This privacy statement describes the processing of your personal data if you are insured for an earnings-related pension, you have applied for a pension or rehabilitation benefit, you are a recipient of a pension or rehabilitation benefit, or you are a customer of pension counselling.

Elo’s task is to manage the statutory pension security of employees and entrepreneurs in accordance with the Employees Pensions Act (TyEL) and the Self-Employed Persons’ Pensions Act (YEL). In order to carry out this task, we need to process personal data of insured persons, applicants and recipients of pensions and rehabilitation benefits. We ensure the protection of our customers’ privacy and process their personal data in accordance with currently applicable legislation. This privacy statement describes in more detail the purposes for which Elo processes personal data in insurance and pensions processes and how information is processed.

In order to fulfil our statutory responsibilities, we also process the information of contact persons of pension insurance policyholders, potential customers, service providers and our partners. More information about this personal data processing can be found here. 

Data controller and Data Protection Officer
The data controller for your personal data is Elo Mutual Pension Insurance Company (”Elo”), at Revontulentie 7, 02100 Espoo, p. 020 703 50 (switchboard)

Read more about data protection at Elo or get in contact with our Data Protection Officer:
Sari Läntinen, tietosuoja@elo.fi, p. 020 703 50 (switchboard).

Insured person

The pension security of employees is ensured by TyEL insurance, which employers take on behalf of their employees. Elo processes personal data as part of the tasks to provide statutory pension security for employees. Elo processes the personal data of TyEL insured persons also to determine insurance contributions and to provide pension advice.

The pension security of self-employed persons is managed by YEL insurance. Elo processes personal data of self-employed persons to provide the statutory pension security, to determine insurance contributions, and to provide pension advice. This privacy statement describes the personal data processing of self-employed persons as YEL insured persons. Self-employed persons are also insurance policyholders as they are obligated to take YEL insurance. More information about personal data processing of pension insurance policyholders can be found here. 

The personal data of insured persons is also processed in preparation and delivery of pension records. Where necessary, personal data can also be processed as part of clarification of employment in order to ensure accuracy of the pension insurance.

Applicant or recipient of pension or rehabilitation benefit

The personal data of an applicant for a pension or vocational rehabilitation benefit is processed for the purpose of processing the application and to provide guidance. The personal data of recipient for pension or benefit payment is processed for the purpose of making the payments and to provide pension advice. Information on applicants and recipients of disability payments are also processed in activities related to the maintenance and restoration of persons’ ability to work.

If an applicant or recipient of a pension or rehabilitation benefit has a representative (based on authorisation or trustee), the representative’s information will be processed in the context of the scope of the authorisation.

The information of applicants and recipients of disability pensions and rehabilitation benefits are also processed in development of disability risk model for companies, in management of occupational health risks of companies and in the development of occupational health processes.

Insured persons and applicants or recipients of pension or rehabilitation benefit

The personal data of insured persons and applicants and recipients of pensions or rehabilitation payments are processed to customer service quality assurance and system development. As part of the development of our operations, we also use data collected for the management of statutory insurance and compensation matters for the purpose of conducting analyses on transaction methods, and of evaluating and reporting on the efficiency of our activities and communications. The online services that we offer are personalised to suit the user’s life situation by using the information received in connection with the insurance and pension processing. The information collected about the use of Elo’s website is processed to ensure functionality, analytics, and targeted advertising. More information about the cookies used on our website can be found here.

What personal data do we process about you?

Your personal data is any information that can be linked to you or used to identify you. Elo processes personal data in statutory insurance operations and system development only to the extent that is necessary for the implementation of our designated tasks.

Read more about the purposes of processing, personal data categories and legal bases of processing >

What are the sources of your personal data?

Elo receives personal data of insured persons and applicants or recipients of pensions or rehabilitation benefits directly from the individual, employers of TyEL insured persons, and other sources from which Elo is entitled by law to receive information, for example:

• Finnish Centre for Pensions
• other pension providers
• social insurance institutions, such as Kela (Social Insurance Institution of Finland)
• Finnish Tax Administration
• Centre for Economic Development, Transport and the Environment
• appeal bodies
• healthcare providers
• EU pension institutions
• educational institutions
• enforcement authorities
• Population Information System

Personal data is also collected as a result of Elo’s own operations. Information is also collected from the use of the website and online services.

To whom is your personal data transferred or disclosed?

Information is only disclosed to third parties when the recipient has the right, by law, to receive information from Elo, or in exceptional circumstances upon consent of the data subject.

Elo may disclose information of insured persons, and applicants and recipients of pensions and benefits, by the virtue of law, for example to employer, trustee, Finnish Centre for Pensions and other pension providers, social insurance institutions such as Kela, State Treasury, EU pension institutions, Finnish Tax Administration, employment and social welfare authorities and enforcement authorities.

Elo uses trusted service providers to implement tasks related to the maintenance and support of information systems in pension insurance and pension processes, which process personal data on behalf of Elo. The joint system of employment pension sector, AREK Oy, processes information in the implementation of insurance and pension security. Personal data related to rehabilitation activities are also processed by external service providers. Payment transactions take place through banks operating in Finland, whereby personal data is transferred to the banks.

Will your data be transferred outside Europe?

Elo primarily uses companies located within European Union and European Economic Area as service providers and to implement tasks related to the maintenance and development of information systems. If personal data is transferred outside Europe to a third country, the measures required by the General Data Protection Regulation will be complied with, such as EU standard contractual clauses and appropriate safeguards, such as pseudonymisation.

How long do we retain your data?

We retain your personal data only as long as necessary to fulfil the purposes set out in this privacy statement or in accordance statutory retention periods, after which the data will be deleted.

The necessary documents to manage insurance and to determine insurance contributions are retained for ten years after the end of the contract to fulfil our legal obligations in accordance with the Employee Pensions Act. The necessary income data is retained to calculate pensions as long as necessary to fulfil the tasks of a pension provider. Pension records are prepared from the joint systems of the employment pension sector, and this information is not stored in Elo’s own systems after the pension record has been sent.

Data of applicants and recipients of pensions and benefits is retained for five years from the death of the person in accordance with the retention period set out in the Employee Pensions Act, unless the Accounting Act requires a longer retention period. The application and pension decision information are kept as long as necessary to fulfil the tasks of pension institution. Documents generated in pension counselling are kept for ten years, and customer satisfaction surveys and recordings are kept for one year.

Automated decision-making

By virtue of the Administrative Procedure Act (434/2003), Elo has the right to make automated decisions. We provide automated decisions concerning old age pensions and partial early-old age pensions if the registers can provide such information for the processing of application and pension calculation that are necessary for granting of the pension. One-time increases in pensions are also made automatically. You can apply for a change to the automatically given decision, in which case an Elon expert will handle your rectification request. As a means of ensuring quality, profiling may be utilised to support the making of disability pension decisions. Profiling is not used as the basis of automated decisions.

What are your rights as a data subject?

You have the rights provided by data protection law to the personal data processed at Elo.

• Right to access data: You have the right to know what information Elo is processing about you. You also have the right to receive a copy of the data that is being processed as well as the necessary information related to the data processing.

• Right to rectify information: You have the right to have inaccurate, outdated, or incomplete information about yourself rectified or supplemented.

• Right to deletion of data: You have the right to request the deletion of information concerning you under certain conditions. Personal data may be deleted, for example, if it is no longer needed for the original processing purposes or if you object to the processing of your personal data for direct marketing. Please note that despite of your request, Elo may have to continue processing your information, for example to comply with legal obligations, when it will not be possible to delete the data.

• Right to restrict processing: In certain situations, you have the right to demand that the processing of your personal data is restricted so that Elo only has the right to retain such personal data. You can for example request that the processing of your information is restricted for the period of the investigation, if you consider that the information about you is inaccurate or the accuracy needs to be further investigated.

• Right to request data to be transferred to another system: If the processing of your personal data is based on consent or contract, you have the right to have your data transferred to another data controller. The right of transfer applies to data that you have provided to Elo yourself and that is stored in an electronic information system. If technically possible, data controller must transfer your information directly to another controller.

• Right to object processing: In certain situations, you have the right to object processing of your personal data if the processing is not based on legal obligation or contract.

• Automated decisions, including profiling: You have the right not to be subject of a decision that is based solely on automated processing, such as profiling, which has legal or other significant effects on you.

If you would like to exercise your rights, please submit an identifiable written request to Elo’s Data Protection Officer via email (tietosuoja@elo.fi) or by mailing Elo Mutual Pension Insurance Company, Data Protection Officer, 00041 Elo. Please note that you will need to prove your identity before the request is fulfilled, so please include your up-to-date contact details in the request.

Elo will respond to requests without undue delay, in any case within one month of receipt of the request. The provided information and actions based on the data subjects’ requests are primarily free of charge, unless the requests are manifestly unfounded, unreasonable, or repetitive, in which case Elo may also refuse to fulfil the request on these grounds.

If you suspect that your personal data has been processed in breach of data protection law, you have the right to lodge a complaint with the data protection authority, Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki or www.tietosuoja.fi.