Controller

Controller: Datadrivers Oy
Address: Hallituskatu 2 A 7 95400 TORNIO, FINLAND
Email: info@kuljettajaopetus.fi
Website: https://kuljettajaopetus.fi

Name of the register

Datadrivers Oy's Webauto customer, user, course and training register.

Data content of the register and categories of personal data

Personal and training data of the trainees is processed in the register. Categories of personal data to be processed are contact persons of previous or current employer communities, persons who have contacted the controller, users of the Webauto software and training event participants. Data is primarily collected from the data subjects themselves in connection with the training event registration and participation or logging in to Webauto.

For example, information necessary for the purpose of the register in the following data groups may be processed:

a) Basic information of the employer community, which is or has been the controller's customer, such as name and contact details (address, email address, telephone number) and the name and contact details of the contact person.

b) Information related to the customer relationship between the controller and the data subjects, such as training information, event information, other contacts between the parties and service-related information.

c) Data subjects' information about the use of the Webauto service used by the controller or its additional service, such as the first and last name, address information, contact information, date of birth, position, employer, gender, native language, username and password, the information collected through the use of the application and its various functions, such as location information, provided by the user in the application.

d) The data subjects' transactions and use of services in the controller's website, information about the behaviour on the website, other similar grouping information, event participation, information provided for the event, customer service contacts and contacts with the controller's employees and services.

e) The first and last name of the data subject registered for the controller's event as well as possible contact details and information provided for the event. The registration information provided by the data subject may include: email address, telephone number, address, date of birth, allergies, passport number or social security number.

f) Other information concerning the data subject, such as direct marketing authorisations and bans.

Purposes of the processing and legal basis

The data is processed for the following purposes:

• Implementation of trainings: The aforementioned information is processed in order to fulfil the agreement, including reliable identification of the person, communication with the data subject and service invoicing. Without the mandatory information marked with an asterisk, the trainings or Webauto service cannot be provided in accordance with the agreement. Allergy information may be provided by the data subject so that special diets can be taken into account in the event catering. The data subject may also give their consent to other purposes of use. This kind of consent can be withdrawn at any time.
• Marketing: The data is used to market the controller's products and services. In this case, the processing is based on the data subject's consent or the controller's legitimate interest. The data subject may object to the marketing or withdraw their consent at any time.
• Statutory obligations: The Driving Licence Act sets requirements for maintaining records of the students and provided training and submitting notifications to the recipient of the driving test supervising the driving school. Laki kuorma- ja linja-autonkuljettajien ammattipätevyydestä (Act on the Professional Qualifications of Truck and Bus Drivers) requires that documents concerning the further training arrangements and persons who have completed the further training must be retained. In this case, the processing of personal data is based on compliance with a legal obligation.

Data retention period

The information concerning the data subject will be retained for as long as is necessary to fulfil the purposes defined above in accordance with applicable law. The data subject can also influence the data retention period themselves through the influence options described below in section 6.

In order to comply with Laki kuorma- ja linja-autonkuljettajien ammattipätevyydestä (Act on the Professional Qualifications of Truck and Bus Drivers), the documents concerning the further training arrangements and persons who have completed the further training will be retained as long as the further training certificate can be used to apply for a professional qualification certificate or professional qualification marking for the driving licence. In order to comply with the Accounting Act, documents and correspondence regarding transactions are retained for six (6) years from the end of the calendar year in which the financial year ends.

Data subject rights

• Checking, correcting and erasing data: A data subject has the right to review personal data stored about them. At the request of the data subject, incorrect, incomplete or outdated personal data will be corrected, supplemented or deleted. However, the data shall not be erased to the extent necessary to comply with legal obligations or to establish, lodge or defend a legal claim or to fulfil an agreement between the data subject and the controller.
• Data transfer: The data subject may, if they so wish, have their personal data transferred, which will be processed automatically on the basis of consent or agreement, by contacting the address mentioned in section 1 above.
• Right to object and restrict: The data subject may object to the direct marketing at any time. The data subject may also object to other processing based on a legitimate interest on the basis of their personal situation. In such a situation, the processing is limited to the time when the grounds for opposing the processing are assessed. Processing can also be restricted when the data subject contests the accuracy of the personal data, in which case the processing shall be limited to the period during which the data is verified.
• Withdrawal of consent: The data subject may withdraw their consent at any time by contacting the address mentioned in section 1 above.
• Right of Appeal: The data subject has the right to lodge a complaint with the authorities if they consider that their data has been processed in breach of the applicable data protection legislation.

Data disclosures and transfers

Datadrivers Oy implements the Webauto service and processes personal data in accordance with the privacy statement of the service.

As a rule, personal data is not disclosed to anyone, except in a manner required by competent authorities and in order to comply with legal obligations. For example, further training data is disclosed to the party granting the professional qualification and driving licence for application processing purposes.

As a rule, data is not transferred outside the EU or EEA area.

Registry security principles

The data is kept technically secure. Physical access to the data is blocked by access control as well as other security measures. Access to information requires adequate rights as well as multi-stage authentication. Unauthorised access is also prevented, e.g. with firewalls and technical protection.

The data is backed up securely and can be restored, if necessary. The level of security is audited at regular intervals through either external or internal auditing.

The data shall be accessible only to the controller and to specifically designated persons. Only the designated persons have the right to process the register data. Designated persons can be, for example, the trainer, secretary, employer representative, processor's employees or bookkeeper of the accounting firm. Users are also bound by professional secrecy.