This is a combined register description and informational document to the customers, potential customers and website users of Workplace Nordic, in accordance with the EU General Data Protection Regulation (679/2016), Articles 12 and 13.

DATA CONTROLLER

Workplace Nordic
Sinipiiantie 4, 02400 Kirkkonummi, +358 400 173 924, info(at)workplacenordic.com

Person in charge of the register: Partner Hilkka-Maija Katajisto

Contact person for the register: Systems specialist Tomi Hakala, +358 40 7652534, info@workplacenordic.com

PURPOSE AND REASON FOR PROCESSING PERSONAL DATA (PURPOSE OF THE REGISTER)

Personal data stored in Workplace Nordic’s web service register is used for maintaining and developing customer relations, for marketing purposes, for collecting statistics as well as for providing and offering services. Personal data is processed within the limits permitted and required by the law.

Personal data is being processed on the basis of one or more of the following:

Contract:
The processing of personal data is based on the execution of a service contract.

Legitimate interest:
As regards Workplace Nordic’s customers, the data controller has a legitimate interest in processing personal data in order to enable customer service and maintain customer relationships. As regards Workplace Nordic’s potential customers and website users, the data controller has a legitimate interest in processing personal data delivered via the website in order to handle contact requests, newsletter subscriptions and event enrollments.

Consent:
Processing may also be based on the consent of the data subject to the extent required by law. The data subject always has the right to withdraw his/her consent. Exercise of the right does not affect the lawfulness of the processing carried out prior to the withdrawal of consent.

CONTENT OF THE REGISTER

Data is collected in the register as follows:

Workplace Nordic newsletter and potential customers/website users:
– Email address
– Phone number
– Usage data
– Other information the person may have supplied

Newsletter for those certified by Workplace Nordic and customers:
– Name
– Email address
– Phone number
– Usage data
– Other information the person may have supplied

Enrollment information to events organized by Workplace Nordic:
– Name
– Email address
– Usage data
– Other information the person may have supplied

Workplace Nordic Extranet users:
-Name
-Email address
-Usage data

Workplace Nordic website visitors:
-Usage data

Personality profiling with the WorkPlace Big Five Profile™ tool for the customers for whom Workplace Nordic conducts personality profiling:
– Name
– Email address
– Demographic background information: optional information such as age, gender, nationality, place of residence, job title
– Profiling: selectable answers to multiple choice questions mapping personality
– This personality profiling can also be done using a cover name. In that case no name, email or any other identifiable information is saved in the system.

Measuring emotional intelligence with the EQ-i 2.0® tool for the customers for whom Workplace Nordic conducts measuring emotional intelligence:
– Name
– Email address
– Demographic background information: optional information such as gender, job title
– Measuring Emotional intelligence: selectable answers to multiple choice questions.
– This measuring can also be done using a cover name. In that case no name, email or any other identifiable information is saved in the system.

Workplace Nordic 360° -assessment using the Workplace Nordic 360° assessment tool:
– Name
– Email address
– Answers to questionnaire

Emergy® Emotional Climat Audit:
– Name
– Email
– Answers to questionnaires

Conflict situations and emotional temperament team simulation
-Name
-Email address
-Answers to simulation questions

HumanLab Academy -Digital learning platform
-Name
-Email address
– Usage data
-Answers to questionnaires

Maslach Burnout Toolkit™:
– Name
– Email
– Answers to questionnaire
– Identification information is not shared outside of Workplace Nordic

REGULAR SOURCES OF INFORMATION

The personal data collected by the data controller includes only the aforementioned data that the person consents to give when using Workplace Nordic’s website and services or in person, on the phone, by email or via other online tools.

PROTECTING THE REGISTER AND HANDING OUT OR TRANSFERRING DATA OUTSIDE THE EU OR THE EUROPEAN ECONOMIC AREA

The data is collected into databases, which are protected by firewalls, passwords and other technical means. The databases are located in locked and guarded premises, and the information is accessible only to specific, designated persons. Employees processing the data in the register are bound by a confidentiality obligation.
Workplace Nordic does not hand out the data in the register to external parties. We have ensured that all service providers we use who are involved in processing the personal data (MailChimp https://mailchimp.com/legal/privacy/, Google https://policies.google.com/privacy, Accountor Finago Oy https://finago.com/en/general-use-and-customer-agreement-terms/, Paradigm Personality Labs, LLC http://paradigmpersonality.com/privacy-policy/, Multi-Health Systems, Inc. (MHS) https://www.mhs.com/Privacy-Policy, SurveyHero https://www.surveyhero.com/privacy?ref=footer-menus, Leadpages (US), Inc. https://www.leadpages.com/privacy, WebinarJam  https://www.genesisdigital.co/_legal/privacypolicy.php, Smoothteam https://smoothteam.fi/rekisteriseloste-pelialusta/, HumanLab Academy https://www.humanlabacademy.com/rekisteri-ja-tietosuojaseloste/, Digitoimisto ACQUA Tmi https://acqua.fi/tietosuojaseloste/ and Accounting Rocks Oy https://www.accountingrocks.fi/tietosuojaseloste/) comply with data privacy legislation.

We use a U.S.-based MailChimp email service for sending newsletters and for event enrollments, which means that personal data is transferred outside the European Union. Personal data is, however, protected in compliance with the Personal Data Act. We have incorporated the EU’s Standard Contractual Clauses in our Data Processing Addendum with Mailchimp. Read more about MailChimp’s privacy protection: https://mailchimp.com/legal/privacy/. Personal data on a registered user is erased upon the user’s request. The request may be emailed to info(at)workplacenordic.com, or the user can opt out of the mailing list. A link to do this is included in every newsletter.

WorkPlace Big Five Profile™ personality profiling is conducted using the My Paradigm Dashboard, which is the property of Paradigm Personality Labs, LLC. Paradigm Personality Labs is a U.S.-based company, which means that personal data is transferred outside the European Union. Personal data is, however, protected in compliance with the Personal Data Act. We have incorporated the EU’s Standard Contractual Clauses in our Data Processing Addendum with Paradigm Personality Labs. Read more about the privacy protection in the MyParadigm System: (http://paradigmpersonality.com/privacy-policy/). Personal data (name and email address) is erased from the MyParadigm System upon request. The request may be emailed to: info(at)workplacenordic.com. This personality profiling can also be done anonymously, in which case no personal data will be stored.

EQ-i 2.0® emotional intelligence measuring is conducted using the MHS Talent Assessment Portal, which is the property of Multi-Health Systems, Inc. (MHS). MHS is a Canada-based company, which means that personal data is transferred outside the European Union. Personal data is, however, protected in compliance with the Personal Data Act, as firstly the European Commission has recognized Canada (commercial organizations) as providing an adequate level of data protection and secondly, as when the data in connection with measuring emotional intelligence is being transmitted and stored on private servers in the United States, MHS’s cloud-service provider Rackspace US, Inc. is commited to handling your personal data according to EU comission approved standard contractual clauses (SCC). Read more about the MHS privacy protection: https://www.mhs.com/Privacy-Policy and https://www.mhs.com/Security-policy. Personal data (name and email address) is erased from the MHS Talent Assessment Portal upon request. The request may be emailed to: info(at)workplacenordic.com. This emotional intelligence measuring can also be done anonymously, in which case no personal data will be stored.

Workplace Nordic 360° assessment uses the SurveyHero platform to collect responses, provided by enuvo GmbH. enuvo GmbH is a Swiss company, which means that personal data is transferred outside the European Union. However, the personal data is protected as required by the Personal Data Protection Act. The EU Commission has recognised the level of data protection in Switzerland as adequate and we are also contractually committed to ensuring that the processing and transfer of our users’ data is in compliance with the EU General Data Protection Regulation. Read more about SurveyHero’s privacy policy: (https://www.surveyhero.com/privacy). Requests to amend or delete personal data can be sent to info@workplacenordic.com. 

Emergy® Emotional Climate Audit uses the SurveyHero platform to collect responses, provided by enuvo GmbH. enuvo GmbH is a Swiss company, which means that personal data is transferred outside the European Union. However, the personal data is protected as required by the Personal Data Protection Act. The EU Commission has recognised the level of data protection in Switzerland as adequate and we are also contractually committed to ensuring that the processing and transfer of our users’ data is in compliance with the EU General Data Protection Regulation. Read more about SurveyHero’s privacy policy: (https://www.surveyhero.com/privacy). Requests to amend or delete personal data can be sent to info@workplacenordic.com. 

The Maslach Burnout Toolkit™ uses the Mind Garden Inc. Transform system to assess burnout risk factors. Mind Garden Inc. is a US company. Personal data is not transferred or processed in Mind Garden’s system, but all reports are produced under pseudonyms. In this case, personal data will not be transferred to the United States. Read more about the privacy protection of Mind Garden’s system: (https://www.mindgarden.com/content/22-privacy). Personal data (name and email address) are collected, if necessary, in Workplace Nordic’s customer register, where they are processed as required by personal data laws.

If any material is printed from the register, which is stored in databases, the material is stored in a locked room, and only the data controller is authorized to use it. When the material is no longer needed, it will be destroyed.

DURATION OF PROCESSING DATA

The duration of processing personal data is open-ended; data is processed for as long as it is needed in order to handle a customer relationship (current or potential), event marketing, personality profiling, measuring emotional intelligence or other specified purpose for which the data is stored. We store the data in the register in the form received from the data subject, and we correct and erase the data in accordance with the data subject’s request. The recipient can opt out of the newsletter mailing list via a link that is included in every newsletter we send.

RIGHTS OF DATA SUBJECT

The data subject’s rights are listed in the following. If the data subject wishes to exercise the rights, a request may be sent to info(at)workplacenordic.com.

Right of access

The data subject has a right to check the registered personal data concerning him or her and to obtain a copy of the data. If the data is inaccurate or incomplete, please send a request to Workplace Nordic for correcting or completing the data.

Right to object

The data subject has a right to object to processing of personal data, if he or she feels that the data have been unlawfully processed.

A right to prevent direct marketing

The data subject has a right to prevent their personal data being processed for direct marketing. We never sell or share personal data to external parties for them to target direct marketing to the data subject.

Right to erasure

The data subjects have a right to request the erasure of the data concerning them, if they feel the data processing is not necessary. We will review the request, after which we will either erase the data or give a justified reason for why the data cannot be erased.

Users can opt out of the mailing list. A link to do this is included in every newsletter.

In accordance with the Accounting Act (Chapter 2, Section 10), the data controller is obliged to retain accounting records for ten years. For this reason, accounting records cannot be erased before the expiry of the period.

The data subject may lodge a complaint on the decision to the data protection ombudsman: instructions for lodging a complaint.

The data subject has a right to request us to restrict the processing of contested data until the issue is solved.

Right to complain

If a data subject feels that our processing of personal data breaches the in force legislation on data privacy, he or she has a right to lodge a complaint to the data protection ombudsman (instructions for lodging a complaint)

USE OF COOKIES

A cookie is a small text file that is stored on a user’s device by an Internet browser. Cookies are set on the user’s terminal only with the site the user invites. Only the server that sent the cookie can later read and use the cookie. Cookies or other technologies do not damage the user’s terminal or files, and cannot be used to access programs or spread malware. The user cannot be identified by cookies alone.

We store the following types of essential cookies when a user visits a website:

• Cookies to improve security
• Cookies necessary for the operation of the website

We store the following types of cookies if the user has accepted the use of cookies (by pressing the I accept cookies button):

• Cookies that enable automation of third-party marketing
• Analytics cookies
• Language choices

We use cookie-based Google Analytics to improve and evaluate the use of our website. In this context, Analytics compiles standard site usage reports. Cookies are used to collect information about the usage habits of website users, such as which pages a user visits and how long they are on the site. Workplace Nordic uses information obtained from cookies to compile statistics on the use of the services. In addition, cookies can be used to target and measure marketing. Learn more about the privacy and security of Google Analytics and Google’s privacy practices and policies.