Privacy notice for Valmet Automotive’s processing of personal data related to VApp employee communication application

Privacy statement

Valmet Automotive Oyj (“Valmet Automotive”) is committed to protecting your privacy and processes your personal data in accordance with good data processing practice and applicable laws and regulations. We adhere to continuously improving our operations and carry out regular risk management measures to ensure data security.

Who is the data controller and how can you contact us?

The data controller is Valmet Automotive Oyj.

Valmet Automotive uses the VApp mobile communication application provided by SuperApp Oy for employee communications. SuperApp Oy processes personal data on behalf of Valmet Automotive as a service provider under a valid data processing agreement.

In case of questions, you may contact Valmet Automotive’s HR department or privacy@valmet-automotive.com, from where you will receive further information about VApp and processing of personal data.

Contact details for Valmet Automotive’s head office are:

PO Box 4
Autotehtaankatu 14
FI-23501 Uusikaupunki, Finland
Tel. +358 20 484 8111 (Switchboard)

Data security and processing principles

• We only collect necessary personal data for predefined purposes and we do not disclose your personal data to third parties without a proper data processing agreement signed by both parties.
• As a data subject, you are informed of how your data is processed. For VApp, personal data originates from Valmet Automotive’s internal employee data sources.
• Before processing personal data, we determine whether and to what extent the processing is necessary to achieve the predefined purpose.
• All personal data has a lifecycle and processing activities are defined in all phases. When personal data comes to the end of its lifecycle, it is deleted in an appropriate manner.
• We strive to ensure that personal data is correct, complete and kept up to date.
• All personal data are classified within Valmet Automotive and secured with appropriate security measures.
• We do not make automated decisions based on your personal data.

What personal data is collected and why?

We only collect personal data for predefined purposes. We do not collect any excess personal data that is not necessary to fulfil the predefined purposes. If the predefined purposes cease to exist, we delete the respective personal data.

With respect to VApp, our purposes to collect and process personal data are:

• Maintaining VApp user accounts and enabling employees to access the VApp mobile communication application.
• Distributing company news, announcements and other business-related information to employees.
• Enabling targeted internal communications by organization.

The processing is based on the following legal grounds:

• The processing is based on Valmet Automotive’s legitimate interest in ensuring efficient, timely and targeted internal employee communications, maintaining up-to-date VApp user accounts and distributing business-related information to employees through an appropriate communication channel.

The personal data involves the following categories of data subjects:

• Valmet Automotive employees

Personal data are collected from the following sources:

• Personal data originates from Valmet Automotive’s internal employee data sources.
• The data is transferred to VApp on a weekly basis for user account maintenance and targeted internal communications.

The collected data includes the following:

• Employee ID
• First name and last name
• Organization

How long will your data be stored?

The retention time for the personal data in VApp is linked to the duration of the employment relationship with Valmet Automotive.

User data is kept up to date through regular weekly updates and is deleted or otherwise removed when the employment relationship ends or when VApp access is no longer required, unless longer retention is required by applicable law or necessary for the establishment, exercise or defence of legal claims or for security-related log purposes.

Destruction of personal data will be made as required by applicable legislation and in accordance with the policies of Valmet Automotive that are applicable at that time.

Who processes your data and where is it transferred?

The data processors process personal data on behalf of us and under our instructions and only under a valid data processing agreement. The processors are never allowed to process personal data for their own purposes. We expect the processors to ensure the same level of security as we provide for our own processing activities.

We use SuperApp Oy as the data processor for VApp. SuperApp Oy processes personal data only on behalf of Valmet Automotive and under Valmet Automotive’s documented instructions.

Personal data processed in VApp is not transferred outside the EU/EEA.

How is your data protected?

Access to personal data in VApp is restricted to authorized personnel based on role-based access controls. Personal data is protected through secure data transfers, data minimisation, confidentiality obligations, incident and breach management procedures, contractual data protection safeguards, and controls. The processed data is limited to the minimum necessary data required for user account maintenance and targeted internal communications.

Technical and organisational safeguards include measures to ensure confidentiality, integrity, availability, transparency and the exercise of data subject rights. Weekly updates support the accuracy of user account information, and the processing is subject to purpose limitation and contractual safeguards with SuperApp Oy.

How can you exercise your data subject rights?

You have the right to request the fulfilment of your data subject rights at any time. Your data subject rights include the following, subject to the conditions and limitations set out in applicable data protection legislation:

• Right of access to your personal data;
• Right to rectification of inaccurate or incomplete personal data;
• Right to erasure of personal data, where applicable;
• Right to restriction of processing, where applicable; and
• Right to object to the processing, where applicable.

All data subject right requests should be made by email to Valmet Automotive’s HR department or privacy@valmet-automotive.com.

All requests related to data subject rights will be handled in accordance with applicable legislation.

The right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a competent supervisory authority. In Finland, the supervisory authority is the Finnish Data Protection Ombudsman. A complaint may also be lodged with a supervisory authority in the EU Member State where you are habitually resident, where you work or where the alleged infringement of applicable data protection laws and regulations has taken place.