The processing of personal data in Posti’s campaign register is jointly controlled by Posti Ltd and Posti Distribution Ltd (together referred to as “Posti”) as joint data controllers. The responsibilities of the joint controllers are divided according to the company providing the service. The company providing the service is indicated in the product terms, on Posti's website, or in connection with the service.
Purpose and legal basis of personal data processing
Posti processes personal data for the marketing, direct advertising, and campaigns of Posti and its group companies, as well as for opinion polls, market research, and similar activities. Surveys may be targeted and personalized. The data collected in surveys is used for analysis, forecasting, segmentation, development, statistics, and reporting on the subject of the research. Survey responses are also used for profiling. Profiling refers to the automated processing of personal data to evaluate certain personal characteristics of the data subject. Profiling is carried out to pursue Posti's legitimate interest in increasing customer understanding and developing its services and products in a customer-oriented manner.
Personal data is used for communication implementation and monitoring. Newsletters, invitations, and announcements may also be sent via electronic channels. Personal data may be used for the implementation of lotteries and for the delivery of prizes and rewards. Additionally, personal data is processed to ensure the legal protection of the data subject and Posti, as well as to fulfill statutory obligations and regulatory requirements (e.g., in connection with lotteries, in accordance with accounting laws and tax regulations).
The legal basis for the processing of personal data depends on the purpose of the processing and/or the data type, which may be the data subject’s consent, Posti's legitimate interest, or compliance with a legal obligation (e.g., accounting law, tax legislation).
Data processed in the campaign register and retention period
The campaign register may contain the following data, depending on the purpose of personal data processing:
First name and surname
Year of birth
Address
Telephone number
Email address
Information regarding consent to or prohibition of direct marketing
Other declarations related to consent
Information on changes/updates to personal data
Contact history
Participation in campaigns, surveys, and lotteries
Responses, discussions, and comments given in connection with surveys, as well as any audio and video recordings from surveys
Segmentation data and other data derived from analytics
Responses and materials provided for lottery participation
Information necessary for the delivery of lottery prizes (e.g., clothing size)
Personal identity number (when necessary, e.g., for tax purposes related to the payment of potential rewards and prizes)
The campaign register only retains data that is necessary for Posti's operations and the purposes of personal data processing, where there are legal grounds for processing. The retention period for personal data is determined by the purpose of processing and/or the data type. The retention period is also affected by statutory obligations for the retention of personal data and other time limits that determine the retention period for the execution of various measures (e.g., statutory limitation or filing period).
Personal data collected in various surveys and lotteries is generally retained for up to one year from the date of collection or the end of continuous data collection. Lottery records are retained for the current year and the following five years. Statutory data related to the payment of rewards and lotteries is retained in accordance with the accounting law for the current year and the following six years.
To the extent that the processing of personal data is based on consent, such personal data will be deleted when the data subject withdraws their consent.
Regular data sources
The data in the register originates from the data subject, for example, when they participate in marketing campaigns, competitions, surveys, lotteries, or other similar marketing activities organized by Posti or potentially its partners. Data related to the data subject is also collected from the data subject in connection with registration for surveys, during the survey, and in connection with the delivery of rewards/prizes.
The data in the register may be corrected and updated with data from the registers of Posti, its group companies, and partners, as well as from the Population Information System of the Digital and Population Data Services Agency, Posti’s address information system, and the opt-out register maintained by the Data & Marketing Association of Finland (ASML), and other similar public and private registers.
Secure disclosure of data
Posti may disclose register data to its group companies for marketing and customer service purposes. The data in the campaign register may also be processed by companies acting as subcontractors for Posti.
Due to the technical implementation of data processing, some data is physically located on the servers or hardware of external subcontractors, where it is processed via a technical remote connection. Personal data may, in such cases, be transferred outside the European Union and the European Economic Area, subject to the restrictions permitted by law. In all cases, the prerequisite for the disclosure and transfer of data is that the parties receiving and processing the data have entered into an agreement with Posti containing the standard clauses approved by the EU Commission, which ensures lawful processing of the data, or that another transfer mechanism permitted by data protection legislation is applicable.
Principles for the protection of the register
The databases in the campaign register are protected by personal usernames and passwords. Only persons employed by Posti Group or authorized by the Group who need the data for their duties have access to the data. Posti requires both its personnel and partners to commit to processing data confidentially.