Privacy Policy

1. Data Controller

Heplan Oy
Laukaantie 4
40320 Jyväskylä
Finland
Business ID: 2964480-3

2. Contact Person Responsible for Data Protection

Teijo Hakkarainen
Tel. +358 40 530 2292
Email: heplan@heplan.fi

3. Purpose of Processing Personal Data

Personal data is processed for the following purposes:

• to manage and develop customer and partner relationships and to process orders and deliveries
• to respond to enquiries and requests for quotation submitted through the website
• recruitment: to process job applications and open applications and to communicate with applicants
• to improve our website and services through analytics

4. Legal Basis for Processing Personal Data

Under the General Data Protection Regulation (GDPR), personal data is processed on the following legal bases, depending on the case:

• the performance of a contract or steps taken prior to entering into a contract
• the Data Controller's legitimate interests (managing customer and partner relationships, responding to enquiries and recruitment)
• consent (analytics cookies and retaining open applications for future recruitment)

5. Personal Data Collected

Contact persons of customers and partners: name, employer and job title, email address, telephone number and information voluntarily submitted through forms.

Job applicants: name, contact details, application, CV and other information submitted by the applicant. Applications should not include a personal identity number, health information or other sensitive data.

6. Data Retention

Customer and partner data is retained for as long as the customer or partner relationship continues or the data is needed to fulfil contracts and legal obligations, such as accounting.

Job applications and CVs are retained during recruitment and thereafter only for as long as necessary to complete the recruitment. Data from open applications is retained, with the applicant's consent, for future recruitment. Data is deleted from email and other storage locations when it is no longer needed, or at the applicant's request.

7. Sources of Personal Data

Personal data is obtained from:

• The data subject.
• Public registers maintained by authorities where permitted by applicable law (e.g. ytj.fi).
• Google Analytics 4, which collects information about the use of the website through cookies, based on the visitor's consent.

8. Disclosure of Personal Data and International Transfers

Personal data is not regularly disclosed outside the Data Controller. The Data Controller uses service providers, such as website maintenance and analytics services, which process data on its behalf. Some service providers, such as Google Analytics, may process or store personal data outside the European Union (EU) or the European Economic Area (EEA). Such transfers are carried out using appropriate safeguards in accordance with the GDPR.

9. Cookies

This website uses cookies to ensure the proper functioning of the website and to improve the user experience.

We use Google Analytics 4 to collect statistical information about the use of the website. Data collection through Google Analytics is based on the visitor's consent. Google Analytics may collect information such as the number of visitors, pages visited, time spent on the website and traffic sources.

Visitors may accept or reject non-essential cookies through the cookie consent banner and may change their cookie preferences at any time.

Most web browsers also allow cookies to be blocked or deleted through the browser settings. Please note that disabling cookies may affect the functionality of the website.

10. Protection of Personal Data

Personal data is transmitted over TLS-encrypted (HTTPS) connections.
Job applications are processed only by persons involved in recruitment.

Electronic data is protected by firewalls, user authentication and password protection.

Access to personal data is limited to employees or authorised persons who require access for the performance of their duties.

11. Automated Decision-Making

No automated individual decision-making as referred to in Article 22 of the General Data Protection Regulation (GDPR) is carried out.

12. Rights of the Data Subject

Under the GDPR, the data subject has the right to:

• Request access to their personal data.
• Request the rectification of inaccurate or incomplete personal data.
• Request the erasure of personal data where applicable.
• Request restriction of processing.
• Object to the processing of personal data, including processing for direct marketing purposes.
• Receive their personal data in a portable format where applicable.
• Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Lodge a complaint with the competent supervisory authority.

Requests concerning personal data should be submitted to the contact person listed above. Requests are processed free of charge. Where a request is manifestly unfounded or excessive, in particular if it is repeated, the Data Controller may charge a reasonable administrative fee or refuse to act on the request in accordance with Article 12(5) GDPR. Requests are answered without undue delay and, as a rule, within one month of receipt.

Lue tämä sivu suomeksi