Privacy statement for valio’s visitors

1. Data controller

Valio Ltd (Business ID: 0116297-6) Meijeritie 6 FI-00370 Helsinki

2. Contact information

If you wish to exercise your rights under this privacy statement or if you have questions about the processing of your personal data, please contact Valio by email at [email protected] or by calling +358 10 381 2185.

3. For what purposes and on what basis do we process your personal data?

The processing of visitors’ and contractors’ personal data is necessary for access to Valio’s production sites and facilities. We process all visitors’ personal data for the following purposes:

• Receiving visitors and verifying their identity
• Ensuring smoothly running visits
• Ensuring food safety and preventing the spread of infectious diseases in Valio’s facilities
• Ensuring the safety of Valio’s employees and others who access the facilities
• Protecting Valio’s property and ensuring safety and order in general.

In addition, we process personal data concerning contractors’ representatives for the following purposes:

• Implementing an agreement between Valio and a contractor (e.g. concerning a construction project or hot work)
• Managing the permits required for the work
• Providing contractors with the necessary induction and other training
• Meeting the requirements in the construction industry to disclose information to the Tax Administration
• Protecting Valio’s property and ensuring safety and order in general.

The processing of personal data is based on (a) Valio’s legitimate interests in line with the person’s visitor or contractor relationship with Valio and the purposes mentioned above (e.g. ensuring safety at Valio’s production plants) or (b) meeting Valio’s statutory obligations (e.g. fulfilling the requirement in the construction industry to disclose information to the Tax Administration and ensuring compliance with the Food Act).

4. What personal data do we process?

With regard to visitors, we process the following personal data:

• First name and last name, phone number, company or employer, email address (if the visitor’s data is collected through the visitor application)
• Information about meeting the requirements for the visit (e.g. compliance with the hygiene instructions concerning the production plant)
• Information about the visit to Valio, such as the time and location (production plant department)
• Information related to access control (car registration number, visitor card number, access pass ID, information about when the access pass was picked up and returned, data collected by the access control system, e.g. doors opened).

With regard to contractors’ representatives, we also process the following personal data:

• Information required to meet the requirement in the construction industry to disclose information to the Tax Administration (name, date of birth, tax number, home country, employment relationship information, residence permit information, address in the home country and in Finland and the supervisor’s name, email address and phone number)
• Information about work-related permits and their validity (on a case-by-case basis, e.g. Occupational Safety Card, hot work permit, first aid card, electrical safety card, forklift operator licence)
• Information about the completion of induction training for contractors (if necessary, the validity of the person’s Hygiene Passport and salmonella certificate is checked).

When a contractor’s representative accesses a Valio production plant for the first time, they are often initially registered as a visitor. This means that the personal data listed above concerning visitors may also be collected about them. Such personal data collected about a contractor’s representative is subject to the same processing practices as personal data concerning visitors.

With regard to visitors and contractors’ representatives, personal data contained in camera surveillance recordings in Valio’s locations will also be processed. The processing practices and storage periods concerning personal data collected through camera surveillance are described in a separate privacy statement.

5. Where do we collect your personal data?

We primarily collect personal data directly from visitors and contractors’ representatives before and during the visit or project. We also collect personal data from the company or employer represented by the person if this is practical and necessary in the situation in question.

In addition, we collect personal data through camera surveillance and access control systems. There are camera surveillance signs in production facilities and areas where the cameras are located.

6. Who processes personal data and to whom do we disclose data?

Personal data is only processed by Valio employees who need such data to perform their duties. Personal data can also be processed by subcontractors working for us and on our behalf (e.g. suppliers of camera surveillance and access control systems and the security company operating in the production plant in question).

We do not regularly transfer personal data to other data controllers. On a case-by-case basis, we may disclose personal data to the authorities if there are legal grounds for doing so.

7. Transfers of personal data outside the EU or the EEA

Valio does not transfer personal data concerning visitors or contractors’ representatives outside the EU or the EEA.

8. How long do we store personal data?

We store visitors’ personal data for six (6) months after the visit, after which the data is deleted or erased securely.

We store personal data concerning contractors’ representatives for a year after the end of the contract. After the storage period, personal data will be erased securely or anonymised to ensure that the contractor’s representative can no longer be identified from the data.

We will store personal data longer to the extent that this is required by mandatory legislation, a legal requirement concerning Valio or a statute of limitations or complaint period based on the law or an agreement. In such a case, we will only store the data required by the legislation or the data required to process a legal claim and will erase any other data.

9. How do we ensure the security of personal data?

We ensure the information security of personal data through appropriate administrative and technological safeguards. We have restricted the processing of personal data to those persons whose duties include the processing of such data. The systems containing personal data can only be accessed using personal user identifiers and passwords issued separately.

10. Rights based on the data protection legislation and their exercise

As data subjects, in accordance with the applicable data protection legislation, visitors and contractors’ representatives have the right to:

• Ask what personal data we process and to get a copy of such data (right of access)
• Require any inaccurate or incorrect personal data to be rectified or updated
• Object to the processing of their personal data to the extent that Valio processes their personal data on the basis of a legitimate interest
• Require their personal data to be erased (right to be forgotten)
• Require the processing of their personal data to be limited (e.g. while the data subject is waiting for a response to a request concerning the rectification of their personal data).

You must submit a request to exercise your rights in accordance with section 2 of this privacy statement.

If you object to the processing of your personal data, you must specify in your request the purpose or purposes of processing that you oppose. In your request, you must also specify the grounds on which you object to the processing of your personal data.

Valio may ask you to verify your identity or further specify your request before implementing your request. Valio may refuse to implement your request on grounds set out in data protection legislation, in which case we will inform you of such grounds.

11. Right to file a complaint with the supervisory authorities

As a data subject, you have the right to file a complaint with the appropriate supervisory authorities if you believe that Valio has not processed your personal data in accordance with the applicable data protection legislation. You can file a complaint with the supervisory authorities in the EU member state where your permanent place of residence or employment is located or where the alleged personal data breach has occurred. In Finland, such complaints are filed with the Office of the Data Protection Ombudsman in accordance with the guidelines provided by the office.