Record of personal data processing in the Positive credit register and in customer service

Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Articles 12 to 14

The Positive credit register is a national register that contains credit information, and its purpose is to ensure the availability of credit information for purposes laid down in the Act on the Positive Credit Register (739/2022).

The controller of the register is the Finnish Tax Administration’s Incomes Register Unit. However, the Incomes Register Unit is a joint controller with the Tax Administration regarding the technical maintenance, functionality, information security and development of the Positive credit register’s information system. The Incomes Register Unit is responsible for receiving, keeping and disclosing personal data and associated credit and other information, and for the controller’s other obligations and the execution of the data subject’s rights under the General Data Protection Regulation.

The Positive credit register processes the identifying and contact information of natural persons, the personal data of contact persons reported by business operators, the personal data and recorded phone calls collected in customer service, and the personal data collected with observation and feedback forms on the Positive credit register’s website.

Controller	The Finnish Tax Administration’s Incomes Register Unit P.O. Box 325, FI-00052 VERO Visiting address: Vääksyntie 4, Helsinki
Processors	The cloud platform is provided by Microsoft. The certificate service is provided by Digia Plc. The operational services of the customer relationship management system are provided by Tietoevry Corporation. The following operators are involved in the provision of application management services: Innofactor Software Ltd, Gofore Plc, Gofore Verify Oy and Advania Finland Oy. Application management processes personal data in a service management system provided by ServiceNow. The digitisation services are provided by Posti Messaging Oy. The call system is provided by Elisa Corporation.
The Tax Administration’s Data Protection Officer	Noora Kontro Hanna-Mari Korva P.O. Box 325, FI-00052 VERO National telephone switchboard: 029 512 000
Data subjects	1) Population Information System data Data subjects are Finnish citizens and foreign nationals residing in Finland and entered in the Population Information System. 2) Business Information System data Data subjects are private traders entered in the Business Information System. 3) Elinkeinonharjoittajien yhteyshenkilöiden tiedot Data subjects are contact persons specified by business operators. After a business has signed up for the Positive credit register as a data notifier, they can specify the following contact persons: contact person for sign-up contact person for content contact person for technical matters technical contact person for certificates When a business applies for a data permission for the Positive credit register from the Incomes Register Unit, they can specify the following contact persons: contact person for data permission application contact person for content contact person for technical matters technical contact person for certificates person responsible for information security person responsible for data protection contact person for invoicing In addition, the notification address provided by the business operator may include personal data. 4) Personal data collected in customer service Data subjects are persons who have contacted the Positive credit register’s customer service. 5) Personal data collected with observation and feedback forms Data subjects are persons who have submitted an observation form or a feedback form available on the Positive credit register’s website.
Personal data subject to processing	1) Population Information System data The Positive credit register processes the following personal data: name identifying information, such as a Finnish personal identity code or a foreign personal ID addresses non-disclosure order for personal safety reasons mother tongue and contact language The data has been received from the Incomes Information System and shared with the Positive credit register under section 13 a of the act on the Incomes Information System (Laki tulotietojärjestelmästä 53/2018). The Incomes Information System has received the data from the Population Information System. The Incomes Register Unit has the right to update the data from the Population Information System and to check a natural person’s personal data in order to verify their accuracy. 2) Business Information System data The Positive credit register processes the following personal data: identifying information (Business ID and personal identity code) addresses contact language The data has been received from the Incomes Information System and shared with the Positive credit register under section 13 a of the act on the Incomes Information System (Laki tulotietojärjestelmästä 53/2018). The Incomes Information System has received the data from the Business Information System. The Incomes Register Unit has the right to update and check the Positive credit register’s data on a party with the reporting obligation in the Trade Register and the Business Information System. 3) Contact information of contact persons for businesses The Positive credit register processes the following personal data on contact persons: name phone number address invoice address email address The data has been received from business operators that have signed up for the Positive credit register as data notifiers, applied for a data permission for the Positive credit register from the Incomes Register Unit, or updated the contact information of contact persons after signing up or submitting a data permission application. 4) Personal data collected in customer service Contacts to customer service are recorded in the Positive credit register if the customer is identified and the customer’s matter requires further investigation. In this connection, the Positive credit register may process the customer's identifying and contact information, and other information necessary for investigating the matter, such as a description of the matter. The data has been received from persons who have contacted the Positive credit register’s customer service. The calls to the Positive credit register’s customer service are recorded. The data saved on a call includes the start and end time, the caller's number, the name of the person who answered the call, and a recording of the call. At the beginning of the call, the customer is notified that the call will be recorded. 5) Personal data collected with observation and feedback forms The Positive credit register processes the following personal data: name organisation Business ID email address phone number The data has been received from persons who have submitted an observation form or a feedback form available on the Positive credit register’s website.
Purpose of the processing of personal data	1) Population Information System data The purpose of the processing is to ensure that the data in the Positive credit register is correct, and to perform the other tasks of the Tax Administration’s Incomes Register Unit under the Act on the Positive Credit Register. 2) Business Information System data The purpose of the processing is to ensure that the data in the Positive credit register is correct, and to perform the other tasks of the Tax Administration’s Incomes Register Unit under the Act on the Positive Credit Register. 3) Elinkeinonharjoittajien yhteyshenkilöiden tiedot The purpose of the processing is to make decisions on sign-up requests and data permission applications, attend to communications regarding the reporting of data to the Positive credit register and the use of the register’s data, to invoice the credit register extracts, and to perform activities relating to API connections. 4) Personal data collected in customer service The purpose of the processing is to advise customers, investigate errors and respond to feedback. Call recordings are used to verify the content of the calls afterwards and to ensure the quality of customer service. 5) Personal data collected with observation and feedback forms The purpose of the processing is to process the observations and respond to feedback.
Legal basis of the processing of personal data	The processing of the Population Information System and Business Information System data and of the data on business operators’ contact persons is based on the following legal provisions: EU General Data Protection Regulation (2016/679), Article 6(1)(c) (compliance with a legal obligation to which the controller is subject) Act on the Positive credit register (739/2022) The processing of personal data collected in customer service or with observation and feedback forms is based on the following legal provisions: EU General Data Protection Regulation (2016/679), Article 6(1)(e) (performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)
Disclosure and transfer of personal data to third countries	Data is not disclosed regularly. The data recorded in the Positive credit register is confidential, with the exception of the name, Finnish Business ID or foreign business ID of a party with the reporting obligation. With the above exceptions, data may be disclosed from the Positive credit register only for the purposes laid down in the Act on the Positive Credit Register and in the Act on the Openness of Government Activities (sections 11 and 12; section 26, subsection 3; section 29, subsection 1, paragraphs 3 and 4). The Incomes Register Unit can make the name and Finnish Business ID or foreign business ID of a party with the reporting obligation publicly available through electronic information network. However, personal data can be searched for in the electronic information network only through individual searches. In principle, data is not disclosed to countries outside the EU/EEA. However, in exceptional individual cases, Microsoft may have access to personal data during support and maintenance activities. In data transfer, the transfer basis under the General Data Protection Regulation is the European Commission's decision on the adequacy of data protection under Article 45(1) (Adequacy decision for the EU-US Data Privacy Framework, C(2023) 4745 final) or, where necessary, standard contractual clauses published by the European Commission.
Time limits for the erasure of personal data	The Tax Administration’s Incomes Register Unit keeps the data in accordance with the Tax Administration's information management plan for as long as necessary for the performance of the Incomes Register Unit's statutory task. The identifying and contact information of natural persons is deleted no later than 10 years after the end of the year in which the natural person died or was declared dead. The data of the contact persons reported by business operators is deleted at the latest when the contact person changes or the business operator's sign-up or data permission for the Positive credit register ends. Call recordings are saved for no more than 6 months. Observation and feedback forms are stored in the application management’s service management system for no more than 2 years.
Data subject’s rights, and the right to lodge a complaint with a supervisory authority	Right of access The data subject has the right to obtain confirmation from the controller as to whether or not the controller is processing personal data concerning them. In addition, the data subject has the right to obtain a copy of any personal data concerning them that is processed by the controller. If you want to view your personal data, please contact the Positive credit register’s customer service. Right to rectification The data subject has the right to request the controller to rectify inaccurate and incorrect personal data concerning them without undue delay. A representative of a business operator can update the contact persons’ information in the Positive credit register’s e-service. If you detect an error in your personal data and want it to be rectified, please contact the Positive credit register's customer service. Right to restriction of processing The data subject has the right to request that the controller should restrict the processing of data concerning them when the data subject disputes the accuracy of personal data, for example. The processing of the data will then be restricted for a period enabling the controller to verify the accuracy of the data. If you want to request a restriction of processing, please contact the Positive credit register’s customer service. Right to oppose processing The data subject has the right to oppose the processing of personal data concerning them if they have a special reason related to personal circumstances and if the processing of personal data is not based on the performance of the Incomes Register Unit's statutory obligation under Article 6(1)(c) of the General Data Protection Regulation. In such a case, the controller may process the data subject’s personal data only if there is a significant and justified reason for the processing that supersedes the data subject’s rights and freedoms, or if the processing is necessary for the purpose of preparing, presenting or defending a legal claim. If you want to oppose the processing of your personal data, i.e. request that your data should not be processed at all, please contact the Positive credit register's customer service. Right to lodge a complaint with a supervisory authority The data subject has the right to lodge a complaint with the Data Protection Ombudsman regarding the processing of their personal data. Further information and instructions on how to make a complaint is available on the website of the Office of the Data Protection Ombudsman.

Page last updated 9/29/2023