Data Protection Notice

Data Protection Notice – NRC Group Finland Oy – Customers, suppliers and partners

1.        Controller

NRC Group Finland Ltd (hereinafter referred to as “NRC Finland”)
Radiokatu 3
PO Box 488

FI-00101 Helsinki, Finland
Business ID: 1007822-3
tel. +358 307 10


2.        Data protection officer and their contact information

NRC Finland’s data protection officer
Irma Savolainen

NRC Finland’s data protection contact person
Anu Asikainen

Contact information, see above


3.        Purposes of the processing of personal data

Personal data of the contact persons and/or employees of NRC Finland’s customers, suppliers and partners is processed for the following purposes:

  • Delivery and procurement of products and services, taking legal requirements into account
  • Planning and development of business, products and services
  • Managing cooperation and related communications
  • Customer satisfaction surveys, opinion polls and event organisation and related communications
  • Product and service marketing and its targeting by telephone, mail, email (including newsletters), SMS and other electronic channels
  • Creating statistics on NRC Finland’s own operations, reporting on and planning them


The processing of personal data about partners’ contact persons is based on:

A contract: We process the contact persons’ personal data for the performance of a contract that the partner is a party at.

A legal obligation: We process the customer’s personal data to fulfill our statutory obligations, such as those stipulated by the provisions for the retention of information in the Accounting Act and the special requirements laid down in the Act on the Contractor’s Obligations and Liability when Work is Contracted.

A legitimate interest: The processing of the personal data of a partner’s contact person may be based on a legitimate interest of the data controller when the data is used to manage and develop the customer relationship or to prevent and clarify irregularities.


4.        Sources of data

Data about partners’ contact persons is collected from a company acting as a partner or from the persons themselves. In addition, personal data may be collected from and updated based on publicly accessible sources of data, such as company websites, the Trade Register, other public and private registers (e.g. Suomen Asiakastieto Oy, Posti Ltd, Fonecta Ltd) and other similar company or decision-maker registers.


5.        Data subjects and the categories of personal data

Regarding this data protection notice, the categories of data subjects and related personal data categories include the following data about customer, supplier and partner companies’ decision-makers, employees and contact persons:

  • Basic data: name, title or degree or profession, position or role in the company, company data, workplace’s mailing and street address, work email address and work telephone
  • Additional data required by the Act on the Contractor’s Obligations and Liability when Work is Contracted Out and other legislation, to the necessary extent: tax number, date of birth, home country, address (if the home country is not Finland), employment relationship type, data about qualifications, education and training
  • Electronic service usage data: e.g. registration data required by access rights, such as the username
  • Communication-related data: feedback, contacts and email messages



6.         Recipients of personal data

We use external parties to support the processing of personal data in the maintenance and development of IT systems, for instance. These service providers process personal data commissioned by us and on our behalf. The data processing follows current legislation and is always carried out in accordance with this data protection notice . This is ensured, among other things, through contracts between the organisations.

Without statutory or contractual grounds, we will not disclose customer, supplier or partner data to parties other than those participating in the production of NRC Group’s or NRC Finland’s services.

7.        Transfer or disclosure of data outside the EU or the EEA

Data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers having an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.



8.        The data storage period or the definition criteria for the storage period

In data storage, the controller follows its statutory obligations. The practices of the storage of the personal data of partners’ contact persons depend on the grounds for the processing of the data.


9.        Rights of the data subjects

As a data subject, you have a right to your personal data processed by NRC Finland. You can exercise your rights by contacting NRC Finland’s data protection contact person. You will receive a response to your request no later than one month after sending the request. We have listed below the rights of data subjects on a general level:

  1. Right to access data

A data subject has the right to obtain confirmation whether their personal data has been processed by NRC Finland and to receive a copy of their personal data.


  1. Right to rectification

A data subject has the right to request NRC Finland to rectify inaccurate and erroneous data about them. The erroneous nature of data is to be decided on a case-by-case basis by resolving whether the data is erroneous from the viewpoint of its processing (unnecessary, incomplete, outdated).

  1. Right to erasure (“right to be forgotten”)

A data subject has the right to request NRC Finland to erase their personal data. Requests will be handled on a case-by-case basis and data that NRC Finland has a legislation-based obligation or right to store will not be erased.


  1. Right to restriction of processing

A data subject has a right in certain special situations stipulated by the regulation to request the restriction of the processing of their personal data.


  1. Right to object

A data subject has the right to object to the processing of their personal data if the processing is based on the controller’s legitimate interest or if personal data is processed for direct marketing purposes.


  1. Right to data portability

A data subject has the right to request NRC Group to provide the data about them in machine-readable format. This right concerns data that is in electronic format and whose processing is based on either consent or the performance of a contract.


  1. Right to withdraw consent

In situations in which the processing of a data subject’s personal data is based on consent, the data subject has the right to withdraw their consent. After the consent is withdrawn, the consent-based processing in question will be discontinued.


  1. Right to lodge a complaint with an authority

We seek to resolve any disputes primarily directly with data subjects. If a customer finds that we have not processed personal data as stipulated by law, the customer may lodge a complaint with a data protection authority.


10.    Principles of data protection

The data security of NRC Group and NRC Finland’s personal data processing as well as personal data confidentiality, integrity and accessibility are ensured with appropriate technical and organisational measures in accordance with NRC Group’s data security principles. Personal data is protected against unauthorized access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by NRC Group to such tasks. We train and provide guidance to our employees involved in the processing of customer data in matters related to data protection.