Privacy Statement: Notification Channel

Controller
Oy Medfiles Ltd
Rajatorpantie 41, 01640 Vantaa

Persons responsible for the register
Katri Ventola-Seppälä
Rajatorpantie 41, 01640 Vantaa

+358 50 577 9004

Purpose and grounds for processing personal data
The purpose of processing personal data is to receive, process and archive releases received through the notification channel. The data may also be used in connection with the internal safety of the work community, compliance with rules and the investigation of possible misconduct.

Source of personal data and category of data subjects
Registered persons i.e., the whistleblowers

Data content of the register

  • Content of the notification
  • Date and time of sending the notification
  • Possible contact information provided by the notifier
  • Possible additional information for anonymous reporting
  • Notes and follow-up information related to the handling of notifications

Data format and location
The data is stored in the database in encrypted form within the EU.

Access to personal data
Only the processors of notifications designated by the controller will be informed of the reports and have access to the processing of the reports. Each processor uses their own unique usernames when logging in to process notifications. The person responsible for the technical maintenance of the system shall not have access to the notification database.

Disclosure/transfer of data
Personal data will not be transferred outside the EU or EEA.

Data is not regularly disclosed to third parties, except for legal requirements, such as a lawful request from an authority.

Evaluation and maintenance policy
The data will be automatically destroyed 12 months after submitting the notification.

Technical protection measures / information security
The service is subjected to at least two information security penetration tests per year in cooperation with a Finnish cyber security company (Silverskin Information Security). Penetration testing uses several different attack methods to ensure that there are no gaps in the service.

Rights of the data subject
Everyone has the right to inspect the data concerning them in the register and to demand the correction of any incorrect data.

A person has the right to demand the removal of data concerning him or her from the register if the processing of the data is not necessary for the purposes of the reporting channel’s information register.