Privacy policy – Whistleblowing reporting channel

Privacy policy

ALTEN Finland

ALTEN processes personal data in accordance with data protection legislation. In this privacy policy you will find information on the processing of personal data in connection with ALTEN’s whistleblowing channel.

Who is responsible for the processing of personal data?

Personal data is processed and controlled by:

The contact details of the ALTEN Data Protection Coordinator are dpc@alten.fi.

What is the purpose of processing personal data?

Having an internal reporting channel is based on the directive of the European Parliament and the Council on the protection of persons who report violations of Union law (EU 2019/1937) and national legislation implementing whistleblower protection (Whistleblower Act, 1171/2022).

ALTEN has founded an electronic reporting channel in accordance with the Whistleblower Act, through which a report can be made about misconduct or breach detected in connection with persons work. Report can be made by ALTEN’s current employees, former employees, job seekers, trainees and subcontractors and persons employed by the subcontractor.

The basis for processing personal data is compliance with a legal obligation to which ALTEN is subject and ALTEN’s legitimate interest.

The personal data contained in the reports received in the reporting channel and the personal data revealed in the investigation of the reports are used to investigate and prevent possible misuse as required by the Whistleblower Act and other applicable legislation. In addition to legal obligations, ALTEN may also process personal data based on ALTEN’s legitimate interest if the subject of the reports is misconduct that is not covered by law.

Personal data is not used for profiling and no automated decision-making is subjected.

What personal data do we process?

ALTEN processes personal data coming through the reporting channel, such as the name and contact information of the whistleblower, the name of the subject of the notification and other personal information contained in the notification, as well as personal information contained in the notification regarding other persons mentioned in the notification, such as witnesses.

The whistleblower can make the report either under his own name or anonymously.

In addition, ALTEN processes other personal data necessary for the proper investigation of the notification. This data originates from ALTEN’s internal information sources, such as from persons possibly related to the matter, if necessary, from experts to investigate the matter, or from ALTEN’s information systems. ALTEN can combine the personal data obtained from these different sources in order to clarify the authenticity of the notification and the matter.

ALTEN can process information related to special personal data groups and criminal convictions and crimes only if the processing is necessary for the purposes of the Whistleblower Protection Act.

Who has access to personal data?

The personal data of the whistleblower and the subject of the report may only be processed by persons chosen by ALTEN Finland for this task, i.e. members of ALTEN’s Whistleblowing team. In addition, a limited number of other experts, who are necessary for the investigation of the case and whom ALTEN has chosen for this task, may participate in the processing of the notification.

The personal information contained in the notification and other personal information connected to the notification must be kept confidential. As a general rule, personal data is not revealed outside the Whistleblowing team without the clear consent of the person. However, if it is necessary the personal information may be handed over to competent authority for the notification’s clarification or to investigation authorities or a prosecutor in order to carry out their tasks specified by law in connection with abuses or violations of legislation, or to the subject of the notification in order to prepare, present or defend a legal claim in legal proceedings. In such a case, ALTEN must inform the person making the notification in advance about revealing his identity, unless such information endangers the investigation of the validity of the notification, the related investigation or court proceedings.

ALTEN ‘s IT department, as the administrator of the information system, has access to all the information contained in the information system, but does not have the right to review notification information, such as personal information related to the notification.

The reporting channel is the Forms platform provided and maintained by Microsoft (see Microsoft General Privacy Statement). ALTEN does not transfer data outside the EU or EEA or to an international organisation, but in accordance with Microsoft’s privacy policy, Microsoft also uses servers located outside the EU or EEA to provide the service.

How long do we keep your personal data?

ALTEN retains the personal data contained in the report or otherwise processed in connection with the processing of the report within the limits set by law or for as long as it is otherwise necessary to retain the data in relation to the purposes for which the data were collected or otherwise processed. As a rule, ALTEN deletes data received through the reporting channel five years after receipt of the notification, unless its storage is for the exercise of rights or obligations laid down by law or for the establishment, exercise or defence of legal claims.

Personal data that are clearly not relevant for the processing of the report will be erased without undue delay.

What rights does the data subject have?

The data subject has the right to know whether ALTEN processes his or her personal data and the right to access the data processed about him or her by ALTEN. The data subject has the right to ask from ALTEN the rectification of inaccurate or incorrect data concerning him or her. In addition, the data subject has the right to request ALTEN to erase the data, to request restriction of processing and to object to the processing.

However, the data subject’s right to restrict the processing of personal data does not apply to the processing of personal data referred to in the Whistleblower Act (Whistleblower Act, section 31(1)).

The data subject’s right of access may also be restricted if it is necessary and proportionate in order to ensure the accuracy of the report or to protect the identity of the notifier (Whistleblower Act, section 31(2)). If only part of the data concerning the data subject is such that it falls outside the right of access, the data subject has the right to know other information concerning him or her (Whistleblower Act, section 31(3)). The data subject has the right to be informed of the reasons for the restriction and to request that the data be provided to the Data Protection Ombudsman in accordance with section 34(3) and (4) of the Data Protection Act (1050/2018) (Whistleblower Act, section 31(4)).

When ALTEN processes personal data for the performance of a statutory task, the data subject does not have the right to request erasure or object to the processing.

All inquiries and requests regarding the processing of personal data should be addressed to ALTEN’s Data Protection Coordinator by e-mail at dpc@alten.fi.

The data subject has the right to lodge a complaint about the processing of personal data with a competent authority, in Finland Data Protection Ombudsman: www.tietosuoja.fi.

What rights does the data subject have?

This release has been updated on 24 January 2025. The latest current policy can be found on the ALTEN website.