Privacy statement for camera surveillance

May 17th 2021

Processing of personal data in Posti camera surveillance register is the responsibility of Posti Group Corporation

Purpose and legal basis of personal data processing

Posti processes data in the camera surveillance register in order to:

  • Ensure the personal safety of employees;

  • Protect property;

  • Supervise the appropriate operation of the production process;

  • Prevent and investigate incidents that compromise safety, property and the production process;

  • Prevent and investigate apparent work-related risks and threats;

  • Prevent and investigate property crime;

  • Ensure an employee’s interests and rights at the employee’s request (requires an agreement).

In respect of the SmartPOST Parcel Locker service, data is also processed for the purpose of controlling proper use, as well as for preventing and investigating cases of vandalism and fraud.

The processing of data is based on the legitimate interests of Posti.

Data processed in the camera surveillance register and its retention

The camera surveillance register consists of digital image recordings of surveillance cameras. In addition to the image itself, the register contains information about the monitored area or parcel locker where the camera is located, as well as the date and time of the events recorded in the image.

Camera surveillance recordings are retained for as long as is necessary for the purpose of use of personal data. The retention time varies depending on the technical solution, but will not exceed three months from the date of creating the image, unless a longer time is required for the purpose of use of the register in a particular case.

Regular sources of data

The data in the register originates from camera surveillance systems of Posti Group Corporation and its subsidiaries.

Disclosure of data

Due to the technical implementation of the processing of data, some data may be physically situated on external subcontractors’ servers or hardware, where they are processed through a technical interface. Personal data is not transferred outside the European Union or the European Economic Area.

Data protection principles

Access to digital records is restricted. Images or video recordings are only processed by persons who are responsible for the operation and/or maintenance of the equipment and those whose work involves the processing of records.

Rights of data subjects, access to information, rectification and completion of data, restrictions

The data subject has the right to know about the processing of his or her personal data, to review his or her personal data and to request rectification of inaccurate data and completion of incomplete data. The data subject may request the erasure or transfer of personal data or request restriction of processing. When processing is based on consent, consent can be withdrawn at any time.

When logged in, data subjects can also submit a request for a review of personal data at www.posti.fi/yhteystietoni.

Data subjects may also submit requests for review, rectification and completion by personally visiting Posti’s HQ in Postintaival 7 A, Helsinki, or by sending the request form to Posti, P.O.Box 8030, 00002 Helsinki.

Requests will be handled on a case-by-case basis, as these rights may be subject to restrictions due to the circumstances.

All data subjects have the right to lodge a complaint with a supervisory authority, especially in the Member State where they have their habitual residence or place of work or where the alleged breach of the data protection regulation occurred (in Finland, the supervisory authority is the Data Protection Ombudsman).

Controller

Posti Group Corporation (business ID: 1531864-4) PO Box 1, FI-00011 POSTI

Street address: Postintaival 7 A, Helsinki Tel. +358 (0)100 5445 (mpc/lnc, also while queueing)

Consumerservice@posti.com Businesscustomerservice@posti.com

Data Protection Officer: tietosuoja@posti.com