:

• The management of load orders for the Solution
• Issuing the Solution and providing them to the Beneficiaries
• The provision and activation of the card/wallet (physical and digital means, or digital-only means) allowing Beneficiaries to use the Solution (hereinafter the ‘Edenred Card’)
• The notification to the Beneficiaries every time the Solution is loaded, and about the approaching expiry date, the available balance, and the transactions made using the Solution
• The provision of information regarding the use of the Solution to the Beneficiaries in electronic or paper form
• The secure use of the Solution including the provision of various means to block the Edenred Card in case of loss, theft, or unauthorized use
• The processing of transactions made using the Solution following the “first in, first out” principle and reimbursement of merchants affiliated to Edenred Finland’s network who have accepted them as payment
• The processing is also necessary for compliance with legal obligations to which Edenred Finland is subject

Categories of personal data concerned

The personal data collected from the employer concerning the Beneficiaries include:

• Identification information: last name, first name, social security number
• Professional information: company name
• Contact information: postal address, email address, phone number
• Data relating to the Solution associated with a Beneficiary of the Solution: benefit and load parameters like start date, end date, amounts, frequency, quantity, face value, validity period, and point of distribution/delivery

The personal data collected from the Beneficiaries concerning the use of the Solution include:

• Data relating to transactions made using the Solution
• Data relating to incidents that may occur while using the Solution

Legal basis of the processing

The aforementioned processing is necessary for the performance of a contract which means the terms and conditions of the Solution subject to which the Solution is provided to the Beneficiaries, or for the execution of pre-contractual measures taken at the request of the employer of the Beneficiary (for example setting up a card) and that processing is then necessary due to the legitimate interest of Edenred Finland to be able to commence the provision of the Solution as agreed with the employer.

In addition to above, Edenred Finland has certain legal obligations that it must fulfil in respect to the management of the Solution as a service provider. In this regard, the relevant legal obligations arise from the following legislation (as amended from time to time): Tax Administration Act (503/2010), Tax Administration’s detailed guidance on the acquisition of benefits in kind to personnel through targeted means of payment (VH/481/00.01.00/2020), the Income Tax Act (1535/1992) and the Accounting Act (1336/1997).

Recipients of the personal data

Your personal data will be accessible to the authorized employees of Edenred Finland Oy including:

• The individuals and organizations in direct contact with Edenred Finland requiring the data as part of the management of the Solution such as:
  • Support teams of the different platforms and processors
  • Customer service workers: employees and subcontractors providing customer service.
  • Local admin: Edenred technical and business local administrators

Each of them has dedicated access rights according to the scope of their need to know.

Your personal data will not be disclosed to third parties except, as necessary, to the following categories of recipients, expressly authorized by Edenred Finland Oy for the performance of the service provided:

• Edenred’s service providers
• The employer of the User/Beneficiary as part of the management of the Solution for members of their staff
• And the authorities that require such data, including the Tax Administration.

You may always request specific information regarding which recipients have received your personal data.

Transfer of the personal data

Edenred Finland Oy ensures that your personal data collected within the mentioned platforms will not be transferred outside the European Union in the absence of an adequacy decision by the European Commission (article 45 of the GDPR) or the establishment of appropriate and adequate safeguards ensuring the security and protection of your personal data, including standard contractual clauses (article 46 of the GDPR).

Retention of the personal data

Your personal data is retained for a duration of:

Personal data are archived, and access is limited as soon as they are no longer required for the management of the Solution, as detailed below:

Your personal data is retained for a duration of 1 year after the end of the service contract signed between the employer and Edenred Finland Oy. If you leave the employment of the Corporate client, your data will be retained as long as you have a valid card (up to 24 months which corresponds with the card validity period).

For legal reasons, some personal data are kept for a period of up to 7 years after the closure of your file or of the Corporate client granting the Solution and, in the event of legal proceedings brought during this period, until all legal remedies have been exhausted.

Once this duration period is reached your personal data will be deleted or anonymized.

Exercise of rights for the data subject

In accordance with the applicable regulation, you are entitled to access, rectify, and erase your data. Under certain circumstances and the conditions set forth in the applicable law, you also have a right to object to and obtain restriction of the data processing activity.

You can exercise your rights, by filling in the relevant form accessible here or by writing to Edenred Finland Oy – Elimäenkatu 15, 00510 Helsinki, Finland.

When we do not have the legal possibility to assist you in exercising your rights because of the data being under the power of one of the platforms mentioned above, the data controller is that respective platform, and their respective privacy policy applies. For any other type of requests or complaints, you can contact the Data Protection Correspondent by sending an email to dpo.finland@edenred.com. 

We also remind you that you can lodge a complaint about the processing of your personal data with your local personal data protection authority, such as Tietosuoja.