Your data protection is important for us
Ilmatar and its group companies are committed to respecting your privacy and complying with all applicable data protection legislation. In this privacy statement, we explain how we collect and use personal data, and what are your rights as a registered user, when Ilmatar functions as the data controller. This privacy statement applies to the use of our services and to other interaction with us.
Personal data refers to information relating to you or another identifiable individual, as defined by the EU General Data Protection Regulation (“GDPR”) (2016/679).
This privacy statement has been amended on 20 July 2023 due to the fact that Ilmatar’s business no longer includes electricity sales to consumer customers.
What information do we process and collect and on what basis?
We collect personal data to a limited extent related to your interaction with Ilmatar when (i) you act as a lessor to us, (ii) you use our whistleblowing channel to report misconduct, (iii) you act on behalf of a company to which we provide electricity production, electricity sales, and other energy-related products and services, (iv) you act on behalf of a company from which we purchase goods or services related to our operations, or (v) you apply to work with us (“Interaction”). The processing of personal data in all these cases is based on legitimate interest. The following personal data may be involved in the processing:
• Basic and contact information of those registered, such as name, email address, phone number, and address details;
• Information you provide to us when using the whistleblowing channel, such as information regarding the individuals involved in the reports and related actions; you may also choose to provide your own information anonymously during this process;
• Specific information about the properties relating to leasing;
• Information you provide to us in relation to job applications, such as education and employment history, contact details of references, possible photograph, and areas of interest.
We may also collect personal data in marketing situations based on your consent, for example when you subscribe to our newsletter, participate in our surveys or events. We may request you for such information as your name, email address, telephone number, address and other free-form information you have provided to us.
We may also conduct direct marketing targeted to our interest groups based on legitimate interest. This may include the processing of personal data such as names, contact information, IP addresses and information about role and employment.
In addition to the above, we may collect and update personal data from the following public sources and services: civil registers, public authorities, credit information agencies, contact information service providers and other similar trusted parties. Where required by the case, credit history may be checked from the credit information register.
Why do we process personal data?
Ilmatar may process your personal data for the following purposes:
Contract enforcement and pre-contractual activities: We may process your personal data when a company you represent enters into a contract with us or sends us a request for quotation, or when you act as a lessor or employer.
Business development and analytics: We process personal data for business development, quality assurance and business needs, including through the use of analytics. We use information about your most recent visits to our website and your movements around our website for analytical purposes and to understand how data subjects use our website so that we can make it easier and better to use.
Regulatory obligations: We may process personal data to comply with our regulatory obligations for instance those stemming from legislation relating to accounting, taxation and money laundering, including the obligation to provide a whistleblowing channel.
Categories of recipients of personal data? Does Ilmatar share personal data?
Your personal data is processed to a limited extent by Ilmatar employees whose job responsibilities include handling the relevant personal data. We do not sell, rent or otherwise disclose your personal data to third parties without a notice, except as noted below.
However, information under this Privacy Statement may be disclosed and transferred to the group companies of Ilmatar or, to a limited extent, to subcontractors after we have entered into appropriate agreements regarding the processing of personal data with them.
• Regarding job applications, we only provide personal data to the recruitment consultants we use.
• For the whistleblowing channel, personal data is not transferred to the service provider; they only have access to system metadata (timestamps, statuses).
If we decide to sell, merge or otherwise reorganize our businesses, this may involve disclosing personal information to potential or actual buyers and their advisors.
Some of the servers used to maintain our data may be located outside the EU or EEA. In such cases, Ilmatar will ensure an adequate level of data protection as required by law.
How does Ilmatar address data quality?
Ilmatar regularly assesses the necessity of data retention in the light of applicable legislation. In addition, Ilmatar takes reasonable steps to ensure that no personal data, relating to data subjects, that is incompatible with the purposes of the processing, outdated or inaccurate are kept in the register. Such personal data shall be corrected or destroyed by Ilmatar without undue delay upon detection.
The data is collected in databases that are protected by firewalls, passwords and other technical measures. The databases and their backups are located in locked facilities and are accessible only to certain pre-designated persons.
How long will the data be stored?
We will retain personal data only for the purposes set out in this privacy statement or for the period otherwise notified to you, unless a longer retention period is required by law. The same applies to the information submitted through the whistleblowing channel. Job applications are retained for a maximum of six (6) months from the date of receipt.
How does Ilmatar use cookies?
We use cookies on our website to improve the functionality of the site.
Articles on this website may contain embedded content (e.g. videos, images and articles). Content from other websites embedded in the articles will function exactly as it does on the website from which the content originates from.
When you use embedded content, information may be collected about you, the website may use cookies and third-party tracking.
What are your rights?
The following rights apply to your personal data processed by Ilmatar:
- Right to access information: You have the right to know what personal data we hold about you.
- Right to rectification and right to erasure: You have the right to have incomplete, incorrect, unnecessary or outdated personal data about you deleted or updated.
- Right to withdraw of consent and right to restriction of processing: You have the right to withdraw the consent you have given to Ilmatar to process your personal data. You also have the right to request the restriction of the processing of your personal data. In such cases, we may continue to process your data on the basis of legitimate interest.
- Right to unsubscribe and right to object processing: You have the right to request that we stop processing your personal data for direct marketing purposes or that we delete your data for other valid grounds.
- Right to transfer your data to another data controller, if possible.
- File a complaint to the supervisory authority if you believe that your rights have been violated
You can exercise your rights by contacting us.
Who is the controller of your data?
Controller and contact point of your personal data:
Ilmatar Energy Oy
Unioninkatu 30
00100 Helsinki, Finland
Changes to this privacy statement
Ilmatar reserves the right to modify this Privacy Statement at any time without a notice. However, if the Privacy Statement is changed in a material, adverse way, Ilmatar will pos a notice of such change at the beginning of this Privacy Statement and on the homepage of this website for a period of 30 days. We recommend you to re-visit this Statement from time to time to learn of any such changes to this Statement.