Privacy Statement: Customer Information
Oy Matkahuolto Ab
Business identity code 0111393-9
P.O. Box 100
Tel. 020 710 5000
(Hereinafter “Matkahuolto” or “We”).
This privacy statement describes how Matkahuolto processes the personal data of its consumer customers that Matkahuolto collects in connection with the travel and parcel services it provides. The information described in this privacy statement applies to data collected by Matkahuolto from the following channels and/or the processing of personal data in connection with travel or parcel services, unless otherwise stated below:
Matkahuolto’s electronic business channels:
Matkahuolto’s website at www.matkahuolto.fi
Matkahuolto’s mobile apps
Matkahuolto’s network of service outlets
Matkahuolto’s other business channels
For the purposes of this privacy statement, all users of Matkahuolto’s services, such as users registered in electronic services, are considered “customers”.
If you would like more information about how your personal data is processed in connection with travel services provided by Matkahuolto or the carriers acting on our behalf, please refer to the travel services privacy statement.
If you want more information about how your personal data is processed when sending or receiving parcels or official documents carried by Matkahuolto or parties acting on its behalf, please refer to the parcel services privacy statement.
If you would like more information about how your personal data is processed by Matkahuolto or by carriers and agents acting on our behalf when providing assistance services to people with reduced mobility and disabilities at bus stations in accordance with EU Regulation No. 181/2011, please refer to the assistance services privacy statement.
Some of Matkahuolto’s service outlets have recording camera surveillance, and customer information is also stored on camera surveillance recordings. For more information on the processing of personal data collected through camera surveillance, see our camera surveillance privacy statement.
Matkahuolto acts as a controller for the personal data it collects and processes in connection with the provision of the above-mentioned services. As the controller, Matkahuolto is responsible for all such personal data and their processing. As data protection is about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto, in its capacity as the controller, only collects personal data to the extent necessary to be able to offer you first-rate services.
What is described in this privacy statement only applies to the ways in which Matkahuolto or the parties acting on our behalf process data. However, please note that our electronic services may contain links to third-party websites or social network services, but we cannot control the actions of such third parties, nor are we responsible for the privacy policies of these third-party services or the content of those services. We encourage you to review the privacy and data protection terms of the third-party services.
1. Contact details related to the processing of personal data
Oy Matkahuolto Ab
Customer Service Centre
P.O. Box 100
2. What data do we process?
When you do business with us through our electronic or other channels and use the services we provide, we may collect the following data about you in connection with your customer relationship:
contact details, such as name, address, telephone number and e-mail address
registration information required for your electronic account, such as username, pseudonym, password, or other unique identifier
demographics such as age, gender, rank or profession, mother tongue
customer relationship information, such as your contacts with our customer service, including recorded customer service calls and customer feedback you provide
other information on communications related to your relationship with us
billing and collection information
information you provide for surveys
objections to direct marketing and supply prohibitions
other information collected with your consent, if the information is necessary for the management of the customer relationship or for other purposes of processing set out in this privacy statement, and
information about which Matkahuolto services you have used, as well as details on the use of these services as set out below or in each service-specific privacy statement; for more information on the processing of your personal data, see the privacy statement of, respectively, travel services, parcel services and assistance services. for more information on camera surveillance in Matkahuolto premises, see the camera surveillance privacy statement.
When you register as a user of our electronic services, you may be asked to enter, for example, the following personal data: name, contact information, date of birth, telephone number, chosen password and, if applicable, additional billing information, such as billing address and/or bank details. In addition, you can voluntarily provide us with information about, for example, your interests. The information in your own profile is constantly updated (for example, the usage history of Matkahuolto services, including parcel, travel and assistance services, as described in more detail below).
When you use our electronic services, we may collect metadata related to your use of our services, such as, where you accessed our services, duration of your visit, amount of data transferred, type of web browser, IP address, operating system and user interface, as well as browser version and language. If you visit our electronic services without registering or logging in, only the above metadata will be processed. These metadata cannot be used to identify an individual user unless you register or log in to our services. These data are collected with the help of cookies or other similar technologies. For more information about Matkahuolto’s cookie policies, see our cookie statement.
3. Purposes and legal bases for the processing of personal data
Purposes of the processing of customers’ personal data
We process your personal information primarily in order to provide you with access to the services we provide, such as our websites and other electronic or non-electronic services, or our business channels, such as customer service.
We process the personal data of Travel Card holders and single-ticket passengers mainly for the purpose of offering travel-related services and products. For more information, see the travel services privacy statement.
In connection with parcel services, we process your personal data for the purposes of providing the services, meaning sending and receiving addressed consignments, sending arrival notices and crediting COD payments as well as for the positive identification of individuals. For more information, see the parcel services privacy statement.
In connection with assistance services, we process your personal data to provide you with access to our assistance services. For more information, see the assistance services privacy statement.
Data stored through camera surveillance are processed for security purposes as further specified in the camera surveillance privacy statement.
We also process your personal data to manage, analyse and develop the customer relationship between us, for example to provide customer service and implement customer communications.
In addition, we help our customers find interesting offers, for example, through advertisements on our electronic channels, as well as by way of email and text messages. We use the personal information we collect for target marketing, to measure the effectiveness of marketing and carry out marketing, such as direct marketing, distance selling, and customise marketing to you with your consent or as permitted by law, unless you have denied the processing of your information for such purposes.
We also process your personal data for the purposes of developing our services and products. We are constantly developing our service offering, and the cornerstone of such development is the information we collect about the kind of services our customers are interested in. This enables us to develop and provide more useful services and products to our customers. From time to time, we collect additional information to support decision-making through customer surveys, such as customer satisfaction surveys. However, business decisions to develop our services and products are made on the basis of aggregated information, which does not identify our individual customers.
Legal bases for the processing of customers’ personal data
The legal basis for processing your personal data is either compliance with the agreement concluded between us, an obligation under legislation binding Matkahuolto, a legitimate interest of Matkahuolto or a third party, or your consent to us. Examples of these bases for processing are given below.
The processing of your personal information is necessary for us to implement the agreement we have entered into with you. For example, when you register as a user of our electronic channels, we will process your data so that we can fulfil our obligations under the agreement between us. Contractual processing also applies, for example, when you leave consignments with us for transportation. For more information on the processing of personal data in connection with our parcel services, see the parcel services privacy statement.
The processing is based on our legitimate interest when, for example, we offer you a first-class customer experience and the best possible content online and in our newsletters. Processing is also based on legitimate interest when we process your data, for example, for administrative reasons and to ensure data security as well as to prevent and investigate, among other things, a possible misuse of our electronic channels.
You can give us your consent to receive electronic direct marketing. Our marketing efforts may also be based on our legitimate interest.
Our legal obligation to process your personal data applies, for example, when we provide you with assistance services, the provision of which is based on an EU regulation that is binding on us, as described in more detail in the assistance services privacy statement.
How do we merge customers’ personal data?
We merge personal data collected in connection with the use of our various services in order to provide you with services that are more usable. However, your information collected in connection with the use of our various services will only be combined if you have registered as a user of our electronic services and use our various services, such as buying tickets, sending packages or otherwise dealing with us through your electronic customer account, in which case the merging of your data is based on your consent..
If you have not enabled our electronic services or accessed our services through your electronic customer account, we will not merge the personal data collected in connection with your use of our various services, in which case you data will only be processed as described in our individual services or other privacy statements.
4. Visitor tracking and cookies on our website and electronic services
Cookies and other similar technologies are used on our website Matkahuolto.fi and in our electronic services.
Cookies can be used to collect metadata, such as where you accessed our services, which Web pages you have browsed and when, information about your browser and operating system, the IP address of your terminal, i.e. the Internet address used by you to send and receive data. For more information on using cookies, see our cookie privacy statement.
5. Regular sources of data
We collect information from you at the start of and during the customer relationship, for example through the registration form or otherwise when you use our electronic services or do business in any other way with us or our partners, such as our agents. We may also collect information from you as you participate in our marketing campaigns. In addition, we collect information from you when you use our travel, parcel or assistance services.
For more information on regular sources of information, see the privacy statement of, respectively, travel services, parcel services and assistance services. As shown in our camera surveillance privacy statement, camera surveillance is used at Matkahuolto’s service outlets.
Personal data and their updates may also be collected from our partners and from authorities and companies that provide personal data services, such as companies that provide services for updating contact details.
6. Transfers of personal data
Matkahuolto may transfer personal data to processors for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance or other data processing tasks. When transferring personal data, we ensure, through contractual arrangements, that the party that processes personal data on our behalf does so only in accordance with the written instructions issued by us and exclusively for the purposes indicated in this privacy statement. We also ensure that access to personal data is limited to persons who need to access it for work-related reasons.
Data will not be transferred outside the member states of the European Union or the European Economic Area without a transfer basis in accordance with the legislation currently applicable. To receive more information on possible transfers of personal data and the applicable transfer bases, please use the contact information given in section 1 of this privacy statement.
7. Disclosures of personal data
We will disclose the personal data of individual customers to third parties only in the cases set forth below.
We may disclose customer data to third parties if you have given your consent.
If you have given your consent to implement electronic direct marketing, we may disclose your personal data to our carefully selected partners for marketing purposes.
We may disclose your personal data as required by the competent authorities or other parties or as required by applicable law, in accordance with currently applicable legislation.
If we sell, buy, merge or otherwise organise our business, we or a party acting on our behalf may disclose your personal data to buyers and their advisors.
When selling HSL mobile tickets, we pass on purchase-related personal data to HSL. HSL is responsible for processing the disclosed information in accordance with its own data protection policies as follows: www.hsl.fi/tietosuoja.
Information will be disclosed in accordance with the service-specific privacy statements. For more information on the disclosure of personal data, see the privacy statement of, respectively, travel services, parcel services and assistance services. For more information on the disclosure of data collected through camera surveillance, please see our camera surveillance privacy statement.
8. Personal data protection policy
Manually processed data is kept in locked rooms at Matkahuolto outlets.
Electronic data is stored in a database that may only be accessed by specifically designated staff members of the controller or a party acting on its behalf who need to access such data for work-related reasons, have received adequate training and are bound by a statutory or contract-based non-disclosure obligation.
The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are protected through technical means.
All the data communications between the browser and the server environment are encrypted.
Access to servers and applications is restricted through role-based access control management.
9. Storage period and erasure of personal data
Matkahuolto or a processor of personal data who carries out processing of such data on behalf of Matkahuolto, as described in this privacy statement, retains the personal data in accordance with applicable legislation for only as long as storage of the data is necessary to achieve the purposes of the processing of personal data described in this privacy statement.
We determine the storage periods of personal data according to the following criteria:
Your personal data will be retained for the duration of your active customer relationship. The activity of your customer relationship is determined, for example, on the basis of your use of Matkahuolto’s electronic services or your communication with us. If a user registered for our electronic services has not logged in to their electronic account within the last two years, we ask the user to confirm that they want to keep their account. Unless the user confirms that they want to keep their account and if the customer relationship or other basis for processing personal data has ended, the personal data will be mainly deleted or changed in such a way that the data can no longer be linked to a natural person.
Information about your direct marketing consent will be deleted if you withdraw your marketing consent or object to the processing of your personal data for direct marketing purposes. In this case, however, we will retain the information regarding the prohibition of direct marketing if your customer relationship can otherwise be considered active.
Your data will be deleted if you have requested the deletion of your data and Matkahuolto has no other basis for processing your personal data.
The communication sections of some of our services, such as your public feedback, will still display your pseudonym and and related content even after your customer relationship has ended.
In addition, we may be required to retain some of your personal information in order to comply with accounting or other mandatory legislation even after the end of your customer relationship or other basis for processing personal information.
Data will be stored for the period specified in service-specific privacy statements. For more information on the storage period of personal data, see the privacy statement of, respectively, travel services, parcel services and assistance services. For more information on the storage period of data collected through camera surveillance, see the camera surveillance privacy statement.
10. Rights of data subjects
The EU General Data Protection Regulation guarantees data subjects a number of rights that you can exercise to determine how your personal data is processed. You may exercise the following rights in respect of Matkahuolto insofar as Matkahuolto serves as the controller of your personal data.
Right of access: The data subject has the right to receive a confirmation from Matkahuolto as to whether Matkahuolto processes his or her personal data and in order to access such data. Matkahuolto may request the data subject to formulate his or her request in more detail regarding the procedure for the delivery of the data, etc.
Right to correct personal data: The data subject has the right to correct any errors in the personal data processed by Matkahuolto or complete any incomplete data.
Right to be forgotten: If there is no longer any legal basis for the processing of personal data or a statutory or contractual provision obligating Matkahuolto to retain personal data ceases to apply, the data subject has the right to demand that Matkahuolto erase his or her personal data and Matkahuolto is required to comply with the request.
Limitation of processing: In certain cases stipulated by law, the data subject may have the right to demand that Matkahuolto limit the processing of his or her personal data.
Right to transfer personal data: Subject to certain statutory provisions, the data subject may have the right to receive from Matkahuolto the personal data concerning him or her in Matkahuolto’s possession in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from Matkahuolto.
Right to object to the processing of one’s personal data: In addition, the data subject may have the right to object to the processing of his or her personal data in certain situations. In particular, the right to object to the processing of personal data applies to situations in which processing is based on Matkahuolto’s legitimate interest, and Matkahuolto is required to comply with the request of the data subject unless Matkahuolto demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Direct marketing and the right to forbid the processing of personal data for direct marketing purposes: The data subject has the right to forbid the processing of his or her personal data for direct marketing purposes.
If you have registered as a user of Matkahuolto’s electronic services, you can check and correct your information in the electronic services provided by Matkahuolto. If you have not registered as a user of our electronic services, or if you do not want to use our electronic services to check or correct your information, you can check and correct your information by contacting Matkahuolto Customer Service Centre referred to in section 1 of this privacy statement. Any requests for the erasure or transfer of the data or any objection to direct marketing must always be submitted to the Matkahuolto Customer Service Centre.
Matkahuolto will take prompt action in response to the data subject’s request and will provide the data subject with information on the exercise of rights normally within one month of receipt of the request.
Additionally, the data subject has the right to lodge a complaint concerning the processing of personal data by Matkahuolto with the data protection authority. Any complaint must be filed with the competent authority, in Finland with the Data Protection Ombudsman in accordance with the instructions they provide. Address of the Data Protection Ombudsman’s website: http://www.tietosuoja.fi.
11. In conclusion
Matkahuolto reserves the right to update and revise this privacy statement. Unless otherwise provided by law, Matkahuolto may not necessarily notify the data subject of such changes personally, and Matkahuolto therefore urges data subjects to check this private statement from time to time for any changes