Data privacy statement
Eltel processes personal data that it may receive in its dealings with customers, partners, suppliers, contractors and other relevant third parties for, inter alia, HR related purposes, contractual purposes, information purposes, billing purposes, service improvement and marketing purposes. Personal data may also be processed for other purposes as described herein. This Data privacy statement explains what kind of personal data is processed, the purposes for which the personal data is used, how the personal data is processed and registered persons’ rights in relation to the processing of personal data.
All personal data is processed in accordance with this Data privacy statement and Eltel’s Data protection policy as well as applicable data protection legislation. Any questions about how Eltel collects, processes and stores personal data should be directed to Eltel’s local legal representatives in each respective jurisdiction.
1. Definition of personal data and processing of personal data
The term "personal data" is used to describe any information that may be used to identify, directly or indirectly, a specific individual. Examples of personal data are a person’s first and last name, phone number, personal identity number, address, factors connected to the physical appearance and details of employment, CV, as well as a person’s e-mail address, online username or identifier and IP address.
Processing of personal data is any operation or set of operations which is conducted in relation to personal data, whether or not it occurs by automatic means. Thus, processing includes, for example, collection, recording, storage, adaptation or alteration, retrieval, transferring or otherwise making data available, combining data sets and deletion of data.
2. Personal data processed by Eltel
Eltel processes personal data in order to be able to fulfil its legal and contractual obligations and in order to establish a safe and efficient administration of its business. More specifically, Eltel will only collect and process personal data as described in the Appendix Personal data matrix and will only process such personal data to fulfil the purposes stated in the matrix. Personal data must only be processed in accordance with applicable legislation and what is considered good practice on the labor market.
3. How the personal data is handled
Eltel will only process personal data for the purposes it was collected and as set out in the matrix. Further processing may occur if it is legal and compatible with the purposes for which the personal data were initially collected. Eltel has taken appropriate technical and organizational measures for the protection of the personal data to ensure that only authorized persons are given access to personal data. The organizational measures taken are e.g. policies, instructions, guidelines regarding the safety and security measures as well as log management and audit trail systems.
Eltel may need to provide personal data to relevant authorities (e.g. the police, social insurance agencies and the tax authority) based on mandatory law and in order to fulfil legal obligations.
Furthermore, due to the fact that Eltel is a part of a group of companies with business activities in several different countries, it will be necessary to transfer personal data to companies in the group outside of the registered person's own country that need to receive such personal data in order for Eltel to fulfil the purposes as stipulated in the matrices. This will always be subject to assessment according to local legislation or contractual requirements.
The personal data may also be transferred to and processed by companies within the EU/EEA which perform services for Eltel (data processors) in order for such companies to be able to perform the services requested by Eltel. Services which may be requested are, for example, the provision of infrastructure, insurance, administration and IT services. Only personal data that is necessary in order to fulfil such purposes will be provided to such parties. The data processors are obliged to act in accordance with Eltel's instructions and to implement appropriate technical and organizational measures for the protection of the personal data.
Eltel aims to process most of its personal data within the EU/EEA, however, at rare occasions, recipients of personal data may be located outside the EU/EEA (third country), mainly when we are using third-party data processors that will process data in a third country. Unless the European Commission has decided that a country ensures an adequate level of protection for personal data, Eltel will ensure that appropriate safeguards have been taken (such as the EU Commission’s standard contract clauses, including other supplementary safeguards as necessary in each case) to protect the personal data. In case personal data actually is transferred to third countries, more detailed information, as well as the applicable measure for each third country transfer will be available on request.
4. Access to information
Personal data will only be available to authorized employees holding a position where it is necessary to process personal data to fulfil his or her tasks. These employees will only be granted access in accordance with the principle of least privilege, and will therefore only have access to personal data that is strictly necessary for the purpose of the processing. Accessibility, confidentiality and integrity of logs containing personal data will always be ensured.
5. Duration of processing and deletion of personal data
Eltel will not store or process personal data for any longer time than what is necessary to fulfil the specific purposes set out in the matrices or otherwise in Eltel’s Data Protection Policy, this privacy Statement or according to any mandatory applicable law. Accordingly, when the purpose has been fulfilled in relation to a specific type of personal data, Eltel will delete or anonymize the relevant personal data as soon as reasonably possible.
6. Rights with regards to the personal data
A registered person has the right to request access to the personal data relating to him or her. The right of access extends to information as to whether or not personal data concerning a person is processed, the relevant personal data being processed and the purpose of such processing. A registered person also has the right to rectify or complete personal data in case the personal data is inaccurate or incomplete.
Erasure of personal data may also be requested if the personal data, inter alia, is no longer necessary in relation to the purposes for which it was collected, if the processing is unlawful or the personal data has to be erased for compliance with a legal obligation in the European Union or in a registered person's own country to which Eltel is subject. This list is not exhaustive and questions regarding the processing should be directed to Eltel if a registered person would like his/her personal data to be erased. A registered person is also entitled to object to certain processing or request that the processing of the personal data is restricted if the registered person believes that the accuracy of the personal data could be questioned, if the registered person believes that the processing is unlawful or if the registered person believes that Eltel no longer needs the personal data for the purposes as stipulated in the matrix or in this Data privacy statement.
However, please note that even if a registered person objects to certain processing, Eltel may still need continue such processing of personal data as necessary under applicable legislation, for example to be able to fulfil legal requirements or to fulfil contractual obligations. If a registered person has any complaints on how the personal data is processed, or would like more information in any regard, he/she may contact Eltel. A registered person is also entitled to lodge a complaint regarding the data processing with the relevant supervisory authority, i.e:
- Sweden: Integritetsskyddsmyndigheten – www.imy.se
- Finland: Tietosuojavaltuutettu – www.tietosuoja.fi
- Norway: Datatilsynet – www.datatilsynet.no
- Denmark: Datatilsynet – www.datatilsynet.dk
- Germany: Datenschutzinstanzen – www.datenschutz.de
- Lithuania: Valstybinė duomenų apsaugos inspekcija – www.vdai.lrv.lt
- Poland: Urząd Ochrony Danych Osobowych – www.uodo.gov.pl
A request to exercise individual rights with regards to the processing of personal data shall be sent by email to gdprforgetme@eltelnetworks.com.
Please note that we may ask a registered person to confirm his/her identity to ensure that we do not disclose personal data to any unauthorized person.
7. Updates to the data protection policy and non-compliance with this data protection policy
In order to ensure compliance with the applicable data protection legislation, as amended from time to time, this statament may be amended by the Eltel at any given time. The applicable Data privacy statement can always be found on eltelgroup.com/data-privacy-statement. Any breach of the Data privacy statement shall be reported to Eltel. Any breach will be taken seriously and will result in necessary actions being taken. Eltel maintains a written plan and process for data protection incident handling.
A registered person should notify Eltel of any changes of the personal data relating to himself/herself in order to facilitate for an accurate and secure processing of personal data. Please find below a list of all data controllers in the different jurisdictions.
|
Data controller |
Relevant country |
Contact person | Data controller | Relevant country |
Contact person |
|---|---|---|---|---|---|
| Eltel AB |
Sweden |
Legal Manager, Sweden |
UAB Eltel Networks | Lithuania |
Legal Manager, Lithuania |
| Eltel Networks TE AB |
Sweden |
Legal Manager, Sweden |
Eltel Networks A/S | Denmark |
Legal Manager, Denmark |
|
Eltel Networks Infranet AB |
Sweden |
Legal Manager, Sweden |
Fiber og Anlaeg I/S | Denmark |
Legal Manager, Denmark |
|
Eltel Group Oy |
Finland |
Legal Manager, Finland |
Eltel Networks AS |
Norway |
Legal Manager, Norway |
|
Eltel Networks Oy |
Finland |
Legal Manager, Finland |
Eltel Infranet GmbH |
Germany |
Legal Manager, Denmark |
|
Eltel Networks Pohjoinen Oy |
Finland |
Legal Manager, Finland |
Eltel Networks Poland S.A. |
Poland |
Legal Manager, Poland |
Appendix
Personal data matrix
|
Personal data type and source |
Purpose | Legal ground |
Retention time or criteria |
|---|---|---|---|
|
Identification details - i.e. name, personal identification number, date of birth and nationality Source: From data subject or the data subject's employer |
To enable Eltel to identify the registered person in order to fulfil all contractual obligations |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations and for as long as a claim can be raised against Eltel
|
|
To enable Eltel to fulfil all its obligations in relation to the contractual relationship. This includes processing of personal data for invoicing purposes, information/contact purposes, documentation of the services performed, recording transactions and planning and |
Performance of a contract |
||
|
To enable Eltel to manage an effective protocol in case of emergency situations and crisis management |
Legitimate interest |
||
|
To enable Eltel to conduct credit ratings, ensuring confidentiality of commercially sensitive information and security vetting |
|||
|
To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third-party databases including information regarding services provided, services received and business opportunities |
|||
|
To enable Eltel to publish references on Eltel's, webpage and in external communication1) |
|||
|
To enable Eltel to carry out surveys and evaluations in order to plan, organize and manage the services to ensure the quality of work |
|||
|
Contact information - i.e. address, telephone number, email address, fax number Source: From data subject or the data subject's employer
|
To enable Eltel to make contact in order to fulfil all obligations in relation to the contractual relationship |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
|
To enable Eltel to administer and fulfil its obligations under mandatory law and regulatory and corporate governance obligations. This includes providing correct information to relevant authorities such as the tax agency, gathering information in relation to legal proceedings |
Legal obligation |
|
|
|
To enable Eltel to manage an effective protocol in case of emergency situations and crisis management |
Legitimate interest |
|
|
|
To enable Eltel to conduct credit ratings, ensuring confidentiality of commercially sensitive information and security vetting |
|
|
|
|
To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third-party databases including information regarding services provided, services received and business opportunities |
|
|
|
|
To enable Eltel to publish references on Eltel's, webpage and in external communication2) |
|
|
|
|
To enable Eltel to carry out surveys and evaluations in order to plan, organize and manage the services to ensure the quality of work |
|
|
|
HR data – work qualifications, prior work experience, test results, CVs Source: From data subject or the data subject's employer |
To enable Eltel to offer and provide services to customer and partners and to participate in procurements |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
|
To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities |
|
|
|
Billing data - i.e. bank details, credit card numbers, and invoice information Source: From contracting party
|
To enable Eltel to fulfil all its obligations in relation to the contractual relationship. This includes processing of personal data for invoicing purposes, documentation of the services performed and recording transactions |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
|
To maintain accounting records and other economic records for book keeping purposes |
Legal obligation |
|
|
Digital information data - i.e. personal data collected when using Eltel services and websites and applications including IP- addresses, browser data, traffic data and user patterns
|
To enable Eltel to ensure correct authorization, clearance and access to facilities and IT-systems and to monitor and ensure compliance with rules communicated regarding allowed use of the IT system and ensuring confidentiality of commercially sensitive information |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations |
|
Assignment details - i.e. working time, work tasks, assignments, work description Source: Eltel
|
To enable Eltel to adapt its organizational structure, workforce management, project time, and to schedule and monitor work time/resource planning |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
|
To enable Eltel to carry out surveys and evaluations in order to plan, organize and manage the services to ensure the quality of work |
|
|
|
Communication data - i.e. correspondence with Eltel through email, telephone, fax or post and comments and reviews on surveys and reviews
|
To enable Eltel to ensure correct authorization, clearance and access to facilities and IT-systems and to monitor and ensure compliance with rules communicated regarding allowed use of the IT system and ensuring confidentiality of commercially sensitive information |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
Contract data |
To enable Elte to administer and maintain the contractual relationship |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
1&2) Please note that marketing information will only be disclosed if Eltel has received consent for a such disclosure.