This version is written in accordance with the EU General Data Protection Regulation (679/2016).
Lumo Energia Oyj
Business id: 2701773-4
Adress: Teollisuuskatu 21, 00510 Helsinki
P. 09 4272 0444
E-mail: [email protected]
Data Protection Officer
P. 041 366 5277
E-mail: [email protected]
Name of the personal register
Lumo Energia's customer register
Grounds and purpose of the processing of personal data
The legal basis for the processing of personal data is:
- Consent of the data subject to the processing of personal data
- The contractual relationship between the data subject and the controller
- Fulfillment of the controller's legal obligations
- Legitimate interest of the controller
The purpose of the use of personal data is:
- Managing and developing the customer relationship between the company and customers
- Maintenance, provision, development and delivery of products and services
- Marketing of products and services
- Control and collection of payments
- Utilization of call recordings in the development of customer service
Legal sources of information
The information entered in the personal register is obtained from the registrant himself.
Personal data to be processed
Personal data to be processed:
- Date of birth
- Mother tongue
- Contacts: phone number, email address and home address
- Direct Marketing Authorization
- Calls recorded by customer service
- Information related to the use of customer services
- Information related to the customer's payment behavior
- Energy application information
- Energy consumption data
Disclosure of personal data
Personal data is not regularly disclosed. Therefore, personal data will also not be transferred outside the EU and the EEA.
However, the information may be disclosed to the authorities, for example, based on a legal requirement.
Protection of personal data
The personal data is collected in databases that are protected by firewalls, passwords and other technical methods. Only Lumo Energias's employees or its subcontractors, who need the information in their duties, are entitled to use it. Each authorized user has their own username and password for the system and commits to keeping the customer information confidential.
Your personal data is not used for profiling nor to make decisions based on automated processing.
Your rights and how to exercise them
Right to access to personal data
You have the right to receive confirmation as to whether personal data concerning you are being processed and, if so, the right to receive a copy of your personal data.
Right to correct personal data
You have the right to request that inaccurate and incorrect personal data concerning you be corrected.
You also have the right to have incomplete personal data supplemented by providing the necessary additional information.
Right to deletion
You have the right to request the deletion of personal data concerning you if:
a. your personal data are no longer required for the purposes for which they were collected;
b. you withdraw the consent on which the processing of personal data is based and there is no other legal basis for the processing; or
c. your personal data has been processed unlawfully.
Right to restrict processing
You have the right to restrict the processing of your personal data if:
a. you dispute the accuracy of your personal data;
b. the processing is unlawful, and you oppose the deletion of your personal data and instead requests that their use be restricted; or
c. the controller no longer needs personal data for the original purposes of the processing, but you need them for the establishment, exercise or defense of legal claims.
Right to object to the processing
You have the right at any time to object to the processing of your personal data on the basis of your particular situation.
The controller shall no longer process your personal data unless the controller can demonstrate that there is a compelling and justified reason for the processing which overrides your interests, rights and freedoms, or is necessary for the establishment, exercise or defense of legal claims.
If personal data are processed for direct marketing, you have the right at any time to object to the processing of personal data concerning you for such marketing, including profiling in connection with such direct marketing.
Right to withdraw your consent
You shall have the right to withdraw your consent to the processing at any time, without prejudice to the lawfulness of the processing carried out on the basis of that consent.
Right to data portability
You have the right to have personal data concerning you supplied to you on paper, electronically in a commonly used file format or verbally and to transfer such data to another controller.
Right to appeal to the supervisory authority
The national supervisory authority for personal data matters is the Office of the Data Protection Ombudsman acting in connection with the Ministry of Justice.
You have the right to refer the matter to the supervisory authority if you consider that the processing of personal data concerning you violates the relevant legislation.
In all matters related to the processing of personal data and in situations related to the exercise of one's own rights, you should contact the Data Protection Officer.