Created: 1 December 2022
1. Joint controllers
Business ID 0593027-4
Telephone: +358 (0)20 703 2000
All joint controllers of the register can be found on the Group’s website at https://administergroup.com/administer-konserni-yhtiolistaus/.
2. Contact person for the data file
The contact person for questions regarding the processing of Data Subjects’ personal data and the exercise of Data Subjects’ rights is the group’s Data Protection Officer Anja Hänninen.
Tel. +358 (0)40 5220 621
Administer Oyj/Tietosuoja, Itämerenkatu 5, 00180 Helsinki.
3. Name of the data file
Administer money laundering data file.
4. The persons whose data we collect
The money laundering data file is used to process the personal data of Administer’s current and potential new Customers, their contact persons, the actual beneficial owners of Customer companies, the board of directors or members of similar decision-making bodies, the CEO and the Customer’s and/or their actual beneficial owner’s family members and/or company partners (“Data Subject”) to the extent required by statutes regarding money laundering.
5. The kinds of data we collect
The money laundering data file processes the following data in accordance with the Act on Preventing Money Laundering and Terrorist Financing (444/2017; “Money Laundering Act”):
- The Customer’s name, date of birth and personal identity code
- the representative’s name, date of birth and personal identity code;
- the actual beneficial owner’s name, date of birth and personal identity code;
- the legal person’s full name, registration number, date of registration and registration authority;
- the full names, dates of birth and nationalities of the legal person’s board of directors or similar decision-making body;
- the legal person’s line of business;
- contact information (postal address, e-mail address and phone number);
- the name, number or other identifier of a document used to verify identity or a copy of the document or, in the case of non-face-to-face identification for the Customer, data on the procedure or sources used in verification; (approved documents for identity verification include a passport, personal identity card, driver’s licence and a Kela photocard);
- information on the Customer’s activities, nature and extent of business, financial standing, grounds for use of transaction or service and information on source of funds as well as the other necessary information that is referred to in section 4, subsection 1 of the Money Laundering Act and is acquired for the purpose of Customer due diligence;
- the necessary information acquired in order to fulfil the obligation to obtain information regarding the source of funds provided in section 4, subsection 3 of the Money Laundering Act, and the enhanced Customer due diligence obligation relating to politically exposed persons provided in section 13;
- for foreign Customers who do not have a Finnish personal identity code, information on the Customer’s nationality, a personal identity card granted by an EEA authority and travel document information.
6. The basis and purpose of processing personal data
The processing of personal data is based on Administer’s duty to fulfill its legal obligations.
According to chapter 3, section 3 of the Money Laundering Act, the Customer’s due diligence data and other personal data is saved, stored and may be used to prevent, detect and investigate money laundering and terrorist financing and such crimes as were committed to gain the assets or proceeds of crime subject to money laundering or terrorist financing. Customer due diligence data and other personal data obtained solely for the purpose of preventing and detecting money laundering and terrorist financing may not be used for purposes incompatible with this purpose.
7. Regular sources of data
Personal data are collected to the money laundering data file primarily from public sources of information, such as trade and other similar registers and the Internet. Personal data are also collected directly from the Customer / the Customer’s contact person.
8. Disclosures and transfer of data
We disclose personal data to the extent permitted and required by legislation. Data may be disclosed to the Finnish National Bureau of Investigation’s Financial Intelligence Unit according to mandatory legislation.
Administer may partially outsource the processing of personal data to service providers, such as IT service providers. When personal data processing is outsourced, Administer ensures that the processing of personal data complies with legislation through sufficient contractual obligations.
Administer does not regularly transfer personal data outside the EU or EEA. However, data may be transferred or disclosed outside the EU or EEA in accordance with what is permitted by Data Protection Legislation if the data are transferred to a country where the European Commission has determined that the level of data protection is adequate or if contractual arrangements can ensure an adequate level of data protection. Transfers outside the EU may temporarily occur when using different cloud services, such as OneDrive, iCloud or Dropbox.
9. Storage period of personal data
The Customer’s personal data are stored in the money laundering data file for as long as the Customer and commissioning relationship is valid. The data relevant to the Money Laundering Act is stored for five (5) years after the Customer and commissioning relationship has ended, unless the personal data in question needs to be stored for a longer period due to criminal investigation or a pending trial or to secure the rights of the controller or a party in the controller’s service. In such cases, the need to continue storing data and documents is reviewed at least three (3) years after the last time that the need for storage was reviewed. The review and its date are logged.
10. Protection of personal data
The personal data in the data file are protected in the manner required by the relevant legislation, with due consideration for data security. Administer has taken appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, disclosure, misuse, alteration, destruction or unauthorised access. The security measures are updated in accordance with the continuous development of technology. Data is protected by firewalls and various encryption techniques, in addition to which the server rooms selected for use are secure and subject to appropriate access control. The data in the systems are backed up regularly.
The employees involved in the processing of personal data have signed a data security and data protection commitment and received the necessary instructions and training for the processing of personal data. The data files containing personal data are located in locked facilities, and the data can only be accessed by certain designated persons. Manual materials are stored in locked facilities, and digitally-processed personal data are protected with access right restrictions. All the used data resources are logged into with personal usernames and passwords. The access rights to personal data involve different levels of access and the granting and use of access rights is supervised by business unit.
11. The rights of the Data Subject
As an exception to what is stated above, the Data Subject does not have the right to inspect the data acquired to fulfil the Money Laundering Act’s reporting obligation and obligation obtain information (Money Laundering Act, chapter 4, section 3). However, the Data Protection Officer may investigate whether the processing of these data complies with legislation at the Data Subject’s request.
The Data Subject has the right to lodge a complaint with a supervisory authority if they are of the opinion that the processing of their personal data violates the Data Protection Legislation. A notification of a fault in the processing of personal data can be submitted on the Office of the Data Protection Ombudsman website: https://tietosuoja.fi/ilmoitus-epakohdasta-henkilotietojen-kasittelyssa.
12. Profiling and automatic decision-making
Administer does not carry out profiling targeting the Customer based on the personal data or use automatic decision-making.