Old version: Privacy Statement

The following entities are responsible for the processing of personal data referred to in this privacy statement as joint controllers:

• Suomen Yrittäjät ry national organization
• Suomen Yrittäjät ry regional associations
• Suomen Yrittäjät ry local societies
• Suomen Yrittäjien Sypoint Oy (business ID 0581846-9)

The joint controllers determine the purposes and means of the processing of personal data together. Hereafter, joint controllers are referred to as “Suomen Yrittäjät” or “we”.

When we use certain social media functionality, for example, when we maintain the Suomen Yrittäjät page on Facebook, we can also be joint controllers with the social media service provider in question.

***

This privacy policy applies to situations in which the purpose and means of the processing of personal data are jointly determined by the Suomen Yrittäjät national organization, its regional associations and local societies, as well as by Suomen Yrittäjät Sypoint Oy, and act as a joint data controller as per data protection legislation. None of the parties to the processing can fulfill the processing purposes described in this privacy statement without the consent of the other parties.

The joint controllers have agreed that the Suomen Yrittäjät national organization is responsible for providing information through this privacy statement and is the primary body you can contact when exercising your rights. This does not prevent you from contacting your local society, for example, in connection with the processing of personal data.

You can use the following details to contact Suomen Yrittäjät in matters related to the processing of personal data in the first instance:

• Suomen Yrittäjät ry
  Postal address: PL 999, 00101 Helsinki
  Visiting address: Kyllikinportti 2, 00240 Helsinki
  Email: jasenpalvelu@yrittajat.fi
  Telephone number: 09 229 221

To exercise your rights, you can contact the persons named in section “What rights you have”.

In addition, we have agreed the following regarding joint controller status:

• Representatives of a local society have access only to the members of their society.
• Representatives of regional associations have access to the CRM system, which processes personal data of members, elected representatives, stakeholders, event participants and potential members. Representatives of a regional association can see the data in a limited way and can only modify their own members’ data.
• Representatives of the Suomen Yrittäjät national organization have access to and may edit all personal data described in this Privacy Policy. The national organization can provide statistical analyses on the basis of the data for regional associations. In the Suomen Yrittäjät national organization, we process the data of elected representatives, stakeholders, participants and potential members in the interests of local society, regional association and national organization: for example, the member recruitment measures aimed at a company becoming a member of a local society.

We also act as a joint controller when we maintain a page on Facebook or use Facebook functionality on our website, such as the “Like” button. With regard to the user information on our Facebook pages, we are joint controllers with Facebook. We collect statistics on the likes on and visits to our Facebook pages, the visibility of our publications and the demographic profiles of the people whom our publications have reached. In addition, we see public information, such as name and profile picture, as well as other information according to the privacy settings specified by the user on Facebook. More information about the processing of personal data can be found in Facebook’s privacy description.

Our mobile apps, which are made available to you through, for example, Apple App Store, Google Play or Microsoft Store, are subject to the terms and conditions of the service provider in question, in addition to those in this privacy statement. You can access them through the device you use or by visiting the app store’s website.

We process the personal data of members of Suomen Yrittäjät, representatives of stakeholder groups and potential members, users of the website and persons registered for events at Suomen Yrittäjät.

The data processed depends on the groups of data subjects, but mainly includes the name and contact details of the data subject and the data subject to represent information related to the organization, such as publicly available information about the organization. We collect information about website users using cookies as described in more detail in the cookie policies.

***

We process the following categories of data subjects:

Personal members or contact persons of the member companies

Categories of data subjects:

• representatives of the member business
• retiree members
• student members
• honorary and support members

Data to be processed

• personal data of the data subject, such as name, gender, service language, date of birth, study data, address, telephone number
• membership information, such as joining information, change of local society, termination of membership and related reasons, invoicing and payment information, product and order information, customer feedback and contacts, communication monitoring information
• basic information on the organization represented by the data subject, such as the name of the organization, business ID, industry data, number of employees, date of establishment of the company, public Business Information System data and contact details such as visiting, mailing and billing address, telephone number, e-mail, social media web addresses, service language

Elected representatives

Category of data subjects:

• Elected representatives of local societies, regional associations and the national organization of Suomen Yrittäjät

Data to be processed:

• personal data such as name, address, email, telephone number, date of birth, gender
• data on a position of trust, such as position, start and end dates of office held

Stakeholder representatives

Categories of data subjects:

• political decision-makers
• civil servants
• media representatives
• other associations’ representatives
• entrepreneur candidates for political office
• other equivalent stakeholders

Data to be processed:

• personal data of the data subject, such as name, address, email, telephone number, organization, job title and political party information for those holding positions of public trust (parliamentary representatives, municipal councilors)

Clients

Category of data subjects:

• enrolled event attendees
• persons who have bought products such as prizes or bought or subscribed to the magazine
• persons receiving the prize, product or magazine

Data to be processed:

• personal data of the data subject, such as name and contact details, allergies, date of birth, job title, entrepreneurship career information or other merits
• information on the organization represented by the data subject, such as the name and contact details of the organization, billing information, organization membership
• information related to the order, such as name and type of transaction, product or order

Representatives of potential members

Category of data subjects:

• representatives of potential members

Data to be processed:

• personal data of the data subject, such as name and contact details, job title
• information on the organization represented by the data subject, such as the name and contact details of the organization
• information provided by the data subject in connection with, for example, a newsletter subscription or contact request
• other information collected during a previous membership or customer relationship

Users of websites and apps

Categories of data subjects:

• users of websites who do not log in to the services or otherwise provide their personal data
• users of websites and apps who log in to the services or make a newsletter subscription, contact request or online shop purchase, or who can be identified through opening an email we send

Data to be processed:

• information on the use of services and the user’s device by means of cookies and similar technologies
• information provided by the data subject on forms, such as name, contact details, billing information, delivery address, membership in the organization

We can combine the above data and use data analytics to derive new information from them, such as modeling of the behaviour of a particular segment (target group).

We mainly process data for the following purposes:

• information about members’ representatives for the management, communication, marketing, sales and development of activities
• elected representatives’ data for communication, granting electronic tool credentials, revising the criteria for granting awards, recording the history of the organization’s elected officials
• stakeholder information for communicating our activities and objectives and organizing stakeholder meetings and events
• customer information for execution, delivery, invoicing, collection of feedback, handling of possible complaints, marketing and sales of events
• information on the recipient of reward products to verify compliance with the criterion for the medal awarded and to issue a certificate
• information about potential members’ representatives for the marketing and sale of membership
• information about website users to deliver services (e.g., login and order delivery), analyze website usage and target marketing and advertising, security management

We process data:

• on the basis of a contract, e.g., to deliver an online store order or to provide training
• based on a legitimate interest, e.g., the management of membership and the relationship of trustees, as well as marketing, sales and related profiling
• based on consent, e.g., setting cookies, publishing contact details on online service Synergia and electronic direct marketing in certain situations
• on the basis of a statutory obligation, such as the maintenance of the association’s membership register and the processing of personal data contained in supporting documents to comply with accounting obligations

We can combine and analyze data in different categories of data, such as membership data, event participation data, email opening data and the use of our services. We can profile you in a specific segment (target group) and use data derived from data analytics to develop our services and target marketing and advertising.

We do not make automated decisions with legal effects on the data subject.

***

We process data for the following purposes:

• Contract:
  When we deliver an order, carry out an event for which the data subject has signed up or observe our rights and obligations under the membership agreement of an individual member, the processing is based on the fulfillment of the contract. Without the processing of personal data, we cannot deliver or invoice an order. If some information is provided on a voluntary basis, these fields are indicated separately on each form.
• Legitimate interest in our relationship with members, elected representatives or clients:
  We process members’ representatives’ data for registering members, electronic and other member communications, providing services and benefits related to membership, carrying out surveys that promote the organization’s purpose and for research, for observing, analyzing and compiling statistics of member companies’ and entrepreneurs’ anniversaries and birthdays, as well as the delivery and development of customer service and activities. We process elected representatives’ data for communication, granting electronic tool credentials, revising the criteria for granting awards, recording the history of elected officials of the organization. Information about the prize or other product or the recipient of the magazine is processed for the delivery of the products in question. Without the processing of personal data, we cannot fulfill a member or customer agreement that we have entered into with an organization that you represent or are associated with or enable a person to occupy positions of trust in the organization. If you wish, you can influence the handling of your data as described in section “What rights you have”.
• Legitimate interest in stakeholder communication:
  One of the basic prerequisites for our activities is to serve the interests of our members. This can only be done through stakeholder communication. We believe that it is also in the interest of a data subject belonging to stakeholders to learn about important issues for Finnish entrepreneurs and to pass them on to readers (media) or political stakeholders (political influencers). Due to your public role, we feel it is within reason to process the data mentioned. If you wish, you can influence the handling of your data as described in section “What rights you have”.
• Legitimate interest in other processing:
  Insofar as we develop our services, market ourselves to prospective members or other marketing activities and carry out statistical analysis and profiling related to them by combining information about different data sources or providing information security on the basis of a legitimate interest, we consider that processing the data benefits both us and the data subjects. The processing of personal data enables us to offer you even better services, to share our membership benefits with people likely to be interested in them, and to keep our services safe for all users. We strive to be as transparent as possible about our practices and to empower you as described in section “What rights you have”.
• Consent:
  We install cookies and process personal data collected with them based on your consent. We may also request your consent for electronic direct marketing. You can withdraw your consent at any time. Failure to give consent means that the advertising you see is not directed at you, nor will you receive electronic direct marketing, which is sent on the basis of consent. On online service Synergia we show only those member businesses that have given their consent for publishing.
• Statutory obligation:
  To the extent that we process personal data from the association’s membership register on the basis of the Association Act or process personal data contained in supporting documents on the basis of the Accounting Act, the processing is based on compliance with statutory obligations. To comply with the obligations of the General Data Protection Regulation, we also need to retain some information to show that we are complying with the Regulation.

We mainly collect data from the following sources:

• the details of the representative of the member undertaking are obtained from the member undertaking or the data subject himself or herself;
• the data on elected officials are obtained from the data subject himself or herself;
• information from stakeholders’ representatives on public information sources, such as the organizations’ websites;
• the information of event participants is obtained at the time of registration;
• the information on the recipient of a prize, product or magazine subscription is provided by the subscriber;
• information pertaining to potential members’ representatives is obtained from the Patent and Registration Office’s list of established companies, partners and public sources of information on the Internet; and
• we collect information about website users through cookies or similar technologies or from the data subject himself or herself via forms or chat service.

As a rule, personal data will be processed for as long as necessary with regard to the processing grounds. We aim to ensure that the information we process is up-to-date and correct. You can also influence the storage time and extent of the data stored yourself through the possibilities of influence described in more detail in section “What rights you have”.

***

The retention periods of personal data vary by data category:

• we process the data of the member company representative for as long as membership and the person’s status in the organization in question are valid and erase them two years after the end of membership;
• we process the data of stakeholders’ representatives as long as the person, by dint of his or her status, belongs to the relevant stakeholder group and delete the data within a reasonable period of time from the change of the person’s duties;
• we retain the data of elected representatives for chronicles and registers as long as a person does not object to the retention of his or her personal data for these purposes.;
• we process customer data for an average of three years after participation in an event or the end of a subscription, after which we process names, contacts and aggregate customer relationship data for marketing and sales purposes as described in the following section;
• we process the data of potential members’ representatives for an average of 3 years from the date of data collection, provided that the data subject represents the organization targeted for sales and marketing purposes and has not specifically requested the deletion of his or her data;
• we store the data of our website users for the duration of the member or customer relationship and for two years after it has ended, after which we process name and contact information and aggregate data of the member or customer relationship for marketing and sales purposes as described in the previous paragraph; and
• any personal data contained in supporting documents will be kept to comply with statutory accounting obligations for at least six years from the end of the financial year of the transaction in question.

You can influence the processing of your personal data in several ways. The extent and means of exercising these rights depend partly on the intended use. You may, among other things, check your personal data, request correction or supplementation of it, restrict or object to processing, refuse marketing, withdraw your consent, request transfer of your data or file a complaint with supervisory authorities.

***

You can influence the processing of your personal data in the following ways:

• Verification, correction and deletion of data:
  You have the right to check your personal data. At your request, we rectify, complete or erase personal data that are inaccurate, incomplete or outdated for the purpose of processing.
• Data portability:
  You may choose to receive the personal information you provide, which we automatically process on the basis of consent or agreement, in a commonly used machine-readable format and have it transferred to a third party.
• Prohibition of direct marketing and related profiling:
  You can at any time prohibit the processing of your data for direct marketing purposes. This is possible by clicking the link at the end of the direct marketing email.
• Right of objection and restriction: You can object to processing based on a legitimate interest on the basis of your personal situation. In such a situation, the processing will be restricted for the duration of the assessment of the grounds for objection. Processing may also be restricted, for example, when you contest the accuracy of your personal data, in which case the processing is limited for a period during which we can verify the accuracy of the data.
• Withdrawal of consent:You can withdraw the consent you give at any time. You can withdraw your consent to electronic direct marketing by pressing the link at the end of the email.
• Cookie-related choices: You can influence the use of cookies and other similar technologies through cookie settings, here. Please note that cookies necessary for the use of our services (such as a cookie in the shopping basket, login and cookie consent management tool) are active despite this choice.
• Right of appeal: You can file a complaint with an authority if you consider that your data has been processed in violation of this privacy statement and the legislation in force at any time. The supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi).

When exercising the above rights, we ask you to contact:

Members: virpi.luke@yrittajat.fi
Elected representatives: hannamari.heinonen@yrittajat.fi
Stakeholders: virpi.luke@yrittajat.fi
Clients: karri.ruuskanen@yrittajat.fi
Potential members: johanna.hallikainen@yrittajat.fi
Website: taru.jussila@yrittajat.fi

Please prepare to prove your identity. If necessary, we may ask you for additional information to verify your identity.

As a rule, we choose data-secure data centres and subcontractors’ sites in Europe as data storage sites. Some aspects of data processing may require transfer or access to an organization located outside the EU or EEA. In doing so, we comply with the requirements of data protection legislation, for example, by requiring, among other things, commitment to the European Commission’s standard contractual clauses.

We disclose information to third parties in carefully considered situations, e.g., to partners for the provision of membership benefits, for research purposes, to authorities on the basis of their legal request, to the receiving party in the event of a company reorganization or merger or on the basis of the data subject’s consent.

In connection with the implementation of digital advertising, third parties may collect information about users of our services through cookies as independent controllers. In addition, we may disclose user cookies to third parties so that they can target advertising on the website of Suomen Yrittäjät or elsewhere on the Internet.

***

We disclose data in the following carefully considered situations:

• Consent:
  We may disclose your data to third parties if you have given your consent.
• Membership and other partners:
  We may disclose your data to partners so that they can offer benefits related to your membership or, for example, the guide you have downloaded to you or to the member company you represent.
• Events:
  We may disclose the data of the event participant to key partners such as catering, transport, congress and travel agencies.
• Studies:
  We may disclose data for statistical, scientific or historical research, provided that the data have been pseudonymized or otherwise coded to ensure the data cannot be connected to a specific person or company.
• Reorganization:
  If we merge or otherwise reorganize our operations, the user’s personal data may be disclosed to the receiving organization and its advisers.
• Authorities:
  We may disclose your personal data in a manner required by the competent authorities, based on current legislation.
• Debt recovery:
  We can disclose your data to our selected partners for the recovery of our receivables.
• Digital advertising:
  On the basis of your cookie consent, we may disclose your cookie identifier and IP address as well as data about the page you browse (e.g., URL of the page, size of the advertising site) to target advertising. The information cannot, in principle, identify you personally. For more information on cookies, please refer to our cookie policies.

We use third party services to ensure the lawful processing of data through contractual arrangements and by instructing third parties on the processing of the data. These third parties only process data on request and only for our purposes as processors.

The safe processing of your personal data is important to us. We use various organizational and technical means to protect your personal data from unlawful or unauthorized processing. As regards our subcontractors, we ensure that we only use processors that provide adequate safeguards so that the processing complies with the General Data Protection Regulation and ensures the protection of the data subject’s rights. We conclude a data processing agreement with each processor in accordance with data protection legislation.

***

We will use the following safeguards, among others, to ensure the security of your personal data:

• Only certain pre-defined controller employees have access to and the right to use personal data.
• The use of personal data is protected by user-specific identifiers, passwords and access rights. The system is also protected by firewalls and other technical means.
• The data are in a computer located in a data centre on a server that has been blocked from unauthorized persons.
• The data are located in locked and guarded premises.
• The data are backed up on a regular basis.

To the extent that we use subcontractors and data are processed on servers other than those we control, we guarantee through contractual arrangements that personal data will be processed in accordance with the applicable data protection legislation. The processor shall take appropriate technical and organizational measures such as:

• pseudonymization and encryption of personal data;
• the ability to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to quickly restore the availability of and access to data in the event of a physical or technical failure; and
• a procedure to regularly test, examine and evaluate the effectiveness of technical and organizational measures to ensure the security of data processing.

We reserve the right to update this Privacy Statement, for example, due to the development of services or changes in legislation or official recommendations. Changes to our Privacy Statement are announced in our services and/or personally, for example by email.

***

This Privacy Statement was published 22/02/2021, when the Suomen Yrittäjät separate privacy statements concerning members, stakeholders, events, marketing and online shop were combined into a single privacy policy, and a new cookie consent management tool was introduced on the site.

Previous versions can be found here:

• Register of members
• Register of stakeholders
• Event register
• Marketing register
• E-commerce
• Register of elected representatives upon request
• Register of Synergia service upon request