Privacy policy – Whistleblowing reporting channel

Privacy policy ALTEN Finland Whistleblowing reporting channel

Personal data controller

ALTEN Finland Oy (Business ID number 1743827-9)
Address: Hermannin rantatie 6, 00580 Helsinki, Finland.
Visiting address: Verkkosaarenkatu 5, 00580 Helsinki
Phone: 020 786 3300

The contact details of the data protection coordinator of ALTEN are the following: dpc@alten.fi

Data Protection Officer

Kari Mantere
kari.mantere@alten.fi

Purpose of personal data processing and legal grounds for processing

Having an internal reporting channel is based on the directive of the European Parliament and the Council on the protection of persons who report violations of Union law (EU 2019/1937) and national legislation implementing whistleblower protection (whistleblower protection act, 1171/2022).

ALTEN Finland has founded an electronic notification channel in accordance with the Whistleblower Protection Act, through which a report can be made about misconduct or breach detected in connection with persons work. Report can be made by ALTEN Finland’s current employees, former employees, job seekers, trainees and subcontractors and persons employed by the subcontractor.

The personal data contained in the notifications sent to the notification channel, as well as the personal data revealed in the investigation of the notifications, are used to investigate and prevent possible abuses as required by the Whistleblower Protection Act and other valid legislation.

The processing of personal data is necessary to comply with ALTEN Finland’s legal obligation.

Personal data is not used for profiling, and automatic decision-making is not applied to the data.

Personal data to be processed

ALTEN Finland processes personal data coming through the notification channel, such as the name and contact information of the whistleblower, the name of the subject of the notification and other personal information contained in the notification, as well as personal information contained in the notification regarding other persons mentioned in the notification, such as witnesses.

The whistleblower can make the report either under his own name or anonymously.

In addition, ALTEN Finland processes other personal data necessary for the proper investigation of the notification. This data originates from ALTEN Finland’s internal information sources, such as from persons possibly related to the matter, if necessary, from experts to investigate the matter, or from ALTEN Finland’s information systems. ALTEN Finland can combine the personal data obtained from these different sources in order to clarify the authenticity of the notification and the matter.

ALTEN Finland can process information related to special personal data groups and criminal convictions and crimes only if the processing is necessary for the purposes of the Whistleblower Protection Act.

Receivers and receiver groups of the personal data

The personal data of the whistleblower and the subject of the report may only be processed by persons chosen by ALTEN Finland for this task, i.e. members of ALTEN Finland’s Whistleblowing team. In addition, a limited number of other experts, who are necessary for the investigation of the case and whom ALTEN Finland has chosen for this task, may participate in the processing of the notification.

The personal information contained in the notification and other personal information connected to the notification must be kept confidential. As a general rule, personal data is not revealed outside the Whistleblowing team without the clear consent of the person. However, if it is necessary the personal information may be handed over to competent authority for the notification’s clarification or to investigation authorities or a prosecutor in order to carry out their tasks specified by law in connection with abuses or violations of legislation, or to the subject of the notification in order to prepare, present or defend a legal claim in legal proceedings. In such a case, ALTEN Finland must inform the person making the notification in advance about revealing his identity, unless such information endangers the investigation of the validity of the notification, the related investigation or court proceedings.

ALTEN ‘s IT department, as the administrator of the information system, has access to all the information contained in the information system, but does not have the right to review notification information, such as personal information related to the notification.

The platform which is used as an internal notification channel is provided and maintained by Microsoft.

ALTEN Finland does not transfer data outside the EU or EEA or to an international organization, but in accordance with Microsoft’s data protection statement, Microsoft also uses servers outside the EU or EEA to provide the service. In this case, the basis for data transfer is the standard clauses approved by the Commission.

Personal data retention

The retention periods of personal data contained in the notification or otherwise processed in connection with the processing of the notification are based on legislation. As a general rule, ALTEN Finland deletes the information coming through notification channels in five years after the notification has been received, unless its retention is necessary for the implementation of rights or obligations stipulated by law or for the preparation, presentation or defence of a legal claim.

Personal information that is clearly not relevant to the processing of the notification will be deleted without undue delay.

Rights of the data subject

The data subject has the right to check what personal data ALTEN Finland processes about him or her. However, the data subject’s right to access the information can be limited if it is necessary and proportionate to ensure the accuracy of the notification or to protect the identity of the whistleblower (Notifier Protection Act § 31 subsection 2). If only part of the data falls out from this right, the data subject has the right to receive all other data concerning him or her. The data subject has the right to be informed of the reasons for the restriction and to request the information to be provided to the data protection ombudsman in accordance with subsections 3 and 4 of Section 34 of the Data Protection Act (1050/2018).

The data subject has the right to demand that the registrar corrects inaccurate and incorrect personal data concerning him or her without undue delay.

According to § 31 subsection 1 of the Whistleblower Protection Act, Article 18 of the Data Protection Regulation on the data subject’s right to limit the processing of personal data does not apply to the processing of personal data referred to in the Whistleblower Protection Act.

ALTEN Finland processes personal data to fulfill a legal task, and the data subject therefore has no right to object to data processing.

Requests regarding the data subject’s rights can be addressed ALTEN Finland’s data protection coordinator at pdc@alten.fi or the data protection officer.

The data subject has the right to file a complaint with the supervisory authority (data protection ombudsman’s office).