Data protection policy
Eltel processes personal data that it may receive in its dealings with customers, partners, suppliers, contractors and other relevant third parties for, inter alia, HR related purposes, contractual purposes, information purposes, billing purposes, service improvement and marketing purposes.
Personal data may also be processed for other purposes as described herein. This Data Protection Policy will explain what kind of personal data that is processed, the purposes for which the personal data is used, how the personal data is processed and registered persons’ rights in relation to the processing of personal data. All personal data is processed in accordance with this Data Protection Policy and the applicable data protection legislation.
Any questions about how Eltel collects, processes and stores personal data should be directed to local legal Eltel representative in each respective jurisdiction as set out at the end of this policy.
1. Background and purpose
The purpose of this Data Protection Policy is to protect the rights of Eltel´s customers, partners, suppliers, contractors and other relevant third parties with respect to compliance with applicable data protection laws and to provide information on the rights of Eltel, as the data controller.
2. Applicability and scope
The policy is applicable for all entities and all employees within the Eltel Group.
3. Definition of personal data and processing of personal data
The term “personal data” is used to describe any information that may be used to identify, directly or indirectly, a specific individual. Examples of personal data are a person’s first and last name, phone number, personal identity number, address, factors connected to the physical appearance and details of employment , CV, as well as a person’s e-mail address, online username or identifier and IP address.
Processing of personal data is any operation or set of operations which is conducted in relation to personal data, whether or not it occurs by automatic means. Thus, processing include for example collection, recording, storage, adaptation or alteration, retrieval, transferring or otherwise making data available, combining data sets and deletion of data.
4. The personal data processed by Eltel
Eltel processes personal data in order to be able to fulfil its legal and contractual obligations and in order to establish a safe and efficient administration of its business. More specifically, Eltel will only collect and process personal data as described in the below matrix and will only process such personal data to fulfil the purposes stated in the matrix. Personal data must only be processed in accordance with applicable legislation to fulfil the purposes set out in this Data Protection Policy and the matrix.
|
Personal data type and source |
Purpose |
Legal ground |
Retention time or criteria |
|---|---|---|---|
|
Identification details - i.e. name, personal identification number, date of birth and nationality.
Source: From data subject or the data subject's employer |
To enable Eltel to identify the registered person in order to fulfil all contractual obligations |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
To enable Eltel to fulfil all its obligations in relation to the contractual relationship. This includes processing of personal data for invoicing purposes, information/contact purposes, documentation of the services performed, recording transactions and planning and execution of services |
Performance of a contract |
||
|
To enable Eltel to manage an effective protocol in case of emergency situations and crisis management |
Legitimate interest |
||
|
To enable Eltel to conduct credit ratings, ensuring confidentiality of commercially sensitive information and security vetting |
|||
|
To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities |
|||
|
To enable Eltel to publish references on Eltel’s, webpage and in external communication[1] |
|||
|
To enable Eltel to carry out surveys and evaluations in order to plan, organize and manage the services to ensure the quality of work |
|||
|
Contact information - i.e. address, telephone number, e-mail
Source: From data subject or the data subject’s employer |
To enable Eltel to make contact in order to fulfil all obligations in relation to the contractual relationship |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations and for as long as a claim can be raised against Eltel |
|
To enable Eltel to administer and fulfil its obligations under mandatory law and regulatory and corporate governance obligations. This includes providing correct information to relevant authorities such as the tax agency, gathering information in relation to legal proceedings |
Legal obligation |
||
|
To enable Eltel to manage an effective protocol in |
Legitimate interest |
||
|
To enable Eltel to conduct credit ratings, ensuring confidentiality of commercially sensitive information and security vetting |
|||
|
To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities |
|||
|
To enable Eltel to publish references on Eltel’s, webpage and in external communication [1] |
|||
|
To enable Eltel to carry out surveys and evaluations in order to plan, organize and manage the services to ensure the quality of work |
|||
|
HR data – work qualifications, prior work experience, test results,
Source: From data subject or the data subject’s employer |
To enable Eltel to offer and provide services to customer and partners and to participate in procurements |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities |
|||
|
Billing data - i.e. bank details, credit card numbers, and invoice
Source: From contracting party |
To enable Eltel to fulfil all its obligations in relation to the contractual relationship. This includes processing of personal data for invoicing purposes, documentation of the services performed and recording transactions |
Performance of a contract |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel |
|
To maintain accounting records and other economic records for book keeping purposes |
Legal obligation |
||
|
Assignment details - i.e. working time, work tasks, assignments, work description
Source: Eltel
|
To enable Eltel to adapt its organizational structure, workforce management, project time, and to schedule and monitor work time/resource planning |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel. |
|
To enable Eltel to carry out surveys and evaluations in order to plan, organize and manage the services to ensure the quality of work |
|||
|
Communication data - i.e. correspondence with Eltel through
Source: Eltel |
To enable Eltel to ensure correct authorization, clearance and access to facilities and IT-systems and to monitor and ensure compliance with rules communicated regarding allowed use of the IT system and ensuring confidentiality of |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations and for as long as a claim can be raised against Eltel |
|
To enable Elte to administer and maintain the contractual relationship |
Performance of a contract |
||
|
Digital information data - i.e. personal data collected when
Source: Eltel |
To enable Eltel to ensure correct authorization, clearance and access to facilities and IT-systems and to monitor and ensure compliance with rules communicated regarding allowed use of the IT system and ensuring confidentiality of |
Legitimate interest |
During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations and for as long as a claim can be raised against Eltel |
[1] Please note that marketing information will only be disclosed if Eltel has received consent for such disclosure
Eltel will only process personal data for the purposes it was collected and as set out in the matrix. Further processing may occur if it is legal and compatible with the purposes for which the personal data were initially collected. Eltel has taken appropriate technical and organizational measures for the protection of the personal data to ensure that only authorized persons are given access to personal data. The organizational measures taken are e.g. policies, instructions, guidelines regarding the safety and security measures as well as log management and audit trail systems.
5. How the personal data is handled
Eltel may need to provide personal data to relevant authorities (e.g. the tax authority) based on mandatory law and in order to fulfil legal obligations.
Furthermore, due to the fact that Eltel is a part of a group of companies with business activities in several different countries, it will be necessary to transfer personal data to companies in the group outside of the registered person’s own country that need to receive such personal data in order for Eltel to fulfil the purposes as stipulated in the matrix. This will always be subject to assessment according to local legislation or contractual requirements.
The personal data may also be transferred to and processed by companies within the EEA which perform services for Eltel (data processors) in order for such companies to be able to perform the services requested by Eltel. Services which may be requested are, for example, the provision of infrastructure, insurance, administration and IT services. Only personal data that is necessary in order to fulfil such purposes will be provided to such parties. The data processors are obliged to act in accordance with Eltel’s instructions and to implement appropriate technical and organizational measures for the protection of the personal data.
6. Access to information
Personal data will only be available to authorized employees holding a position where it is necessary to process personal data to fulfil his or her tasks. These employees will only be granted access in accordance with the principle of least privilege, and will therefore only have access to personal data that is strictly necessary for the purpose of the processing. Accessibility, confidentiality and integrity of logs containing personal data will always be ensured.
7. Duration of processing and deletion of personal data
Eltel will not store or process personal data for any longer time than what is necessary to fulfil the specific purposes set out in the matrix or otherwise in this Data Protection Policy or according to any mandatory applicable law. Accordingly, when the purpose has been fulfilled in relation to a specific type of personal data, Eltel will delete the relevant personal data as soon as reasonably possible.
8. Rights with regards to the personal data
A registered person has the right to request access to the personal data relating to him or her. The right of access extends to information as to whether or not personal data concerning a person is processed, the relevant personal data being processed and the purpose of such processing. A registered person also have the right to rectify or complete personal data in case the personal data is inaccurate or incomplete.
Erasure of personal data may also be requested if the personal data, inter alia, is no longer necessary in relation to the purposes for which it was collected, if the processing is unlawful or the personal data has to be erased for compliance with a legal obligation in the European Union or in a registered person’s own country to which Eltel is subject. This list is not exhaustive and questions regarding the processing should be directed to Eltel if a registered person would like his/her personal data to be erased. A registered person are also entitled to object to certain processing or request that the processing of the personal data is restricted if the registered person believes that the accuracy of the personal data could be questioned, if the registered person believes that the processing is unlawful or if the registered person believes that Eltel no longer needs the personal data for the purposes as stipulated in the matrix or in this Data Protection Policy.
However, please note that even if a registered person objects to certain processing, Eltel may still need continue such processing of personal data as necessary under applicable legislation, for example to be able to fulfil legal requirements or to fulfil contractual obligations. If a registered person has any complaints on how the personal data is processed, or would like more information in any regard, he/she may contact Eltel. A registered person is also entitled to lodge a complaint regarding the data processing with the relevant supervisory authority, i.e. Datainspektionen (Sweden) – www.datainspektionen.se; Office of the Data Protection Ombudsman (Finland) – www.tietosuoja.fi; Datatilsynet (Norway) – www.datatilsynet.no; Datatilsynet (Denmark) – www.datatilsynet.dk; State Data Protection (Lithuania) – www.vdai.lrv.lt; Bundesdatenschutzbeauftragte (Germany) – www.bfdi.bund.de and The Bureau of the Inspector General for the Protection of Personal Data (Poland) – www.uodo.gov.pl.
A request to exercise individual rights with regards to the processing of personal data shall be sent by email to dataprivacy@eltelnetworks.com
Please note that we may ask a registered person to confirm his/her identity to ensure that we do not disclose personal data to any unauthorized person.
9. Updates to the Data Protection Policy and non-compliance with this Data Protection Policy
In order to ensure compliance with the applicable data protection legislation, as amended from time to time, this policy may be amended by the Eltel at any given time. The applicable Data Protection Policy can always be found on www.eltelgroup.com/data-protection-policy Any breach of the Data Protection Policy shall be reported to Eltel. Any breach of this policy will be taken seriously and may result in necessary actions being taken. Eltel maintains a written plan and process for data protection incident handling.
A registered person should notify the Eltel of any changes of the personal data relating to himself/herself in order to facilitate for an accurate and secure processing of personal data. Please find below a list of all data controllers in the different jurisdictions.
|
Data controller |
Relevant country |
Contact person |
Data controller | Relevant country |
Contact person |
| Eltel AB
|
Sweden |
Legal Manager, Sweden | Eltel Networks Pohjoinen Oy | Finland |
Legal Manager, Finland |
| Eltel Networks TE AB | Sweden |
Legal Manager, Sweden |
Eltel Networks A/S | Denmark |
Legal Manager, Denmark |
| Eltel Netweorks Infranet AB | Sweden |
Legal Manager, Sweden |
Fiber og Anlaeg I/S | Denmark |
Legal Manager, Denmark |
| Eltel Group Oy | Finland |
Legal Manager, Finland |
Eltel Networks AS | Norge |
Legal Manager, Norge |
| Eltel Networks Oy | Finland |
Legal Manager, Finland |
Eltel | Germany |
General Counsel |
| Eltel Networks Poland S.A. | Poland |
Legal Manager, Poland |
Eltel Academy Foundation | Poland |
Legal Manager, Poland |
| Energoprojekt Krakow S.A. | Poland |
Legal Manager, Poland |
Eltel Networks Energetyka S.A. | Poland |
Legal Manager, Poland |
| UAB Eltel Networks | Lithuania |
Legal Manager, Finland |