This privacy statement describes the processing of your personal data if you are a contact person or representative of a loan customer or its group company, investment target company, management company, fund management company or a service provider, contact person of a commercial property tenant, or a buyer or seller of a real estate transaction. We ensure the protection of privacy and process personal data always in accordance with currently applicable legislation and regulations. This privacy statement describes in more detail how Elo processes personal data in its investment operations.

Data controller and Data Protection Officer
The data controller for your personal data is Elo Mutual Pension Insurance Company (”Elo”), at Revontulentie 7, 02100 Espoo, p. 020 703 50 (switchboard)

Read more about data protection at Elo or get in contact with our Data Protection Officer:
Sari Läntinen, tietosuoja@elo.fi, p. 020 703 50 (switchboard).

The processing of personal data in investment operations is mainly related to the analysis of investment objectives and loan customers, as well as implementation and management of investments (including risk management) and communication. We process the information obtained in connection with the analysis of potential investment objectives and loan customers on the basis of legitimate interest. After the implementation of the investment, the personal data of the contact person of a target company, management company, fund management company and loan customer or its group company is processed on the basis of a contract. In addition, the purpose of processing personal data is to comply with legislative requirements and instructions of authorities in relation to investment activities.

We use service providers to enable our investment operations. We process the personal data of contact persons and representatives of service providers in order to enable provision of services, communication and in identification of business partners. The provision of services is based on an agreement with the service provider and the identification a business partner is our legal obligation. We also keep in contact with service providers for possible future cooperation, in which case processing of the information for the contact persons is based on legitimate interest.

What personal data do we process about you?

Your personal data is any information that can be linked to you or used to identify you. The personal data processed in investment operations are mainly name, position and contact details of contact persons in companies and organisations, and personal data of responsible persons and owners. Other personal data can be also processed for identification of business partner, exploring financing opportunities and tracking of investment targets.

Read more about the purposes of processing, personal data categories and legal bases of processing >

What are the sources of your personal data?

Elo receives personal data primarily directly from the data subject, customer organisations and contracting parties, partners and service providers. Information is also obtained from investment-related materials and documents, as well as other partially public sources of information, such as Suomen Asiakastieto Oy, Finnish Patent and Registration Office and the corresponding foreign registration authorities, and the Dow Jones Risk and Compliance system.

To whom is your personal data transferred or disclosed?

Information is only disclosed to third parties when the recipient has the right, by law, to receive information from Elo, or in exceptional circumstances upon consent of the data subject. Elo may on these grounds disclose information to authorities, such as police, competition authority or Finnish Financial Supervisory Authority. Elo may also disclose information to KTI Kiinteistötieto Oy for conducting market research in the real estate business.

Elo also uses service providers in its investment operations and support tasks, which process personal data on behalf of Elo. These are real estate agents, real estate managers, advisory and brokerage firms, legal and tax service providers, providers of investment services and funds, and maintenance of online and information systems.

Will your data be transferred outside Europe?

The personal data processed in investment operations is not transferred outside European Union or European Economic Area on a regular basis.

How long do we retain your data?

We retain your personal data only as long as necessary to fulfil the purposes set out in this privacy statement or in accordance statutory retention periods, after which the data will be deleted. The retention periods in investment operations are generally 10 years from the end of the contract, unless the legislation sets out a longer retention period. If the processing is not based on a contract, and the legislation does not provide for another retention period, Elo retains personal data as long as there is a valid legal basis and the personal data is necessary for the purposes of processing.

What are your rights as a data subject?

You have the rights provided by data protection law to the personal data processed at Elo.

• Right to access data: You have the right to know what information Elo is processing about you. You also have the right to receive a copy of the data that is being processed as well as the necessary information related to the data processing.

• Right to rectify information: You have the right to have inaccurate, outdated, or incomplete information about yourself rectified or supplemented.

• Right to deletion of data: You have the right to request the deletion of information concerning you under certain conditions. Personal data may be deleted, for example, if it is no longer needed for the original processing purposes or if you object to the processing of your personal data for direct marketing. Please note that despite of your request, Elo may have to continue processing your information, for example to comply with legal obligations, when it will not be possible to delete the data.

• Right to restrict processing: In certain situations, you have the right to demand that the processing of your personal data is restricted so that Elo only has the right to retain such personal data. You can for example request that the processing of your information is restricted for the period of the investigation, if you consider that the information about you is inaccurate or the accuracy needs to be further investigated.

• Right to request data to be transferred to another system: If the processing of your personal data is based on consent or contract, you have the right to have your data transferred to another data controller. The right of transfer applies to data that you have provided to Elo yourself and that is stored in an electronic information system. If technically possible, data controller must transfer your information directly to another controller.

• Right to object processing: In certain situations, you have the right to object processing of your personal data if the processing is not based on legal obligation or contract.

• Automated decisions, including profiling: You have the right not to be subject of a decision that is based solely on automated processing, such as profiling, which has legal or other significant effects on you.

If you would like to exercise your rights, please submit an identifiable written request to Elo’s Data Protection Officer via email (tietosuoja@elo.fi) or by mailing Elo Mutual Pension Insurance Company, Data Protection Officer, 00041 Elo. Please note that you will need to prove your identity before the request is fulfilled, so please include your up-to-date contact details in the request.

Elo will respond to requests without undue delay, in any case within one month of receipt of the request. The provided information and actions based on the data subjects’ requests are primarily free of charge, unless the requests are manifestly unfounded, unreasonable, or repetitive, in which case Elo may also refuse to fulfil the request on these grounds.

If you suspect that your personal data has been processed in breach of data protection law, you have the right to lodge a complaint with the data protection authority, Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki or www.tietosuoja.fi.