Privacy Statements and Cookie Policies

The following entities are responsible for the processing of personal data referred to in this privacy statement as joint controllers:

• Suomen Yrittäjät ry national organization
• Suomen Yrittäjät ry regional associations
• Suomen Yrittäjät ry local societies
• Suomen Yrittäjien Sypoint Oy (business ID 0581846-9)

Joint controllers determine the purposes and means of the processing of personal data together. In future, joint controllers are referred to as “Suomen Yrittäjät” or “we”.

When we use certain social media functionality, for example, when we maintain the Suomen Yrittäjät website on Facebook, we can also be joint controllers with the social media service provider in question.

***

This privacy policy applies to situations in which the purpose and means of the processing of personal data are jointly determined by the Suomen Yrittäjät national organization, its regional associations and local societies, as well as by Suomen Yrittäjät Sypoint Oy, and act as a joint data controller as per data protection legislation. None of the parties to the processing could fulfil the processing purposes described in this privacy statement without other parties.

The joint controllers have agreed that the Suomen Yrittäjät national organization is responsible for informing through this privacy statement and is the primary body you can contact when exercising your rights. This does not prevent you from contacting your local society, for example, in connection with the processing of personal data.

With regard to Suomen Yrittäjät, you can use the following contact details in matters related to the processing of personal data in the first instance:

• Suomen Yrittäjät ry
• Postal address: PL 999, 00101 Helsinki
• Visiting address: Kyllikinportti 2, 00240 Helsinki
• Email: jasenpalvelu@yrittajat.fi
• Telephone number: 09 229 221

To exercise your rights, you can contact the persons named in section “Where we disclose personal data”.

In addition, we have agreed the following regarding joint controller status:

• Representatives of a local society have access only to the members of their society.
• Representatives of regional associations have access to the CRM system, which processes personal data of members, elected representatives, stakeholders, event participants and potential members’ representatives. Representatives of a regional association can see the data in a limited way and can only modify their own members’ data.
• Representatives of the Suomen Yrittäjät national organization have access to and editing of all personal data described in this Privacy Policy. The national organization can provide statistical analyses on the basis of data for regional associations. At the Suomen Yrittäjät national organization, we process the data of elected representatives, stakeholders, customers’ and potential members’ representatives participants and potential members in the interests of the local society, regional association and national organization: for example, the member recruitment measures aimed at a company becoming a member of a local society.

We also act as a joint controller when we maintain a page on Facebook or use Facebook functionality on our website, such as the like button. With regard to the user information on our Facebook pages, we are joint controllers with Facebook. We collect statistics on the likes on and visits to our Facebook pages, the visibility of our publications and the demographic profiles of the people whom our publications have reached. In addition, we see public information, such as name and profile picture, as well as other information according to the privacy settings specified by the user on Facebook. More information about the processing of personal data can be found in Facebook’s privacy description.

Our mobile apps, which are made available to you through, for example, Apple App Store, Google Play or Microsoft Store, are subject, in addition to this privacy statement, to the terms and conditions of the service provider in question. You can access them through the device you use or by visiting the app store’s website.

We process the personal data of individual members of Suomen Yrittäjät, representatives of member businesses, elected representatives, representatives of stakeholder groups, customers and potential members’ representatives, as well as users of the website and applications.

The data processed depend on the groups of data subjects, but mainly includes the name and contact details of the data subject and the data subject to represent information related to the organization, such as publicly available information about the organization. We collect information about website users using cookies as described in more detail in the cookie policies.

***

We process the following categories of data subjects:

Personal members or contact persons of the member companies

Categories of data subjects:

• representatives of the member business
• retiree members
• student members
• honorary and support members

Data to be processed:

• personal data of the data subject, such as name, gender, service language, date of birth, education, address, telephone number, email address
• membership information, such as joining information, change of local society, termination of membership and related reasons, invoicing and payment information, product and order information, customer feedback and contacts, communication monitoring information
• basic information on the organization represented by the data subject, such as the name of the organization, business ID, industry data, number of employees, date of establishment of the company, public Business Information System data and contact details such as visiting, mailing and billing address, telephone number, e-mail, social media web addresses, language of transactions

Elected representatives

Category of data subjects:

• Elected and other representatives of local societies, regional associations and the national organization of Suomen Yrittäjät
• trade associations’ elected and other representatives.

Data to be processed:

• personal data such as name, address, email, telephone number, date of birth, gender
• data on a position of trust, such as a position, start and end dates of office held

Stakeholder representatives

Categories of data subjects:

• political decision-makers
• civil servants
• media representatives
• other associations’ representatives
• entrepreneur candidates for political office
• other equivalent stakeholders

Data to be processed:

• personal data of the data subject, such as name, address, email, telephone number, organization, job title and party information for those holding positions of public trust (parliamentary representatives, municipal councillors)

Clients

Category of data subjects:

• enrolled event attendees
• persons who have bought products, such as reward products, bought or subscribed to the magazine
• persons receiving the prize, product or magazine

Data to be processed:

• personal data of the data subject, such as name and contact details, allergies, date of birth, job title, entrepreneurship career information or other merits
• information on the organization represented by the data subject, such as the name and contact details of the organization, billing information, organization membership
• information related to the order, such as name and type of transaction, product or order

Representatives of potential members

Category of data subjects:

• representatives of potential members

Data to be processed:

• personal data of the data subject, such as name and contact details, job title
• information on the organization represented by the data subject, such as the name and contact details of the organization
• information provided by the data subject in connection with, for example, a newsletter subscription or contact request
• other information collected during a previous membership or customer relationship

Users of websites and apps

Categories of data subjects:

• users of websites who do not log in to the services or otherwise provide their personal data
• users of websites and applications who log in to the services or download materials, make a newsletter subscription, contact request or online shop purchase, or who can be identified through opening an email we send

Data to be processed:

• information on the use of services and the user’s terminal by means of cookies and similar technologies
• information provided by the data subject on forms, such as name, contact details, billing information, delivery address, membership of the organization

We can combine the above data and use data analytics to derive new information from them, such as modelling of the behaviour of a particular segment (target group).

We mainly process personal data for the following purposes:

• information about members’ and member businesses’ representatives for the management, communication, marketing, sales and development of membership, as well as to provide member services
• elected representatives’ data for communication, award of electronic tool credentials, revising the criteria for granting awards, recording the history of elected officials of the organization
• stakeholder information about our activities and objectives to communicate and organize stakeholder meetings and events
• customer information for implementing a service orfulfilling a subscription, invoicing, collection of feedback, handling of possible complaints, marketing and sales of events
• information on the recipient of reward products to verify compliance with the criterion of the label to be awarded and to issue a certificate of honour
• information about potential members’ representatives for the marketing and sale of membership
• information about website users to deliver services (e.g. login and order delivery), analyse website usage and target marketing and advertising, security management

We process personal data:

• based on a contract, such as to manage the member relationship and provide member services, as well as to deliver an online store order or to provide training, for example
• based on a legitimate interest, e.g. the management of membership and the relationship of trustees, as well as marketing, sales and related profiling
• based on consent, e.g. for installing cookies, provision of the Yrityshakemisto business directory service, and electronic direct marketing in certain situations
• on the basis of a statutory obligation, such as the maintenance of the association’s membership register and the processing of personal data contained in supporting documents to comply with accounting obligations

We can combine and analyse data on different categories of data, such as membership data, event participation data, email opening data and the use of our services. We can profile you in a specific segment (target group) and use data derived from data analytics to develop our services and target marketing and advertising.

We do not take automated decisions with legal effects on the data subject.

***

We process data for the following purposes:

Contract:
When we deliver an order, we carry out an event for which the data subject has signed up or we take care of our rights and obligations under the membership agreement of an individual member, the processing is based on the fulfilment of the contract. Without the processing of personal data, we cannot deliver or invoice an order. If some information is provided on a voluntary basis, it is indicated separately on each form.

Legitimate interest in the relationship between members, elected representatives or clients:
We process members’ representatives’ and individual members’ data for registering members, electronic and other member communications, providing services and benefits related to membership, carrying out surveys and surveys that promote the organization’s purpose, taking into account, analysing and statistical information for members’ companies and entrepreneurs, as well as the implementation and development of customer service and activities. We process elected representatives’ data for communication, award of electronic tool credentials, revising the criteria for granting awards, recording the history of elected officials of the organization. Information about the prize or other product or the recipient of the magazine is processed for the delivery of the products in question. Without the processing of personal data, we cannot fulfil a member’s or customer agreement that we have entered into with an organization that you represent or related to, or enable a person to perform positions of trust in the organization. If you wish, you can influence the processing of your data as described in the section “What rights you have”.

Legitimate interest in stakeholder communication:
One of the basic prerequisites for our action is that we can serve the interests of our members. This can only be done through stakeholder communication. We believe that it is also in the interest of a data subject belonging to stakeholders to learn about important themes for Finnish entrepreneurs and to pass it on to readers (media) or political stakeholders (political influencers). We think you can reasonably expect your public role to be processed. If you wish, you can influence the processing of your data as described in the section “What rights you have”.

Legitimate interest in other processing:
Insofar as we develop our services, make member acquisitions or other marketing activities, and carry out statistical analysis and profiling related to them by combining information about different data sources or providing information security on the basis of a legitimate interest, we consider that processing benefits both for us and for data subjects. The processing of personal data enables us to offer you even better services, to share our membership benefits with people likely to be interested in them, and to keep our services safe for all users. We strive to be as transparent as possible about our practices and to empower you as described in section “What rights you have”.

Consent:
We set cookies and process personal data collected with them based on your consent. We can also request your consent for electronic direct marketing. You can withdraw your consent at any time. Failure to give consent means that the advertising you see is not directed at you and does not receive electronic direct marketing, which is sent on the basis of consent. On the Yrityshakemisto online service we show only information about those member businesses and their representatives that have given their consent for publishing.

Statutory obligation:
To the extent that we process personal data from the association’s membership register on the basis of the Association Act or process personal data contained in supporting documents on the basis of the Accounting Act, the processing is based on compliance with the statutory obligation. To comply with the obligations of the General Data Protection Regulation, we also need to retain some information to show that we are complying with the Regulation.

We mainly collect personal data from the following sources:

• the details of the representative of the member undertaking are obtained from the member undertaking or the registered self;
• the data on elected officials are obtained from the data subject himself or herself;
• information from stakeholders’ representatives on public information sources, such as the organizations’ websites;
• the information of the event participants will be obtained at the time of registration;
• the information on the recipient of a prize, product or magazine subscription is provided by the subscriber to the product;
• information from potential members’ representatives on the Patent and Registration Office list of established companies, partners and public sources of information on the Internet; and
• we collect information about website users through cookies or similar technologies or from the data subject themselves via forms or chat service.

As a rule, personal data will be processed for as long as necessary with regard to the processing grounds. We aim to ensure that the information we process is up-to-date and correct. You can also influence the storage time and extent of the data stored yourself through the possibilities of influence described in more detail in the section “What rights you have”.

***

The retention periods of personal data vary by data category:

• we process the data of the member’s and member company’s representative for as long as membership and/or the person’s position in the organization in question are valid and delete them 3 years after the end of membership;
• we process the data of stakeholders’ representatives as long as the person, by dint of his or her status, belongs to the relevant stakeholder group and deletes the data within a reasonable period of time from the change to be made;
• as long as the person has not objected to the retention of his or her personal data for the purposes of those purposes, we retain the data of elected representatives for the aforementioned purposes;
• we process customer data for an average of 3 years after participation in the event or the end of an order, after which we process names, contacts and aggregate customer relationship data for marketing and sales purposes as described in the following section;
• we process the data of potential members’ representatives for an average of 3 years from the date of data collection, provided that the data subject represents the organization to be marketed and sold and has not specifically requested the deletion of his or her data;
• we store website users’ data for the duration of the member or customer relationship and for 3 years after it has ended, after which we process name and contact information and aggregate data of the member or customer relationship for marketing and sales purposes as described in the previous paragraph; and
• any personal data contained in the supporting documents will be kept to comply with statutory accounting obligations for at least six years from the end of the financial year relating to the transaction in question.
• we store the personal data of people who have prohibited direct marketing insofar as is necessary to implement the prohibition.

You can influence the processing of your personal data in several ways. The extent and means of exercising these rights depend partly on the uses used. You may, among other things, check your personal data, request its correction or supplementation, restrict or object to processing, refuse marketing, withdraw your consent, request transfer of your data or file a complaint with supervisory authorities.

***

You can influence the processing of your personal data in the following ways:

Verification, correction and deletion of data:

You have the right to check the personal data we store about you. At your request, we rectify, supplement or delete personal data that are inaccurate, incomplete or outdated for the purpose of processing. Personal data which are required by law to be stored cannot be deleted.

Data portability:

You may choose to receive the personal information you provide, which we automatically process on the basis of consent or agreement, in a commonly used machine readable format and have it transferred to a third party.

Prohibition of direct marketing and related profiling:

You can at any time prohibit the processing of your data for direct marketing purposes. Electronic direct marketing can be objected to by pressing the link at the end of the email.

Right of opposition and restriction:

You can object to processing based on a legitimate interest on the basis of your personal situation. In such a situation, the processing will be restricted for the duration of the assessment of the grounds for objection. Processing may also be restricted, for example, when you contest the accuracy of your personal data, in which case the processing is limited for a period during which we can verify the accuracy of the data.

Withdrawal of consent:

You can withdraw your consent at any time. You can withdraw your consent to electronic direct marketing by pressing the link at the end of the email.

Cookies-related choices:

You can influence the use of cookies and other similar technologies through cookie settings, here. Please note that cookies necessary for the use of our services (such as a cookie in the shopping cart, login and cookie consent management tool) are available despite this choice.

Right of appeal:

You can file a complaint with an authority if you consider that your data has been processed in violation of this privacy statement and the legislation in force at any time. The supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi).

When exercising the above rights, we ask you to contact:

• Members: virpi.luke@yrittajat.fi
• Elected representatives: hannamari.heinonen@yrittajat.fi
• Stakeholders: virpi.luke@yrittajat.fi
• Clients: karri.ruuskanen@yrittajat.fi
• Potential members: johanna.hallikainen@yrittajat.fi
• Website: arttu.talvela@yrittajat.fi

Please prepare to prove your identity. If necessary, we may ask you for additional information to verify your identity.

As a rule, we choose data-secure data centres and subcontractors’ sites in Europe as data storage sites. Some aspects of data processing may require transfer or access to an organization located outside the EU or EEA. In doing so, we will comply with the requirements of data protection legislation, for example, by requiring, among other things, commitment to the European Commission’s standard contractual clauses.

We disclose information to third parties in carefully considered situations, e.g. to partners for the provision of memberships, for research purposes, to authorities on the basis of their legal request, in the event of a transaction to the receiving party or on the basis of the consent of the data subject.

In connection with the implementation of digital advertising, third parties may collect information about users of our services through cookies as independent controllers. In addition, we may disclose user cookies to third parties so that they can target advertising on the website of Suomen Yrittäjät or elsewhere on the Internet.

***

We disclose data in the following carefully considered situations:

Consent:
We may disclose data subjects’ data to third parties if you have given your consent.

Membership and other partners:
We may disclose your data to partners so that they can offer benefits related to your membership or, for example, the guide you have downloaded to you or to the member company you represent.

Events:
We may disclose the data of the event participant to key partners such as catering, transport, congress and travel agencies.

Studies:
We may disclose data for statistical, scientific or historical research, provided that the data have been changed to such a form that makes the object of the data is unidentifiable.

Reorganization:
If we merge or otherwise organize our operations, the user’s personal data may be disclosed to the receiving organization and its advisers.

Authorities:
We may disclose your personal data in a manner required by the competent authorities, based on current legislation.

Debt recovery:
We can disclose your data to our selected partners for the recovery of our receivables.

Digital advertising:
On the basis of your cookie consent, we may disclose your cookie identifier and IP address as well as data about the page you browse (e.g. URL of the page, size of the advertising site) to target advertising. The information cannot, in principle, identify you personally. For more information on cookies, please refer to our cookie policies.

We use third party services to ensure the lawful processing of data through contractual arrangements and by instructing third parties on the processing of the data. These third parties only process data by order and our chapter as processors.

The safe processing of your personal data is important to us. We use various organizational and technical means to protect your personal data from unlawful or unauthorized processing. As far as our subcontractors are concerned, we ensure that we only use processors that provide adequate safeguards so that the processing complies with the requirements of the General Data Protection Regulation and ensures the protection of the data subject’s rights. We conclude a data processing agreement with each processor in accordance with data protection legislation.

***

We will use the following safeguards, among others, to ensure the security of your personal data:

• Only certain pre-defined controller employees have access to and access to personal data.
• The use of personal data is protected by user-specific identifiers, passwords and access rights. The system is also protected by firewalls and other technical means.
• The data are located in a computer located in a data centre on a server that has been blocked from unauthorized persons.
• The information is located in locked and guarded premises.
• The data will be backed up on a regular basis.

To the extent that we use subcontractors and data are processed on servers other than our control, we guarantee through contractual arrangements that personal data will be processed in accordance with the applicable data protection legislation. The processor shall take appropriate technical and organizational measures such as:

• pseudonymization and encryption of personal data;
• the ability to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to quickly restore access to and access to data in the event of a physical or technical failure; and
• a procedure to regularly test, examine and evaluate the effectiveness of technical and organizational measures to ensure the security of data processing.

We reserve the right to update this privacy statement, for example, due to the development of services or changes in legislation or official recommendations. Changes to our Privacy Statement are announced in our services and/or personally, for example by email.

***

This Privacy Statement was published 21/02/2023, when the Suomen Yrittäjät separate privacy statements concerning members, stakeholders, events, marketing and online shop were combined into a single privacy policy, and a new cookie consent management tool was introduced on the site.

Previous versions can be found here:

• Old version, valid until 21.2.2023: Privacy Statement and Cookie Policy
• Register of members
• Register of stakeholders
• Event register
• Marketing register
• E-commerce
• Register of elected representatives upon request
• Register of Synergia service upon request