Data collection and processing
Data collection and processing
The processing of data stored in the registers of Navigora online service takes place in the EU and Navigora does not transfer data for processing outside the EU/EEA.
Data from the registers may be transferred to countries outside the EU/EEA if the EU Commission has decided that the level of data protection in the country receiving the data is adequate.
Other necessary security measures have been implemented, for example, by following the model contractual clauses approved by the EU Commission or by ensuring that the company processing the data (the transferee) has valid binding corporate rules.
Collection of personal data
Personal data is collected from several data sources. The data sources are described by personal data groups.
Company decision-maker information
Data subjects: job tasks, contact information.
Employers of data subjects: job tasks, contact information.
Press and other public sources (appointment news).
Publicly available information (e.g. publications, databases, internet).
Trade Register
Business persons
Trade Register: information entered in the Trade Register about the company’s responsible persons
Navigora user information
User information from the company, user information from the individuals themselves in connection with registration.
Navigora customer register
Registered persons: contact information
Registered persons’ employers: contact information
Trade Register: information about the company’s responsible persons
Decision-maker information from the decision-maker register of Navigora online service
Navigora personnel information
Information is collected mainly from the employee himself.
Navigora marketing database
Personal data for the marketing database is compiled from Navigora’s own databases: user information from the open business information service, user information from Navigora services, customer register information, decision-maker register information.
Processing of personal data
Navigora processes different types of personal data groups. This describes the purposes of processing for different groups and the legal grounds for processing under the General Data Protection Regulation.
Personal data groups
The data content, disclosures and data retention periods are described below.
1) Business persons (responsible persons)
Purpose of processing
Personal data is also processed in credit information activities concerning companies. Business information includes publicly available information describing the position, tasks and management of persons working in companies in business life.
According to Section 29 of the Finnish Credit Information Act, no notification needs to be sent to the person about the storage of responsible person information (company connection information).
Information concerning business persons is processed and disclosed to customers in connection with information concerning the company to protect their interests and rights. Business connection information pursuant to Section 12, Paragraph 1, Paragraph 2 of the Finnish Credit Information Act is disclosed to parties who request the information. No special reason is required for requesting the information.
The data of the responsible persons of companies pursuant to Section 3(3) of the Finnish Credit Information Act are processed in accordance with the Credit Information Act when classifying companies (Section 27 of the Finnish Credit Information Act).
The data of the responsible persons of a company are also processed for marketing purposes.
Legal basis for processing
In accordance with Article 6 of the General Data Protection Regulation and Section 4(i) of the Data Protection Act (1050/2018), personal data may be processed if it concerns information describing the position, duties and management of a person in a public body, business, organizational activities or other similar activities, to the extent that the purpose of the processing is in the public interest and the processing is proportionate to the legitimate aim pursued.
The processing of the data of the responsible persons of a company in credit information activities is provided for in the Finnish Credit Information Act.
According to the national data protection act, the data of the responsible persons of a company may also be processed in other ways than only in credit information activities.
The use of data in electronic marketing is regulated in the Information Society Act (917/2014). A company representative may be sent work-related electronic marketing to his or her work email (Sections 202, 203). In this case, it is marketing targeted at the company.
This is also the basis for processing the company’s beneficial owners.
2) Company decision-makers and influencers
Purpose of processing
Personal data is processed for the purpose of providing companies using the data with necessary information for marketing or sales measures, or for opinion or market research, and for updating customer registers.
Legal basis for processing
The processing is based on Article 6, point 1.f. of the Data Protection Regulation (pursuant to the legitimate interests of the controller or a third party).
Processing of personal data for direct marketing purposes can be considered to be carried out for the purpose of implementing a legitimate interest (Recital No. 47 of the Data Protection Regulation).
The use of data in electronic marketing is regulated in the Information Society Act (917/2014). Electronic marketing related to work may be sent to a company representative’s work email (Sections 202, 203). In this case, it is marketing targeted at the company.
In accordance with Article 6 of the General Data Protection Regulation, personal data may be processed if it concerns information describing the position, duties and their management in a public body, business, organizational activities or other similar activities, to the extent that the purpose of the processing is in the public interest and the processing is proportionate to the legitimate aim pursued.
The processing of data in the register does not require the consent of the data subject.
3) Navigora online service user data
Purpose of processing
The purpose of the processing of personal data is to administer the rights to use Navigora Oy’s services and systems and the use of the services.
Legal basis for processing
The processing is based on Article 6, point 1.f. (realization of the legitimate interests of the controller or a third party) of the General Data Protection Regulation.
Such a legitimate interest may exist, for example, when there is a relevant and appropriate relationship between the data subject and the controller, such as when the data subject is a customer of the controller or is employed by the customer, or when the user is granted user IDs for Navigora online services.
Navigora has the right to process the data of persons using its services because the provision of the service requires this.
4) Navigora customer register
Purpose of processing
The purpose of processing personal data is to use information about the controller’s customers’ contact persons and potential customers’ contact persons in contact with the customer or potential customer.
Legal basis for processing
The processing is based on Article 6(1)(f) of the GDPR (pursuant to the legitimate interests of the controller or a third party).
Such a legitimate interest may exist, for example, when there is a relevant and appropriate relationship between the data subject and the controller, such as the data subject being a customer or employed by the controller.
Processing of personal data for direct marketing purposes can be considered to be carried out for the purpose of pursuing a legitimate interest (Recital No. 47 of the Data Protection Regulation).
The use of data in electronic marketing is regulated in the Information Society Act (918/2014). A company representative may be sent electronic marketing related to his work to his work email (Information Society Act 20 § 2, § 203). In this case, this is marketing targeted at the company.
The use of data in the register does not require the consent of the data subject.
5) Navigora marketing database
Purpose of processing
The purpose of processing personal data is to use the controller’s central marketing database for communication and marketing to customers, online service registrants and those who have joined our marketing lists.
Legal basis for processing
The processing is based on Article 6, point 1.f. of the Data Protection Regulation (pursuant to the legitimate interests of the controller or a third party).
Such a legitimate interest may exist, for example, when there is a relevant and appropriate relationship between the data subject and the data controller, such as the data subject being a customer of the controller or employed by the controller.
Processing of personal data for direct marketing purposes can be considered to be carried out for the purpose of pursuing a legitimate interest (Recital No. 47 of the Data Protection Regulation).
The use of data in electronic marketing is regulated in the Information Society Act (918/2014). A company representative may be sent work-related electronic marketing to his or her work email (Information Society Code, Section 20, Section 2, Section 203). In this case, this is marketing targeted at the company.
6) Navigora personnel data
Purpose of processing
To manage the employment affairs of Navigora Oy.
Legal basis for processing
The processing is based on Article 6, Section 1.f. (pursuant to the legitimate interests of the controller or a third party) of the Data Protection Regulation.
Recital 47 of the Data Protection Regulation. Such a legitimate interest may exist, for example, when there is a relevant and appropriate relationship between the data subject and the data controller, such as the data subject being a customer of the data controller or employed by the data controller.
General restrictions on the processing of data by Navigora
The controller also uses the registers to implement the right to information and inspection (Article 15 of the Data Protection Regulation, Section 30 of the Finnish Credit Data Act).
Data concerning the data subjects is also used in research activities carried out or supported by the controller and for statistical purposes. For research activities and statistical purposes, the data is processed in such a way that it cannot be identified as relating to a specific person.
The registers do not process special data groups referred to in Article 9 of the Data Protection Regulation (sensitive data).
The registers do not process special data groups referred to in Article 10 of the Data Protection Regulation (criminal convictions).
Who processes the data?
The access control of Navigora online service has been defined as the rights to view, process and edit personal data. These rights are granted to persons who need to process personal data due to their job.
Customers also have personal user IDs. Customers’ access rights are always defined according to their needs. If access is granted to credit information, the customer must have a purpose of use in accordance with the Finnish Credit Information Act.
Automated decisions and profiling at Navigora
Navigora uses personal data in modeling, which is used to form marketing target groups. The controller has the right to such profiling when it has the right to process the data.
However, as the controller, Navigora does not make decisions that would have legal effects on the data subjects or that would have a similar significant effect (Article 22 of the General Data Protection Regulation). Data users can use the data in their credit decisions. Legal effects only arise then.