Privacy policy

This is a statement on the processing of your personal data pursuant to the EU’s General Data Protection Regulation (679/2016).

As updated July 3rd, 2024.

Controller

Arctic Farming Oy
Business ID: 3107533-9
address: Arctic Farming Oy c/o A Grid, PL 13100, 00076 AALTO email address: hello@arcticfarming.fi

Communication regarding privacy matters

Oliver Rotko
email address: privacy@arcticfarming.fi

We request that data subjects contact the person listed hereinabove for all questions related to the processing of personal data and situations related to the exercising of your rights.

Basis and purpose of processing personal data

The legal basis for the processing of personal data is:

• The consent to the processing of personal data provided by the data subject

• The contractual relationship between the data subject and controoler

• The controller’s legitimate interest based on marketing and customer acquisition

• The controller’s legitimate interest based on compliance with the obligations and special rights of the data controller and the data subject in the field of labor law

The purpose of personal data processing is:

• Fulfilling our contractual and other promises and obligations

• Managing our customer relationships

• Developing our services based on customer feedback

• Recruitment and the administration of recruitment processes, as well as the administration of information related to the job application process

Regular data sources

The personal data to be processed for marketing purposes are regularly received from the following sources:

• The data subject themselves

• The Trade Register

• The data subject’s employer’s website

• The data subject’s LinkedIn account

The personal data to be processed for recruitment purposes are regularly received, as a rule, from the job applicant itself. Other data sources can also be used within the limits set by the Finnish law. If necessary, we also use third parties in our recruitment process, such as recruitment consultants.

By submitting a job application via our website, by email, or by any other digital or physical means, the job seeker gives permission to collect their information as necessary and related to the job vacancy that was applied for, or any other future job vacancies that might be relevant for the job seeker in question.

Personal data being processed

The controller only collects personal data concerning the data subject that is essential and relevant for the purposes explained in this privacy statement.

The following data concerning the data subjects is processed for marketing and customer acquisition purposes:

• The registrant’s basic information such as name, employer, and job title.

• The registrant’s contact information, such as email address*, phone number, and LinkedIn account.

• Information regarding marketing communications, such as booked meetings, call records, and messages sent to the data subject, information on opened messages, and approvals or prohibitions regarding direct marketing*.

Proving personal data market with an asterisk is a prerequisite for the implementation of electronic marketing communications, and for customer acquisition activities. Without the personal data mentioned with an asterisk, we cannot deliver electronic marketing messages to the data subject.

The following data concerning the data subjects is processed during recruitment processes:

• The registrant’s basic information such as name*, date of birth*, gender*, citizenship*, and native language.

• The registrant’s contact information such as email address*, phone number*, and address information*.

• Information related to the job position applied for by the registrant, such as the form and quality of the employment relationship.

• Other information provided in connection with the registered job search process, such as study and other education-related information, work history, language skills, other special skills, and recommenders.

• Information regarding the progress of the registered recruitment process, such as information about the upcoming follow-up interview or interruption of the recruitment process.

• Any other information that the registered person has voluntary provided in connection with the job search process or information collected by the controller separately with the consent of the registered person, such as a job application and curriculum vitae.

Providing personal information market with an asterisk is a prerequisite for us to move forward in the job search process.

Disclosure of personal data

Personal data will not be disclosed to third parties, unless the law imposes an obligation to do so. Data may, therefore, be disclosed in exceptional cases, such as to the authorities when so required by law.

Transfer of personal data to third countries

As a rule, personal data will not be transferred outside the EU and the European Economic Area. Personal data is primarily located in the EU/EEA area. Some of the IT systems and services used by Arctic Farming Oy are produced by international service providers, in which case data may be transferred outside the EU/EEA area in connection with the production of the service. In such situations, Arctic Farming Oy has ensured that data transfers are protected as required by the EU data protection regulation.

Protection of personal data

The controller processes personal data in a manner that aims to ensure the appropriate security of the personal data, including their protection against unauthorised processing and accidental loss, destruction or damage.

The controller uses appropriate technical and organisational safeguards in order to achieve this goal; these include the use of appropriate access control, careful management of data system user IDs, and providing instructions to the personnel participating in the processing of personal data. Only personnel that have the right to process the data in question, for their work, are entitled to use the information in the marketing register. Each user has their own usernames and passwords for the systems.

Retention period of personal data

The controller will process the personal data as long as the data is relevant for the intended purposes listed above, or until the data subject requests for the data to be deleted.

In addition to this, we take reasonable measures to ensure that out-of-date or incorrect personal data regarding the purposes of the processing is not stored in the register.

The controller may have an obligation to process some personal data belonging to the filing system for longer than stated above in order to comply with the legislation or authority requirements.

Profiling

Personal data will not be used for profiling or other automated decision-making during recruitment processes.

Rights of the data subject

Right to request access to personal data

The data subject has the right to receive confirmation regarding whether personal data concerning them is being processed and, if it is, the right to receive a copy of their personal data.

Right to rectification

The data subject has the right to request that inaccurate and erroneous personal data concerning them be rectified. The data subject also has the right to supplement incomplete personal data by submitting the required additional information.

Right to erasure

The data subject has the right to request erasure of personal data concerning them if

a. the personal data is no longer required for the purposes for which they were collected;

b. the data subject withdraws their consent which the processing of personal data was based on, and no other legal basis exists for the processing; or

c. the personal data has been unlawfully processed.

Right to restriction of processing

The data subject has the right to restrict the processing of personal data concerning them if

a. the data subject contests the accuracy of their personal data;

b. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; or

c. the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims.

Right to object

The data subject has the right to object, on grounds relating to their particular situation, at any time, to processing of personal data concerning them.

The controller shall no longer process the data subject’s personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Right to withdraw consent

The data subject has the right to withdraw the consent they have provided for the processing, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller.

Right to lodge a complaint with a supervisory authority

The office of the Data Protection Ombudsman, operating under the Ministry of Justice, is the national supervisory authority for personal data matters. You have the right to bring your case to the supervisory authority if you consider that the processing of personal data concerning you is in violation of applicable law.