Privacy Notice

General

This privacy statement describes how Merus Power Oyj (“Merus Power” or “data controller”) processes the personal data of its customers, shareholders, subscribers to the company’s newsletters, website visitors and representatives of its partners. We are committed to protecting your privacy and processing your personal data only in accordance with applicable data protection and privacy protection legislation and good data processing practices. The data protection statement also provides information about the obligations we comply with when processing personal data.

We comply with data protection legislation when processing personal data. Data protection legislation refers to the data protection legislation in force at any given time, such as the European Union’s General Data Protection Regulation (2016/679) (“data protection regulation”) and the national data protection act (1050/2018).

Our site may contain links to websites and services of other organizations that we do not control. This Privacy Statement is not suitable for the use of such third-party sites, so it is recommended to read the third-party privacy statements separately.

Controller

Merus Power Ltd
PIC: 2230775-9
Address: Pallotie 2, 33470 Ylöjärvi
Email: meruspower@meruspower.com

Controller’s contact person

Rainer Antila, Data Protection Officer
rainer.antila@meruspower.com

What personal data do we process?

Personal data refers to all data concerning a natural person (“data subject”) from which the person can be directly or indirectly identified in the manner intended by the data protection regulation. Personal data is all data that can be linked to a natural person. We only collect personal data necessary for the purposes described in this privacy statement.

We process the following personal data of our clients and our partner’s representatives:

  • Name
  • Contact details (mobile, email)
  • Organisation, title, and position
  • Communication with you
  • Meeting details

We process the following personal data of our shareholders and members of the Board:

  • Name
  • SSN or other personal identification code
  • contact details (address, mobile, email)
  • payment details
  • tax information
  • number of shares by share class
  • joint owner details
  • other information according to the book entry system
  • PEP information

We process the following personal data of our newsletter subscribers:

  • Name
  • Email

We process the following personal data of our website visitors:

  • Browser type
  • IP address
  • Location
  • Which parts of the website you visit and when
  • Consent to cookies

We do not necessarily collect and process all the above data of every data subject.

For what purposes and on what basis we process your personal data?

We process the information of our customers and representatives of customer companies in order to provide services, maintain customer relations and perform related tasks based on the agreement between you or the company you represent and Merus Power Oyj.

If you are a representative of our partner, we will process your data for the implementation, analysis and development of cooperation based on the agreement
between you or the company you represent and Merus Power Oyj.

We process the information of subscribers to our newsletters based on your consent to deliver the newsletters.

The purpose of processing our shareholders’ information is to keep a shareholder list of the shares and their owners connected to the book-entry system. The processing of this data is based on our statutory obligation (the Companies Act).

We process the information of website visitors in order to provide informative and functional websites. The processing of this data is based on our legitimate interest and your consent for non-necessary cookies.

Where do we collect your personal data from?

Personal data is primarily collected from you when you enter into a contractual relationship with us or when you order our newsletter. If you are a shareholder, we also collect your information from the value share system. We can also receive your information from the company you represent or from our partner. When giving authorization, the person also enters the necessary personal information for the authorized person.

To whom do we disclose your personal data?

Based on the Limited Liability Companies Act, the information in the shareholder list is public.

If the magistrate has ordered a restriction on the disclosure of information about the shareholder (a so-called security ban) and we or the account manager have been notified of the restriction, the shareholder’s municipality of residence, address and other contact information entered in the shareholder register will only be disclosed to the authority.

We can hand over the ownership and payment information necessary for submitting taxation to the Tax Administration. Information can also be disclosed in other ways if required by law.

In processing personal data, we also use the following service providers who process your personal data for us:

  • IT system suppliers and other IT service suppliers
  • providers of communication services and bulletin distribution services
  • website maintenance service providers
  • providers of information services

Do we transfer your personal data to a third country?

As a rule, we do not transfer your data outside the European Union or the European Economic Area. However, some of our providers of external service or software may store data outside the EU or the EEA, in which case the Controller ensures that all necessary technical, physical, and organisational safety measures have been implemented and that appropriate data processing agreements and transfer impact assessment have been concluded.

You can get more information about international transfers of personal data from the data protection officer at rainer.antila@meruspower.com.

How long do we process your personal data?

We will keep your personal data for as long as is necessary for the purposes of personal data processing, unless the legislation obliges us to keep personal data longer. When there is no basis for the processing of personal data, the personal data will be removed from the registers within a reasonable time. We regularly evaluate the necessity of data retention.

You can get more information about the retention periods of personal data from the data protection officer at rainer.antila@meruspower.com.

How do we ensure data security when processing your personal data?

We store your personal data in systems that are protected by firewalls, personal user rights and passwords, and other generally accepted technical and organizational means in the industry at any given time. The materials we maintain manually are located in data- and fire-safe premises, to which unauthorized access is blocked.

What are your rights as a data subject?

You have the following rights in accordance with data protection legislation regarding the processing of personal data:

The right to get access to personal data and to receive a copy of personal data

  • You have the right to receive confirmation as to whether we are processing personal data concerning you, as well as the information defined in the data protection legislation regarding the processing of personal data. In addition, you have the right to receive a copy of the personal data being processed.

The right to correct personal data and the right to delete data

  • You have the right to demand the correction of incorrect or inaccurate personal data. In addition, you have the right to demand the deletion of your personal data (right to be forgotten) in accordance with the requirements of data protection legislation.

The right to limit and object to the processing of personal data

  • In accordance with the requirements of data protection legislation, you have the right to request the restriction of the processing of your personal data and the right to object to the processing of your personal data based on legitimate interests.

The right to transfer personal data

  • In accordance with data protection legislation, you have the right to demand the transfer of your personal data to another data controller.

The right to withdraw the consent given for the processing of personal data

  • If the processing of your personal data is based on your consent, you have the right to withdraw your consent. Please note that the withdrawal of consent has no effect on the processing of personal data carried out before the withdrawal.

Requests regarding your rights must be made in writing by email to the data protection officer in rainer.antila@meruspower.com.

You always have the right to file a complaint with the competent data protection authority if you believe that your personal data has been processed in violation of the law. In Finland, the supervisory authority for data protection is the Data Protection Commissioner (www.tietosuoja.fi).

Changes to the Privacy Notice

With the development of our services, it may be necessary to make changes and update this privacy statement. We recommend that you familiarize yourself with the content of the privacy statement regularly.