DATA PROTECTION NOTICE

Planmeca Group is committed to protecting your privacy.

We respect your rights as a registered person. We will always tell you about our privacy practices and the purpose and legal basis of the processing of our data when we collect your personal information. We retain personal information only for as long as is necessary.

We share personal information only with appropriate and authorised third parties that also comply with our privacy policies. We always use appropriate transfer mechanisms and security measures when processing and transferring personal data.

PLANMECA’S PRIVACY NOTICE REGARDING THE WHISTLEBLOWING CHANNEL

This Data Privacy Notice explains how the personal data received through the Whistleblowing channel of Planmeca Group (‘Planmeca’) may be processed and how the privacy rights of individuals may be exercised.

DATA CONTROLLER

The data controller is:
Planmeca Oy (Business ID 0112773-2)
Asentajankatu 6, 00880 Helsinki, Finland

THE PURPOSE AND LEGAL BASIS OF THE DATA PROCESSING

Planmeca Group only processes personal data when it is strictly necessary. Regarding the Whistleblowing Channel, personal data is processed for the purposes of investigating reports of alleged wrongdoings or violations, as well as for the purposes of the subsequent processing of these reports, and the reporting of the outcome to relevant parties.

All reports are treated confidentially. The data in the Whistleblowing Channel is managed only by the Head of Compliance and Corporate Responsibility of Planmeca Group, personnel involved in Whistleblowing investigations according to Planmeca Group Whistleblowing Policy and the Data Protection Policy.

The processing is based on legal obligations laid down in the Finnish Whistleblower Protection Act (1171/2022), DIRECTIVE (EU) 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law, other applicable whistleblowing legislation and the Planmeca Group’s Global Code of Conduct and Whistleblowing Policy. In addition, the processing of personal data complies with the requirements of the General Data Protection Regulation (EU) 2016/679, the Finnish Act on the Protection of Privacy in Working Life (759/2004), the Finnish Data Protection Act (105/2018) and other applicable legislation.

THE CATEGORIES OF PERSONAL DATA TO BE PROCESSED

In connection with the processing of data in the Whistleblowing Channel, Planmeca processes the following categories of personal data:

Data subject Examples of processed data

Whistleblower – a person who files a report in

Reported individual – the person who is
mentioned in the report

Other individuals mentioned in the report or in the investigating process – e.g. a witness, or a person with the information about the report 

Whistleblowing case managers or person(s) investigating a report.

The Head of Compliance & Corporate Responsibility is responsible for the handling of whistleblowing cases within the Planmeca Group together with employees responsible for investigation according to Planmeca Group Whistleblowing Policy

Examples of processed data

the Whistleblowing channel The Whistleblowing channel is designed to protect the identity of the whistleblower at all stages of the reporting process. This means that a report can be made anonymously, with report-specific ID and password to ensure confidentiality in a data-secure manner.

Whistleblower may voluntarily provide their personal information in the report, for example name, location, contact details, financial information, behavioral information, image or video footage, or any other information.

It should be noted that any disclosed details or contents of the report may allow the whistleblower to be indirectly identified. However, the identity of the whistleblower is not sought to be determined. According to the Whistleblower Protection Act, it is strictly prohibited to disclose the identity of the whistleblower, regardless of whether it is known.

The report may contain information regarding the behavior and circumstances of the reported individual, as well as other personal data, such as contact details, location, date and place of the incident, financial information, behavioral information, image or video footage or any other relevant details.

The report may contain information regarding the behavior and circumstances of other individuals, as well as other personal data, such as contact details, location, date and place of the incident, financial information, behavioral information, image or video footage or any other relevant details. 

The following personal data is collected from the whistleblowing case managers handling the reports and investigations: name, title, user ID and password, communications and notifications, email address, log information, device identifier, timestamp, IP address

THE STORAGE TIME
Planmeca will store personal data only for as long as necessary to fulfil the purposes described in this privacy notice, mandatory legal requirements, or a legal claim.

Data is retained for a period of up to 5 years from the date of the report unless further investigations or a longer storing time is justified for the purposes of a criminal investigation, ongoing legal proceedings, regulatory investigation, or to safeguard the rights of the whistleblower, the subject of the report or Planmeca Group. Personal data that is clearly irrelevant to the processing of the report will be deleted without undue delay.

DATA TRANSFER AND PROCESSING OUTSIDE THE EU/EEA AREA

Persons or groups receiving personal data:

Planmeca Group:

The Head of Compliance & Corporate Responsibility, acting impartially and independently, is responsible for the processing and follow-up of whistleblowing reports. Specific Planmeca Group personnel involved in Whistleblowing investigations according to Planmeca Group Whistleblowing Policy may also have access to data, as well as the Data Protection Office in certain cases if required by
law.

Service provider:

The Whistleblowing Channel is a secure channel separated from the Planmeca Group IT environment. The platform is provided by an external service provider, WhistleB.

Third parties:

Planmeca Group may disclose information and personal data related to the investigation and the identity of the persons whose personal data is processed to the authorities for the purpose of filing a police report, preliminary investigation by the authorities or for the purposes of judicial proceedingswhere there is a legal obligation to do so. 

Planmeca Group may also disclose information and personal data related to the investigation and the identity of the persons whose personal data is processed to external advisors, such as legal advisors, when allowed by applicable law. Personal data is not transferred outside the EU or EEA.

SECURITY OF DATA PROCESSING

Planmeca maintains appropriate and adequate organisational, technical and physical safeguards to protect personal data disclosed to Planmeca against unlawful or unauthorised destruction, alteration, use or disclosure, or loss. Only authorised persons have access to the personal data held by Planmeca. Planmeca requires that all employees with access to any personal data observe strict confidentiality.

AUTOMATED DECISION MAKING

Not done.

DATA PROTECTION RIGHTS

In accordance with the applicable data protection legislation, you may have the right to

— Request access to the personal data we hold about you,
— Request that we rectify any inaccuracies in the personal data we hold about you
— Withdraw your consent at any time if the processing of your personal data is based on consent
— In some circumstances, to request the transfer of your personal data to a third party
— In some circumstances, to request erasure or restriction of processing or to object to processing

If you would like to exercise any of the rights listed above, you can submit your request to us by sending an email to [email protected].

You have the right to file a complaint to your local data protection authority if you are not content with our data protection practices.

You also have a right to file a complaint with a supervisory authority if you consider that the processing of personal data breaches your rights pursuant to applicable law.

Office of the Data Protection Ombudsman, Ratapihantie 9, 00520 Helsinki, [email protected].

OUR CONTACT DETAILS

If you have any questions regarding the data protection practices related to the whistleblowing channel or if you wish to exercise your data protection rights, please contact Planmeca Data Protection Office at [email protected].

Data Protection Officer

We have appointed a global Data Protection Officer. If you have questions about data protection at Planmeca Group or if you need any further information, please contact the Data Protection Officer at [email protected].

CHANGES TO OUR PRIVACY NOTICE

We may update this privacy notice without prior notice when necessary to reflect changes to our data protection practices. This privacy notice has been published on 13 December, 2024.