Tietosuojaseloste Fleet Innovation Oy

Updated on 03/06/2022

This privacy policy describes how Fleet Innovation Oy (later referred to as “Fleet Innovation”) processes the personal data of its clients, its potential clients, the representatives of its suppliers or other business partners, as well as the physical persons who use the services of Fleet Innovation or whose organisations use the services of Fleet Innovation, and whose personal data Fleet Innovation processes in order to produce these services. In this privacy policy, Fleet Innovation’s services refer to all services offered by Fleet Innovation at any given time, including the administration of vehicles and/or bicycles which is offered to corporate clients and related services (including online services), Fleet Innovation’s website and its newsletter.

The information stated in this privacy policy only applies when Fleet Innovation processes personal data as Controller. When producing services for its clients related to the administration of vehicles, Fleet Innovation processes the personal data of its clients’ employees and other representatives, including the personal data of those employees and other representatives who are seen as end customers of the services provided by Fleet Innovation (such as the keepers of vehicles). When Fleet Innovation processes the personal data of its clients’ employees or other representatives who are seen as end customers in these situations, the Controller of the personal data is usually Fleet Innovation’s client, not Fleet Innovation, who instead usually acts as Processor on behalf of its clients and processes personal data based on a commission agreement which Fleet Innovation has entered into with the client, and according to the instructions of the client.

However, in terms of the FleetBike service, Fleet Innovation is always responsible for the bicycle which has been acquired by the end customer, i.e. the bike keeper, including finance and insurance, and therefore Fleet Innovation acts as Controller of the personal data of the FleetBike end customers.

1 CONTROLLER AND CONTACT PERSON

Controller

Fleet Innovation Oy

(Business ID: 2098898-4)

Vaisalantie 6 C

02130 Espoo

Contact person

Jarkko Vuorenmaa

c/o Fleet Innovation Oy

Tel.: +358 9 689 88 460

Email: jarkko.vuorenmaa@fleet.fi

2 GROUNDS FOR DATA PROCESSING AND PURPOSE OF DATA PROCESSING

The data processing carried out by Fleet Innovation is based on the following legal bases:

The consent of the data subject according to relevant legislation.
Carrying out a legal obligation which Fleet Innovation is subjected to.
Performing a contract between the data subject or the organisation they represent and Fleet Innovation, a client relationship, a supplier relationship or some other relevant relationship, in which case the legal basis for processing the data is the legitimate interest of Fleet Innovation or a third party (such as a current or future client, supplier or business partner).

When processing is based on legitimate interest, this legitimate interest can, in addition to the above mentioned legitimate interests, be particularly administering and developing the business relationship between Fleet Innovation and its client, supplier or other business partner or other reasonable and justifiable requirements related to Fleet Innovation’s business activities, such as administrative measures, ensuring and improving the safety of the premises or the security of the IT systems or data networks, protecting property, preventing, resolving or investigating abuse of the IT systems, fraud or money laundering, marketing and customer acquisition, developing Fleet Innovation’s services, or potential corporate transactions as defined below.

In terms of the FleetBike end customers, i.e. the bike users, a legal basis for processing personal data is also the contract pertaining to the use and redemption of the bike which is created between Fleet Innovation and the data subject.

Personal data is processed in particular for the following purposes, depending on the relationship between the data subject and Fleet Innovation:

For representatives of client companies and FleetBike end customers: the processing of orders placed by the data subject and the organisation they represent, providing and administering the services which have been ordered, as well as carrying out obligations pertaining to providing these services, such as offering user support.
For suppliers and other business partners: monitoring the supply of services and products which Fleet Innovation has ordered from the data subject or the organisation they represent, and carrying out obligations and rights related to the supply of services or products.
Monitoring billing and its correctness, making administrative payments, and potential debt collection.
Managing client relationships or other business relationships, as well as other equivalent contacts, such as carrying out, managing and improving customer services and/or reciprocal communications.
Improving Fleet Innovation’s service production, business activities, and customer service.
Compilation and analysis of statistics for business purposes.
Customer acquisition and managing contact details for sales.
Advertising and marketing, including targeted and online marketing, but only within the limits allowed by the relevant legislation or when the data subject has given their express consent.
Preventing and investigating abuse, e.g. using camera monitoring or other forms of monitoring.

Providing personal data for the purposes listed in this privacy policy is partially based on the contract between the data subject or the organisation they represent and Fleet Innovation. When, for example, the data subject enters into a service agreement or places a service order on behalf of the organisation they represent, or when they enter into an agreement pertaining to the use and redemption of a bike with Fleet Innovation, and during the agreement period when the services are being provided, the data subject is obligated to provide their personal data to Fleet Innovation for the purposes listed in this privacy policy. Entering into a contract and providing services is not possible without the personal data of the client, the contact person of the supplier or other business partner and/or some other contact person whom Fleet Innovation can contact regarding the client’s service order. In situations where the contractual relation is created directly between Fleet Innovation and the data subject (e.g. FleetBike end customers), entering into a contract also requires the data subject to provide personal data.

3 CATEGORIES OF PERSONAL DATA PROCESSED BY FLEET INNOVATION

Fleet Innovation only processes the kind of personal data specified below which is needed in order to carry out the purposes of processing personal data mentioned above.

Basic data will be collected for all clients or representatives of potential, current or former client companies, suppliers or other business partners, such as the data subject’s name, contact details (such as address, phone number and email address), as well as details about the data subject’s employer and position or role in the organisation they represent. In certain cases (e.g. FleetBike end customers), relevant additional data which is required to unambiguously identify the data subject, i.e. social security number or date of birth, will also be collected.

In addition to basic data, Fleet Innovation also collects and processes data which is related to the client relationship between Fleet Innovation and the data subject or the organisation they represent, or the business relationship between Fleet Innovation and its supplier or other business partner, or some other relevant connection between Fleet Innovation and the data subject, as clarified below.

In the case of clients and FleetBike end users, Fleet Innovation processes data related to the client relationship and the client agreement, as well as individual service or product orders made under this agreement, and data about client type, client history, and the start and end dates of the client relationship. Fleet Innovation also processes data related to the service package which it offers the client and the administration of this, as well as data created during the client relationship as part of managing the client relationship, such as details about the contents of the service, client satisfaction, details relating to marketing and customer service measures and other equivalent communication and contact, as well as details related to billing, payments and potential debt collection. Fleet Innovation also processes data relating to user identifiers in information systems meant for its clients or their representatives.

Relating to suppliers and other business partners, Fleet Innovation processes data pertaining to new and existing business relationships, such as the type and history of the business relationship, details of products and services that have been ordered, as well as the supply and administration of these. Fleet Innovation also processes other data pertaining to the administration and promotion of the business relationship which have been created during the business relationship, such as data on billing and payments, as well as details on the communication and other contact between Fleet Innovation and its business partner.

Where applicable, Fleet Innovation also processes data collected through the use of technical monitoring or other automatic measures, such as log data relating to the use of Fleet Innovation’s online services, data relating to access rights and the administration of access rights, data relating to visits to the website, such as IP addresses, browser and terminal device details, and details relating to recordings produced through camera monitoring and other technical measures of the data subject’s visits to the premises of Fleet Innovation.

4 REGULAR DATA SOURCES

Personal data is collected from the data subject themselves or the organisation they represent e.g. when entering into a contract, when ordering and/or using products or services, or during billing. Personal data is also collected in other ways when the contract continues and when services are provided, e.g. through customer service over the phone or via email, or visits from the data subject. Fleet Innovation also receives personal data e.g. when data subjects visit Fleet Innovation’s website or social media channels.

Fleet Innovation also receives personal data pertaining to clients or client companies from contracting parties who participate in Fleet Innovation’s service production, such as car dealerships, service companies, car repair shops or bike shops. In addition, Fleet Innovation may also receive some data relating to FleetBike end customers from finance companies and insurance companies who offer Fleet Innovation finance and insurance services relating to the bikes owned by Fleet Innovation.

Personal data can also be collected and updated from authorities and companies offering services relating to personal data, such as Suomen Asiakastieto.

Fleet Innovation carries out active client acquisition efforts and may collect basic data relating to data subjects from public websites or other publicly available sources.

5 TRANSFERS AND DISCLOSURE OF PERSONAL DATA

Fleet Innovation may transfer personal data to third parties in order to carry out the purposes of processing data listed in this document as specified below.

Fleet Innovation may transfer personal data to Processors of personal data in order for them to offer services or carry out duties which are closely related to the service production and which Fleet Innovation has assigned them. When personal data is transferred to a party which processes personal data on behalf of Fleet Innovation as Processor, Fleet Innovation has ensured through contracts and other means that the personal data will only be processed according to the written instructions provided by Fleet Innovation, and only for the purposes which have been defined in this privacy policy. The duties of the Processors of personal data are related to offering and maintaining equipment, information systems and software, as well as offering other data processing services, for instance.

Fleet Innovation does not disclose personal data to external parties unless obliged by law, or unless it is necessary in order to achieve the purposes mentioned in this privacy policy.

Fleet Innovation may, for instance, disclose personal data to competent authorities when obliged by law, to prepare for legal action, or to defend itself against a legal claim within the limits of current legislation, to debt collection agencies in order to carry out debt collection, or to its other service providers to the degree that they require the disclosure of personal data to carry out their duties. Fleet Innovation may also disclose the personal data of FleetBike end customers to finance and insurance companies that are part of a service package.

If Fleet Innovation sells its business or some parts of it, or if Fleet Innovation in some other way rearranges its business activities, then Fleet Innovation can disclose personal data to the buyers or their advisers in accordance with applicable legislation.

Personal data can be transferred to non-EU or non-EEC countries if, for instance, the technical implementation of a service requires it. When personal data is transferred to a non-EU or non-EEC country where a sufficient level of data protection cannot be guaranteed, Fleet Innovation ensures through contracts and other means that these parties ensure a sufficient level of data protection when processing personal data. More information about potential cross-border transfers of personal data and the appropriate protective measures which are applied are available from the contact persons named in section 1 of this privacy policy.

6 RETENTION PERIOD FOR PERSONAL DATA

The retention period for personal data depends on the type and purpose of the data. Fleet Innovation will retain personal data for at least as long as it is necessary to carry out the purpose of the processing, such as to fulfil its contractual obligations or managing the contractual relation between Fleet Innovation and its client, supplier or other business partner.

Retention periods are defined based on the following criteria:

Personal data is retained for as long as it can be reasonably stated that Fleet Innovation has a legitimate interest in relation to the data. The existence of a legitimate interest is defined for instance based on contact between Fleet Innovation and the data subject.
The personal data will be deleted when the data subject withdraws their consent to the processing or opposes the processing of their personal data for direct marketing purposes. In this situation Fleet Innovation may still retain the information that direct marketing has been forbidden.
The retention period for the personal data of clients, suppliers and the contact persons of other business partners as well as FleetBike end customers is defined by the validity of the agreement between the data subject or the organisation they represent and Fleet Innovation.
The retention period may also be defined by law. Accounting legislation, for instance, requires that accounts be retained for at least six years.

Unnecessary personal data will be deleted in a secure way or anonymised in an irreversible way.

7 RIGHTS OF THE DATA SUBJECT

The data subject can exercise their rights in relation to Fleet Innovation in situations where Fleet Innovation is processing the personal data of the data subject as a Controller. The rights of the data subject depend on the legal basis for the processing, and exercising the rights requires verifying the identity of the data subject.

Right of access: The data subject has the right to get verification of the fact that Fleet Innovation is processing the data subject’s personal data and has the right to access this data. Fleet Innovation may ask the data subject to specify their request, including the details of the requested data.
Right to rectification: The data subject has a right to demand Fleet Innovation to rectify incorrect or outdated data and to add to insufficient personal data.
Right to be forgotten: The data subject has the right to demand Fleet Innovation to erase the personal data pertaining to the data subject. Fleet Innovation is obligated to erase the data in question if it no longer has a legal basis for processing this data, Fleet Innovation’s obligation to retain the data based on a law or contract has ended, or the data subject has withdrawn their consent to the processing of their personal data.
Right to restriction of processing: In certain cases defined by law, the data subject may have a right to get Fleet Innovation to restrict their processing of the personal data pertaining to the data subject.
Right to data portability: In certain cases defined by law, the data subject has the right to receive the personal data pertaining to themselves which is being processed by Fleet Innovation from Fleet Innovation. In this case, Fleet Innovation must deliver the personal data to the data subject in a structured, commonly used and machine readable format, after which the data subject has the right to transfer the data in question to another Controller without hindrance from Fleet Innovation.
Right to object to the processing of personal data: In certain cases, the data subject may have a right to object to the processing of their personal data. The right to object is particularly applicable to situations where the processing of personal data is based on Fleet Innovation’s legitimate interest. In these situations, Fleet Innovation must adhere to the demand of the data subject, unless Fleet Innovation can present a compelling legal basis which bypasses the interests, rights and freedoms of the data subject, or if the personal data is needed to make, enter or defend the company against a legal claim.
If the processing of personal data has been based on the consent of the data subject, then the data subject has the right to withdraw their consent at any time. Withdrawing consent has no retroactive impact, so it does not impact the legality of the processing which took place before the withdrawal.

Requests relating to exercising of the above rights must be addressed to the contact person named in section 1 of this privacy policy.

The data subject also has the right to lodge a complaint about the processing of personal data with the supervisory authority. The complaint must be lodged with a competent authority, who in Finland is the Data Protection Ombudsman, according to their instructions. The website of the Data Protection Ombudsman can be found here.

8 CHANGES TO THIS PRIVACY POLICY

Fleet Innovation may make changes to this privacy policy from time to time. The date when changes were last made to the privacy policy can be found at the beginning of this privacy policy under “Updated on”. Fleet Innovation encourages data subjects to check this policy for changes regularly. If significant changes are made to the privacy policy, Fleet Innovation will notify data subjects of this on its website or via email.