Privacy Policy

Taxitec Oy acts as the controller processing personal data.
Business ID 3235140-3, address Oppipojankuja 10 H2 70780 Kuopio, tel 0405919000, email sales@taxitec.fi

Legal bases and purpose of processing personal data

We process the personal data of data subjects on the following processing bases in accordance with the EU General Data Protection Regulation (Regulation 2016/679 of the European Parliament and of the Council, "GDPR"):

• with the explicit consent given by the data subject;
• on the basis of consent obtained from the data subject by a customer using our services, or another lawful processing basis held by the customer;
• for the performance of a contract to which the data subject is party (for example, a commission agreement or an employment contract);
• for compliance with legal obligations to which the controller is subject (for example, to manage Taxitec Oy's employer obligations); and
• on the basis of legitimate interest to offer services to our customers.

Registers formed from personal data and categories of personal data

Through the collection of personal data, the personal data registers described below are formed for us. For each personal data register, we have described the purpose for which the register was established and provided examples of the personal data contained in them.

• The Customer Register consists of personal data that we need for customer identification, as well as for managing and developing the customer relationship. Such information includes, for example, the data subject's name, address, phone number, job title, and other contact information, as well as information related to customer identification.
• The Marketing Register consists of personal data that we collect, for example, from potential and current customers, former employees, and participants in events and functions organized by us, to whom we market our services and inform about our activities. Such information includes, for example, name, address, phone number, job title, and similar contact information.
• Our Website Personal Data Register consists of personal data that we collect from visitors to our website, and which we collect and process to ensure the functionalities of our website and for the development of our website. Such personal data includes, for example, cookies, information about the browser used, time spent on the website, and the path through which the visitor arrived at our website.
• The Recruitment Register consists of personal data of potential employees and recruited employees that we collect and process for making recruitment decisions. Such information includes, for example, job applicants' contact details and personal data provided to us by job applicants in their job applications.
• The Employee Register consists of personal data of our current employees that we collect and process for managing employer obligations. Such information includes, for example, employees' contact details.

Processing of personal data and categories of personal data

Through the processing of personal data collected by the Customer and transferred to us in connection with the provision of services, the following categories of personal data processing are formed for us.

• The Service Data Maintenance Register consists of location data generated by the taximeters used in connection with the use of our services. Location data may constitute personal data if the Customer, based on the information in their possession, has the ability to link the location data to an individual data subject.

Recipients of personal data

We may transfer and in some cases do transfer data subjects' personal data to our contractual partners, who process the data subjects' personal data on our behalf based on a personal data processing agreement concluded between us and the personal data processor.

We may disclose or transfer data subjects' personal data in a manner required by claims presented by competent authorities or other parties, based on applicable legislation.

However, the baseline is that we do not disclose data subjects' personal data to third parties unless there is a justified reason for doing so as described above or arising from legislation.

We do not disclose personal data received from the customer that we process, without the customer's request, to parties other than subcontractors necessary for providing the services or authorities who have the right to receive information pursuant to legislation.

Transfer of personal data abroad

We aim to ensure that we do not disclose data subjects' personal data outside the EU or EEA. If we are required to disclose data subjects' personal data outside the EU or EEA, we ensure that an adequate level of data protection is guaranteed by applying the safeguards required by data protection legislation (e.g., standard contractual clauses drafted by the EU Commission).

We use third-party tools on our website whose service providers may also be located outside the EU or the European Economic Area. Such service providers include, for example, Google Analytics. In these cases, we ensure an adequate level of data protection for personal data.

Retention of personal data

We retain data subjects' personal data for as long as necessary for each purpose described above, for our operations, and as required by the legislation binding on us.

The retention period of personal data is determined by the purpose for which the personal data is processed. Personal data concerning the customer relationship is retained for as long as required by the legislation binding on us. Personal data retention periods vary greatly. We delete data subjects' personal data when we no longer have a need or a legal basis for processing it.

We retain location data received from our customers for the duration of the customer relationship and thereafter for the period necessary to secure the responsibilities and obligations under the customer relationship.

Protection of personal data

We protect data subjects' personal data from unauthorized access and unlawful processing through organizational and technical measures, such as passwords, access restrictions, and internal operating guidelines. We also use appropriate firewalls to protect personal data.

Rights of the data subject

Right of access to personal data

The data subject has the right under data protection legislation to inspect what personal data concerning them has been stored in personal data registers, or that there is no personal data concerning them in the registers.

Right to rectification

If there are errors in the processed personal data, the data subject may submit a request to the controller to correct the error.

Right to erasure

The data subject has the right to request the deletion of personal data concerning them from the register if there is no lawful basis for processing the personal data.

Right to restriction of processing

The data subject may request the restriction of processing of personal data on grounds laid down by law.

Right to object

The data subject has the right to object to the controller processing personal data concerning them for direct advertising, distance selling, and other direct marketing, as well as for market and opinion research.

Right to data portability

To the extent that the data subject has provided the controller with data that is processed based on consent, the data subject has the right to receive such data generally in a machine-readable format and the right to transmit that data to another controller.

Right to withdraw consent

If the processing of personal data is based on consent given by the data subject, the data subject has the right to withdraw their consent at any time. However, the processing of the data subject's personal data that occurred prior to the withdrawal of consent does not become unlawful even if consent is withdrawn.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with the competent supervisory authority if they consider that the controller has not complied with applicable data protection regulations. The national supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi)

Other

The processing of personal data may in some respects be a statutory task of the controller and in some respects a contractual requirement. Processing of personal data is our statutory task, for example, if it relates to managing our employer obligations.

We do not engage in automated decision-making and profiling.

Where your personal data is obtained from

We receive personal data from the data subject themselves when the data subject uses the services provided by us and when the data subject discloses their personal data to us on the basis of consent given by them. We may also collect and update personal data from the registers of our partners as well as from authorities and companies offering personal data services, such as our subcontractors who provide services to us.

In addition, we receive location data from our customers in connection with the provision of our services.

Further information

If the data subject has any questions regarding our data protection practices or wishes to exercise their rights, we ask the data subject to contact us at sales@taxitec.fi

We may update this privacy notice by announcing it on our website or through other electronic means.

The privacy notice / record of processing activities was last updated on October 17, 2024.