DATA PROTECTION STATEMENT

1. Data controller
Tampere Chamber of Commerce (business ID 0206122-9) [hereafter referred to as ‘TCC’]
Address: Kalevantie 2, FI-33100 Tampere
Telephone: +358 (0)3 230 0555
E-mail: info (at) tampereenkauppakamari.fi
Contact person in matters related to data protection: Juha Koski juha.koski (at) tampereenkauppakamari.fi

2. For which purposes do we process our members’ personal data?
In this context, a ‘member’ means a contact person of such companies and other entities with which TCC has a member relationship. TCC processes the personal data of its members for the following purposes (one or more purposes at the same time).

Management and analysis of the member relationship
• TCC uses your personal data for the management and analysis of the member relationship formed with the company or other entity you represent. TCC’s task is to develop the operating conditions of business within its operational area.

Offering membership perks
• TCC may use your personal data to offer various changing membership benefits and to analyse the usage of them. Personal data is used to exercise rights and obligations based on an agreement or another commitment between TCC and the member’s organisation.

Member communications
• TCC may use your personal data in its member communications, for example, to send you notifications related to the membership and membership perks, to communicate about changes made to services or to request feedback on products and services.
• TCC may use personal data to customise its offering for members and to offer relevant content. This means, for example, that we may provide recommendations or show customised content and customised messages in our own services and third-party services.

Development of products and services
• TCC may use a member’s personal data to develop its products and services.
The following subparagraphs of Article 6 of the EU General Data Protection Regulation act as the legal basis for processing personal data:
1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject; and/or
4. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
In principle, TCC processes your data in its member register based on the Chamber of Commerce Act and the Associations Act. TCC may also process your personal data when other legislation so obligates, for example, based on the obligation to retain data as laid down in the Accounting Act.
TCC has legitimate interests related to conducting its business, such as further development of the operation and clarification of potential circumvention, and your personal data can also be processed on those grounds.

Processing logic
Personal data is processed either using automated means or manually. The processing does not involve automated decision-making.

3. Which types of data can we collect?
The personal data collected by TCC may contain, among others, the following types of data and amendments made to them:
3.1. Basic information of all data subjects
• First and last name
• Contact information (postal address, email address, telephone numbers)
• Title and/or job description for work tasks related to current and previous TCC customer relationship
• Name and information of the company related to TCC membership where the data subject currently works or has worked previously
• Communications targeted to the data subject and the use of products and services contained in the communication
• Data concerning the use of TCC’s digital services and digital content created for the data subject
• Technical data sent to a data subject’s digital devices (such as computers and mobile devices) by TCC, as well as data concerning cookies and other corresponding techniques
• E-mail and online discussions
• Positions of trust, expert positions or other stakeholder relationships.
3.2. Data of data subjects who have used TCC member products, provided feedback and/or made a complaint about them
• Content of feedback and complaints, correspondence and further actions related to them.
3.3. Data of data subjects who have participated in TCC’s regular meetings, events and other services
• Date of birth related to events for which, for example, a shipping company requires it
• Essential information about the organisation and participation in an event
• Information concerning diet (special data which the user has provided voluntarily)
• Benefits targeted to a data subject and their usage.

4 From which sources do we collect personal data?
The majority of the data is received at the beginning of and during the membership and from the programmes through which you use our products and services.

TCC also receives personal data and updates to them from the authorities, organisations and companies who offer update services for credit and personal data, from public directories, and other public data sources, such as websites of communities and social media channels.

5. With whom can we share your personal data?
TCC does not give, sell or otherwise reveal your personal data to third parties outside the Tampere Chamber of Commerce community, unless otherwise stated below.
TCC may share your personal data with the member company or entity where you work, for example, when your employer asks for the data of the employees who have participated in TCC events. TCC may share the data of the participants of TCC events with other participants of a given event, for example, by sharing a participant list in connection with other material.
TCC may share your personal data with co-operation partners with whom TCC manages and implements projects, such as Finland Chamber of Commerce.
TCC may share your personal data with third parties who provide services for TCC. Such services may include, for example, customer service, software services, technical management and analysis of personal data, research, communications and various campaigns. TCC may share your personal data in order to collect payments for products and services, and it may transfer or sell unpaid invoices to third parties which offer collection services. Protecting your personal data is important to TCC, which is why it does not allow said parties to use the data for any other purpose than offering said services, and it requires that the parties protect the user’s personal data in compliance with this Data Protection Statement.
TCC may share your personal data with carefully selected third parties for joint or independent research, advisory services or direct marketing purposes. Data can only be shared for said purposes when the intended use by the third party is not in conflict with the intended use specified in this TCC Data Protection Statement.
TCC may share your personal data upon the order of a court of justice or a corresponding instance.

6. Do we transfer your personal data outside the EU area?
TCC may use resources and servers located in different parts of the world when offering its services. TCC’s member register is located on a server in the EU area. TCC may thus transfer your personal data outside the country of use and possibly also to countries outside the EU and EEA where there is no special protection of personal data in the legislation, or the legislation differs significantly. In such cases, TCC ensures that there is a legal basis for transferring the data and that the user’s personal data is protected in compliance with the applicable legislation, for example, by using (when required) standard contracts approved by appropriate authorities and by requiring that appropriate technical and practical data protection measures are followed.

7. For how long do we process your personal data?
TCC processes your personal data in this register for as long as TCC has a basis described in Section 2 of this Data Protection Statement for data processing to be in force, and for a reasonable time after it. Your data will be processed at least during the period when TCC and the organisation you represent have a valid member relation and you act as a contact person towards TCC or work in said member company.

8. How can you exercise your rights related to your personal data?
As a contact person of a member you have various opportunities to influence the processing of your personal data. As a rule, we will fulfil your request within a month. We request that you contact the contact person mentioned in Section 1 of this Data Protection Statement in matters of exercising your rights.

Your rights include:
1. The right to access the personal data collected on you. In practice, based on your appropriate and identified request, we provide you with a report of the personal data collected on you in the register.
2. The right to request the rectification of the personal data collected on you. If you notice errors or deficiencies in your data, you can send us a request for rectification.
3. The right to request the erasure of the personal data collected on you. We are obligated to erase the personal data from our register, as requested by you, if any of the following grounds applies and there is no obligation to retain the data for legal reasons or due to an authority regulation:
a) personal data are no longer needed for the purposes for which they were processed;
b) you withdraw the consent you have given, and there are no other legal grounds for the processing;
c) you object to the processing because of your special personal situation, and there is no legitimate interest for the processing, or you object to having your personal data processed for direct marketing;
d) your personal data has been unlawfully processed;
e) your personal data must be deleted to comply with EU legislation or a statutory obligation based on the Finnish law applied to TCC; or
f) your personal data have been collected in relation to the offer of information society services, for example, in connection with ordering TCC’s digital information services.
4. The right to request the restriction of the processing of personal data collected on you. You can ask TCC to restrict the processing of your personal data, if:
a) You contest the accuracy of your personal data at TCC.
b) The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
c) TCC no longer needs the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims.
d) You have objected to the processing pending the verification whether the legitimate grounds of TCC override your grounds.
5. The right to transfer the data provided by you from one system to another. If the automatic processing of your personal data is based on consent or an agreement, you have the right to receive the personal data you have delivered to TCC in a structured, generally used and machine readable format, and you have the right to transfer the said data to another controller.
6. The right to withdraw consent. If all or part of your personal data is processed in this register based on your consent, you have the right to withdraw the consent you have given.
7. The right to lodge a complaint with a supervisory authority. If a possible dispute related to the processing of your personal data cannot be amicably settled between you and TCC, you have the right to submit the matter to be resolved by the Office of the Data Protection Ombudsman.
9. Is it necessary give us your personal data?
For TCC to be able to fulfil its contractual obligations related to Chamber of Commerce membership, TCC must receive and process your personal data. Without the necessary personal data, we cannot offer a member and/or you the member benefits in connection with which it is necessary to process personal data.

10. Do we perform profiling?
For the time being, we shall not conduct profiling as intended in the EU General Data Protection Regulation which would have a legal impact or other corresponding sanctions related to you.
However, we can otherwise analyse the personal data in our registers and combine them with information received from third parties to attempt to predict, for example, what type of content you would probably be interested in, and target content based on the forecasts.

11. Which country’s legislation is applied to the data processing?
TCC is a Finnish organisation operating in Finland. The Finnish legislation and EU legislation applied directly in Finland, such as the EU General Data Protection Regulation, are applied to this person register and the processing of personal data contained in it.