When processing our customers’ personal data, we place great importance on complying with data protection principles and ensuring the secure handling of personal data. We operate transparently in matters related to data protection.
This Privacy Policy explains our practices regarding the collection, use, and storage of personal data. We also describe the rights of data subjects in this register.
We will update this privacy policy as necessary due to changes in our operations or services, or, for example, due to changes in legislation.
Data controller
Alva-yhtiöt Oy, Business ID: 1071200-1
Mailing address: P.O. Box 4, 40101 Jyväskylä
Phone: 014 366 4000
Website: www.alva.fi
Contact person
Toni Luhti
Phone: 050 344 6566
Mailing address: Alva-yhtiöt Oy, P.O. Box 4, Jyväskylä
Email: tietosuoja(at)alva.fi
Name of the register
Alva-yhtiöt Oy’s customer register. The data subjects are Alva-yhtiöt Oy’s customers and potential customers.
Purpose of personal data processing and legal basis for maintaining the register
Alva-yhtiöt Oy, as the data controller, and partners acting as data processors authorized by Alva-yhtiöt Oy under contract, process the personal data of customers and potential customers in accordance with personal data legislation for the following purposes:
- To manage the customer relationship between Alva-yhtiöt Oy and its customers and to improve the quality of that relationship.
- Customer and stakeholder communications
- Maintaining, offering, developing, and delivering Alva-yhtiöt Oy’s products and services, as well as managing Alva-yhtiöt Oy’s internal and external tasks related to these products and services
- To manage responsibilities related to contractual relationships
- To receive payments, monitor payments, and carry out collection activities
- To market and advertise products and services, as well as for distance selling
- For internal reporting and reporting to authorities
The processing of personal data is based on grounds in accordance with applicable personal data legislation, such as:
- The contractual relationship between the data subject and Alva-yhtiöt Oy
- Alva-yhtiöt Oy’s legitimate interest, for example when Alva-yhtiöt Oy uses the data subject’s information to market its products and services, or processes the data internally within the Alva Group or with a third party involved in providing the service
- The data subject’s consent, when the data subject has given their consent to electronic marketing or to other consent specifically requested by Alva-yhtiöt Oy
Alva’s processing of personal data is also based on other mandatory and statutory obligations, such as the Electricity Market Act and its implementing regulations, the Energy Efficiency Act, and the Consumer Protection Act.
Data contained in the registry
The following information is collected in the registry.
- name
- age or year of birth
- personal identification number or business ID
address - customer number
- gender
- language of service
- contact information, such as phone numbers, email address, and other address details
- direct marketing permissions and opt-outs provided by the customer
- recorded phone calls, emails, and chat messages between customers and Alva-yhtiöt Oy’s customer service, as well as other communication related to customer interactions
- information related to the customer’s service experience
- data from customer surveys
- participation in campaigns and contests
- other information obtained with the data subject’s consent that is necessary for the provision of the agreed-upon service
- information related to the customer’s contract (subject of the contract, duration, contract prices, billing address, any representative information, product information, contact person information, notice of termination)
- information related to the customer’s use of services, including service events and fault reports
- information related to the customer’s payment behavior and bank details
- information on energy and water consumption locations, as well as information related to consumption sites and connections
- device information located at the consumption site
- energy and water consumption data
- security and authentication data related to the customer for logging into electronic services, such as username and PIN code
- device data, such as IP address and other data derived from cookies
- consent data, such as marketing consents
Sources of personal data
The register is updated based on information received from customers through requests for offers, orders, contracts, or other related contacts, as well as energy and water consumption data collected from meters installed at customer premises.
Information on potential customers is obtained, for example, from prize draws, competitions, events, and telemarketing.
Information on customers and potential customers may also be obtained from other companies within the Alva Group, taking into account the non-discrimination principles of the Electricity Market Act.
Data in the register may also be collected and updated from external data sources, such as the register of Suomen Asiakastieto Oy or the register of another data controller providing address, update, or similar services.
Data is also collected using cookies and similar technologies in accordance with the procedures permitted by the regulations in force at any given time.
Data is also updated based on the rules governing data exchange in the electricity market.
All communications from customers and potential customers to Alva-yhtiöt Oy can be recorded and used to verify customer contacts, develop services, handle complaints, and for other similar purposes.
Regular disclosure of data and transfer of data outside the EU or the European Economic Area
No data from Alva-yhtiöt Oy’s customer register is disclosed to third parties without the data subject’s consent, except to other companies within the Alva Group, recipients acting on behalf of Alva-yhtiöt Oy, or third parties involved in the provision of services.
Alva may also disclose data in the event of a business reorganization, such as a sale, merger, or other corporate restructuring, in which case personal data may be disclosed to potential or actual buyers and their advisors. Data may be disclosed to authorities to the extent and in the manner required by applicable law.
Personal data will be transferred outside the European Union or the European Economic Area only in accordance with the procedures set forth in personal data legislation, for example, by using standard contractual clauses approved by the European Commission.
Data retention
Data concerning the data subject will be retained only for as long as necessary to fulfill the purposes specified earlier in this privacy notice.
The most significant statutory retention obligation is the obligation to correct consumer invoices, which determines a data retention period of ten years.
Principles of data security and risk management
Customer registry data is stored in databases protected by firewalls, passwords, and other technical measures. We may also protect personal data by making it unidentifiable (pseudonymization). Access to the data is restricted to individuals employed by Alva-yhtiöt Oy or its authorized agents who require the data for their work duties. Alva-yhtiöt Oy requires its staff and partners to commit to maintaining the confidentiality of customer data and to the secure processing of personal data.
In processing personal data, Alva-yhtiöt Oy is guided by the objective of handling customer data in a manner that does not pose a risk to the data subject. As risk management measures, Alva-yhtiöt Oy conducts regular risk identification and assessment, impact assessments related to data processing, and regular staff training.
In the event of a data breach, the risk to the data subject is assessed. If a high risk to the data subject’s rights and freedoms is assessed, the data subject is notified of the data breach.
Cookies
When you use our services or visit our website, the Alva Group may collect information about your device using cookies or similar technologies. Our website may also contain third-party cookies or similar technologies. You can read more about the use of cookies on our Cookie policy page.
Rights of data subjects
Right of access to data and to verify data
The data subject has the right to inspect the data concerning them and to receive a copy of the data in paper form or in a commonly used electronic format. A request for data may be submitted by contacting Alva-yhtiöt Oy’s customer service using the contact information provided at the end of this statement.
Right to rectification and restriction of processing
Data subjects have the right to have their data rectified by submitting incomplete or incorrect information, along with supporting documentation, to Alva-yhtiöt Oy’s customer service using the contact information provided at the end of this notice. If they wish, data subjects may also update their own data via the Alva Group’s electronic service, Oma Alva, within the limits permitted by the electronic service channel. In certain situations, data subjects also have the right to request a restriction on processing.
Right to erasure
The data subject may request the erasure of their data. For consumer customers, data may be erased no earlier than ten years after the termination of the contract. The ten-year retention period is based on the consumer customer’s obligation to correct billing, which specifies a data retention period of ten years.
A request to delete data can be submitted by contacting Alva-yhtiöt Oy’s customer service using the contact information provided at the end of this statement.
Right to object to automated decision-making, including profiling
In electronic service channels, it is possible that the data provided by the data subject is used to automatically verify, for example, a customer’s eligibility to enter into a contract.
When automated processing and the resulting decision-making are used, the data subject has the right to object to the procedure if it is not necessary for the conclusion or performance of a contract.
In such cases, the data subject may contact Alva-yhtiöt Oy’s customer service to learn about alternative ways to handle the matter.
Right to withdraw consent
The data subject has the right to give consent to electronic marketing and also to withdraw such consent. The data subject may withdraw consent by contacting Alva-yhtiöt Oy’s customer service using the contact information provided at the end of this notice. Customers can unsubscribe from the electronic newsletter via the unsubscribe link in the newsletter.
Right to lodge a complaint with a supervisory authority
The data subject has the right to file a complaint with the competent supervisory authority if the data subject believes that their data has been processed in violation of this Privacy Policy or applicable law.
Contact information for the data protection authority:
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Mailing address: P.O. Box 800, 00531 Helsinki
Switchboard: 029 566 6700
Email: tietosuoja(at)om.fi
Contact Information
To exercise their rights, data subjects may contact the customer service of Alva-yhtiöt Oy:
Phone: 014 366 4010
Email: asiakaspalvelu(at)alva.fi
Mailing address: Alva-yhtiöt Oy, Customer Service, P.O. Box 4, 40101 Jyväskylä
The data subject must reliably verify their identity.
Alva-yhtiöt Oy will process the request within one month of receiving it and verifying the data subject’s identity, unless there is a specific reason to extend the response time.