Data protection
Privacy Notice for the Reporting Channel Register
1. Controller
GRK Infra Plc (Business ID 0533768-1)
Address: Jaakonkatu 2, 01620 Vantaa
Telephone: +358 10 321 4110
Email: tietosuoja@grk.fi
2. The name of the register
Reporting channel register
3. Purposes and legal bases for processing personal data
The purpose of the reporting channel is to enable the reporting of inappropriate, unlawful or ethically objectionable conduct and the proper handling of reports.
The controller processes the personal data of data subjects in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (“GDPR”, Regulation (EU) 2016/679) and national data protection legislation.
Personal data is processed for the following purposes:
- receiving, handling and investigating reports
- ensuring compliance with laws, internal guidelines and ethical principles
- preventing and investigating misconduct and violations
- safeguarding the rights and obligations of the controller
- fulfilling the controller’s statutory obligations
The legal bases for processing under Article 6 of the GDPR are:
- compliance with a legal obligation (Whistleblower Protection Act 1171/2022)
- the controller’s legitimate interest in preventing and investigating misconduct
- exceptionally, the data subject’s consent where the reporter voluntarily provides their personal data
4. Categories of personal data processed
The reporting channel is anonymous by default and does not automatically collect personal data. If the reporter chooses to provide their personal data, or if the report contains personal data relating to other persons, the following data may be processed:
- the reporter’s name, position and contact details, if provided by the reporter
- the name, position and possible contact details of the person who is the subject of the report
- the names and contact details of any witnesses
- the content of the report, description of the events, time, location and attachments
- notes and log data relating to the handling of the report
- information relating to the persons handling reports
If reports contain data belonging to special categories of personal data, such data is processed only to the extent necessary for handling the report or fulfilling a statutory obligation. Personal data is processed only to the extent necessary for handling the report.
5. Sources of personal data
Personal data is obtained primarily from the reporter through the reporting channel. Data may also be obtained from other sources, such as the person who is the subject of the report, the organisation’s internal investigations or authorities, where necessary for handling the report.
The service does not store identifying information about the reporter unless the reporter provides it in the report.
6. Disclosure and transfer of personal data
Personal data is not disclosed to third parties on a regular basis. Data may be disclosed only:
- to authorities where required by law or an order of an authority, for example in connection with a criminal investigation or legal proceedings; or
- on the basis of the controller’s legitimate interest, for the establishment, exercise or defence of legal claims.
The technical implementation of the reporting channel is provided by Easywhistle Oy, which acts as a processor on behalf of the controller.
The controller has ensured that the processing of personal data complies with applicable data protection legislation and that data processing agreements (DPAs) have been concluded with the processors. Personal data is not transferred outside the European Union or the European Economic Area.
7. Protection of personal data
Personal data is processed confidentially. The data is protected by appropriate technical and organisational measures.
Access rights are restricted to persons who are authorised to process the data on the basis of their duties.
All parties processing personal data are bound by an obligation of confidentiality, and the persons handling reports are additionally subject to statutory and contractual duties of confidentiality.
No automated decision-making or profiling is used in the processing of personal data.
8. Data Retention Period
Personal data is retained only for as long as necessary for handling the report or fulfilling statutory obligations.
- Reports and the related personal data are deleted no later than five (5) years after receipt of the report.
- Personal data that is clearly irrelevant to the handling of the report is deleted without undue delay.
- Where retention is necessary for the establishment, exercise or defence of legal claims, data may be retained for a longer period within the limits permitted by law.
9. Rights of the Data Subject
The data subject has the right to:
- obtain access to personal data concerning them
- request the rectification or erasure of inaccurate data
- request restriction of processing or object to processing
- request the transfer of data from one system to another
Restrictions on rights
Under Chapter 6, section 31 of the Whistleblower Protection Act (1171/2022), the data subject’s right of access (Article 15 of the GDPR) may be restricted where necessary to safeguard the investigation or protect the reporter.
The data subject has the right to be informed of the reasons for the restriction and to request that the data be provided to the Data Protection Ombudsman in accordance with section 34 of the Data Protection Act (1050/2018).
The data subject has the right to lodge a complaint with the Data Protection Ombudsman if they consider that personal data is being processed unlawfully.
The data subject may exercise their rights by contacting the controller’s representative using the contact details set out in section 1.
10. Personal Data Processing System and Processors
The reporting channel operates as a cloud-based service (SaaS) provided by Easywhistle Oy. Easywhistle Oy (Business ID 3132737-2) acts as a processor on behalf of the controller. Reports submitted through the reporting channel are handled on behalf of the controller by Tvenda Oy (Business ID 0105004-2).
The controller is responsible for ensuring that the processing of personal data complies with applicable data protection legislation.
11. Updates to this Privacy Notice
The controller may update this privacy notice from time to time.
The updated version will be published on the controller’s website and/or in connection with the reporting channel.