Data Protection and Privacy Policy Statements

We collect and process various types of personal data as and when necessary, depending on your relationship with us. The data we process includes, amongst other things, the following:

• Personal details – your contact details (such as your name, address, telephone number and email address), as well as your personal identification number where required to verify your identity.
• Contract and transaction data – for example, details of your contracts, orders, purchases, payment status and invoices; recorded and transcribed calls; your consents and opt-out preferences; and other interactions with us, such as your service requests and correspondence with our customer service team.
• Work order data, such as details of your communications with our customer service team, information on installations, support work orders, complaints, etc.
• Payment details – for example, your bank account details, which are required to process refunds.
• Web traffic data and identifiers – data collected via cookies or similar technologies regarding your use of our services, such as your browsing activity on our websites and your user segment, your IP address, cookie ID, mobile device identifier, browser and device information, and location.
• Security and IT services management data – data used to secure the use of our services and premises, such as your password and login details, security logs, CCTV recordings, and background check information relating to the identification of counterparties.
• Technical and consumption data – for example, data relating to the operation of a device, vehicle or application, including measurements of the consumption and production of electricity and other utilities, as well as data obtained from charging stations and smart devices, such as data collected from sensors (e.g. temperature).

The personal data we process comes from various sources:

• From you and your organisation (if you are a business customer or a lead), when you order or use our services, fill in a form, take part in a survey or competition, create an account, browse our website or otherwise interact with us.
• From our relationship with you as a customer, such as energy consumption data, work order processing, device data or behavioural data.
• From energy companies operating in the electricity market and the centralised data exchange unit for the electricity market (Datahub), based on data exchanges in accordance with applicable law or regulatory requirements.
• From third parties, such as public address registers, credit reference and debt collection agencies, installation partners, marketing partners, electricity and insurance companies, and other data providers.
• From companies within the Neve Group that share data for the purposes set out in this notice.

We use your personal data for pre-defined purposes on the basis of a contract, consent, a legal obligation or a legitimate interest. Data from online and offline sources may be combined for these purposes, unless you have prevented such combination. We use your personal data for the following purposes:

1. Provision of services and customer service

We collect and use your personal data to process orders, deliver products and services, provide customer service, and manage payments, contracts and transactions.

The information required to provide our services varies depending on the product or service, and on whether you are a consumer or a business customer. For example, online services may require user authentication, whilst electricity contracts require the storage of meter readings. Our customer service team processes your requests and messages in order to serve you or your organisation. Customer service may also offer you the contract or service best suited to your needs based on the information we hold about you. We may contact you regarding matters relating to your contract by telephone, post, email, text message, via our chat service, and through other digital channels, such as social media.

The processing of your data as part of the provision of our services and customer service is typically based on a contract and, in business relationships, on a legitimate interest. Where required by law, we will ask for your consent to provide certain services. Such services include, for example, location-based services.

2. Sales, marketing and stakeholder communications

We may contact you for marketing purposes even if you are not our customer. We will ask for your consent to contact you where required by law. In other cases, our contact is based on legitimate interest. We may, without your consent, send automated electronic marketing messages relating to your customer relationship, and use traditional marketing channels (such as post, telephone and door-to-door sales) where permitted by law.

We also organise prize draws and competitions.

In addition to our own marketing and sales activities, we use salesand marketing partners who may contact you based on their own customer lists to tell you about our products and services, or to sell our products and services at their own premises.

Below, you can read more about the different marketing methods. In section 10, you can read about how to manage your marketing preferences.

2.1 Customer marketing

Customer marketing is automated digital marketing sent without consent to existing customers and business customers.

We regularly send offers and information about products and services relevant to the customer relationship to our consumer customers who currently subscribe to our products and services. We send these messages to the contact details (telephone or email) you have provided in connection with your customer relationship.

To our business customers (employees and business partners of our current and potential client companies, as well as other stakeholders) we send offers and information about products, services and promotional events relevant to their professional roles. We send these messages to the work contact details we have received from the customer, their organisation or a public source.

2.2 Consent-based marketing

We will send you automated electronic marketing messages and newsletters if you have given your consent to receive them. This marketing may include information about the products and services of companies within the Neve Group or those of our partners. We may also collect consent for marketing on behalf of our partners.

2.3 Traditional marketing channels

We may use traditional marketing channels (post, telephone, door-to-door sales) to contact you about our products and services, as well as those of our partners, unless you have opted out of the use of your contact details.

2.4 Online advertising

We advertise our products and services online to users who visit our website or our partners’ websites. Advertising is carried out by placing retargeting cookies or pixels on these sites, which enable us (or a third party acting on our behalf) to display a Neven advert to the same user on other websites. We may target you with advertising on social media based on your telephone number or email address, unless you have opted out of this. We also purchase advertising services from partners who target messages promoting Neve’s products and services to audiences that are important to Neve. In such cases, Neve does not process personal data itself.

2.5 Data used to optimise sales and marketing (“Profiling”)

In our marketing and advertising, we use and combine data collected during the customer relationship and from customer surveys, online behaviour data, and derived data which, for example, predicts users’ areas of interest. Based on this data, we can make our marketing more engaging and effective, and send you more personalised offers. You may also receive a targeted offer, for example, because you have recently moved house.

2.6 Stakeholder relations

We manage our stakeholder relations by communicating on relevant topics and promoting the events we organise. Messages are sent by email directly to email addresses obtained from stakeholders or their organisations.

3. Product and service development

We process personal data to improve and develop better services for our customers, to support decision-making in our business, and to take into account our customers’ feedback and needs. The processing of data for product and service development is based on legitimate interest or consent. Data is processed, for example, by collecting feedback directly from users via surveys, test panels, interviews, forms and other market research methods, analysing data generated from the use of our services, recording or transcribing calls for trainingand quality assurance purposes, and by testing system functions using temporarily stored sample data collected during normal use of the service.

Data processing in our product and service development is carried out using pseudonymised data to the extent possible. If we have collected your actual contact details in connection with a survey or have interviewed you in person, we may provide further information on the use of your contact details in connection with the survey or interview.

In our analytics, we compile large amounts of service usage data and use it to create statistical models, reports, forecasts and trend analyses to support business decision-making, as well as to produce analyses of the performance of a service or feature, and to identify customer segments which are used to improve our sales and marketing as described in section 2.5.

4. Legal obligations

We process personal data to fulfil our legal obligations, which we have, for example, under accounting and tax laws, the Whistleblower Protection Act and anti-money laundering legislation.

5. Defending legal rights and ensuring security

We use personal data to ensure the security of our data, premises, products, services, customers and staff. We carry out standard due diligence checks on our business partners. When personal data is processed in connection with legal claims, debt recovery, credit checks, ensuring data security, and preventing fraud and misconduct, the legal basis is typically a legitimate interest. Personal data is used to ensure the security of our products and services, for example by collecting usage logs and system backups, as well as by authenticating users and preventing attacks.

We retain personal data only for as long as is necessary, depending on the type of personal data and the purpose for which it is processed. Retention periods may vary depending on the categories to which the data belongs.

Generally speaking, personal data is stored for the duration of the customer relationship and for a further ten years after the end of that relationship. We retain personal data relating to metering data (including data on energy consumption and production) for ten years from the date on which the metering data was obtained.

RETENTION PERIODS FOR PERSONAL DATA

The retention periods mentioned are maximum periods, unless otherwise stated. Data may be deleted earlier. Please note that this list is a summary of the most common retention periods. These retention rules take into account statutory obligations regarding data retention, such as regulations relating to accounting, the electricity market, the Water Act and the Communications Act. Retention periods are typically calculated from the end of the financial year. Pseudonymised and aggregated data may be retained for longer than the periods specified below for reporting and analysis purposes.

Retention schedule – Consumer customers

1. Basic customer relationship data (name, contact details, contact history, invoices, consumption data, transaction data and contract details) 10 years from the end of the customer relationship
2. Data necessary for the defence of legal rights, such as log data In accordance with national limitation periods; typically 10 years from the date of collection. Please note: if a complaint is pending, the data will be retained until it is no longer required.
3. Leads and non-customer data: 3 years from the date of collection
4. Call recordings: 3 years from the date of collection
5. Digital account and login details: 3 years from the last login
6. IT service management data and other temporary data, such as survey responses and campaign participation: 2 years from the date of collection
7. Marketing preferences and contact details, as well as basic data used for customer segmentation. Contact details may be used for marketing purposes until the customer opts out. Contact details will be deleted after opt-out, unless they are required for other purposes. Marketing preferences, such as opt-outs, are retained for 10 years from the end of the customer relationship.
8. Cookie data and other data collected using similar technologies For further information, please see our cookie settings, which you can access via our Cookie and Online Data Policy.

Retention schedule – Business customers

1. Basic customer relationship data (name, contact details, invoices and consumption data containing personal data, for example individual residents of housing cooperatives) 10 years from the termination of your organisation’s / business customer’s customer relationship
2. Data necessary for the defence of legal rights, such as transaction data, log data and project documentation In accordance with national limitation periods; typically 10 years from the date of collection. Call recordings are usually deleted earlier, after 3–5 years.
3. Leads and non-customer data: 3 years from the date of collection
4. IT service management data and other temporary data, such as survey responses and campaign participation: 2 years from the date of collection
5. Marketing preferences and contact details: Contact details may be used for marketing purposes until the customer opts out. Contact details will be deleted after opt-out, unless they are required for other purposes. Marketing preferences, such as opt-outs, are retained for 10 years from the end of the customer relationship.
6. Cookie data and other data collected using similar technologies For further information, please see our cookie settings, which you can access via our Cookie and Online Data Policy.
7. Names in company documents, such as contracts and official correspondence, for as long as the company remains in operation.

If we use automated decision-making that has legal or similarly significant effects on you, we will inform you of this in advance. If automated decision-making is not justified by law or necessary for the performance or conclusion of a contract, we will seek your consent.

You may always express your views or object to a decision based solely on automated processing, and request a manual decision-making process by contacting us using the contact details below.

Our data processing subcontractors or other third parties may process your personal data as described below, to the extent permitted by applicable law.

• Data processors – We use data processing subcontractors to provide our services. Our subcontractors have access to your data when they process it on our behalf. We ensure, through appropriate contractual arrangements, that our data processors process your data in accordance with this policy. Typical service providers that process personal data include, for example, sales and customer service partners, payment and invoicing partners, and providers of IT software and services.
  Where necessary, we may share your personal data with other data controllers on the basis of our legitimate interests, a contract entered into with you, or our legal obligations, including:
• Companies within the Neve Group – Our group companies may process your personal data for the purposes set out in this notice.
• Commercial partners, subcontractors and authorised third parties – We may share your personal data with our commercial partners where necessary, for example for contractual reasons or on the basis of limited legitimate interests, such as to develop services using pseudonymised data.
• Our commercial partners include, for example, electricity network operators, debt collection agencies, postal services, consumer electronics retailers, electric vehicle charging station operators and online advertising partners, as well as other service providers.

Examples of data sharing with our commercial partners:

• When you have purchased our products or services from one of our commercial partners, we often need to exchange information about you as part of managing that relationship and your purchase, so that we can, for example, identify your order and pay our partner.
• When you purchase a product or service from one of our commercial partners through us, you enter into a contract with the commercial partner selling that product or service. In this context, we may pass on your personal data to our partner in order to deliver the service you have purchased.
• When we deliver the product or service you have ordered, we may share your contact details with a postal, courier or installation partner for the purpose of delivering the service.
• Limited cooperation in marketing and sales activities.
  In addition, some of our products and services also allow you to share your personal data with other parties.
• Mergers and acquisitions – If we decide to sell, merge or otherwise reorganise our business, this may involve the disclosure of personal data to prospective or actual purchasers and their advisers.
• Authorities, legal proceedings and the law – We will disclose your data to the relevant authorities, such as the police, if required by law. We may also disclose your personal data in connection with legal and regulatory proceedings, pursuant to a court order or legal proceedings, or where otherwise required or permitted by law.

As a general rule, Neve does not transfer personal data outside the European Union (EU) or the European Economic Area (EEA). However, if we do transfer personal data outside the EU or the EEA, we will apply appropriate safeguards in accordance with applicable data protection legislation, such as the standard contractual clauses approved by the European Commission.

We use appropriate organisational and technical security measures to protect your data from loss or misuse. We have a data protection management framework in place that sets out roles and responsibilities at Group level. Our guidelines provide detailed information on how personal data is to be processed within our Group. We organise awareness campaigns to improve our employees’ capabilities in data protection and information security. When we enter into an agreement with a third party for a service that may give that party access to your personal data, the agreement requires that they have in place data security measures of an equivalent standard.

When you use our digital services or visit our websites, we may collect information about your devices using cookies or other similar technologies. Our websites and mobile apps may use cookies and other similar technologies set by third parties. For more information on managing the use of cookies and web data, please read the cookie policies available on the neve.fi website.

The following lists your rights in relation to the personal data we process about you. If you wish to enquire about your rights or exercise them, please contact our customer service team. You can also request a copy of the data we hold about you. Some rights do not apply in all cases; for example, if the data cannot be linked to you.

• Right of access to personal data – You have the right to be informed about the processing we carry out and to request a copy of your personal data.
• Right to rectification – You may request that information concerning you be corrected if it is inaccurate or needs updating.
• Right to data portability – You can obtain the data you have provided to us and reuse it elsewhere. We can provide a selected set of data in a machine-readable format where the basis for processing has been either a contract or consent.
• Right to erasure – We will erase your data at your request if it is no longer lawfully required.
• Right to withdraw your consent – If you have given your consent to the processing of your data, you may withdraw your consent at any time.
• Right to object to processing – You have the right to object to the processing of your personal data on the basis of our legitimate interests, such as the development of our products and services or for other purposes described in sections 3 and 6. We may reject your request if there is a compelling reason to continue processing.
• Right to restrict processing – In certain circumstances, you have the right to restrict the processing of your data.
• Opting out of electronic marketing communications and customer surveys – If you no longer wish to receive marketing communications from us, you can unsubscribe at any time. The easiest way to do this is via the link at the end of the marketing message.
• Opting out of telephone and postal marketing – If you no longer wish to receive marketing calls or letters from us, you can contact our customer service team or inform a customer service representative of this during a marketing call. You can also manage your preferences via the national opt-out register.
• Managing cookies – If you wish to manage cookies on our websites, please use the settings described in the cookie policy on the neve.fi website.

Please note that you may continue to receive marketing messages for a short time after blocking them, until the information has been updated across all systems. We also use marketing partners who present our products and services to you, but who have not received your personal data from us. If you wish to opt out of such marketing or exercise your other rights, please contact the relevant marketing partner directly.

In certain circumstances, the rights mentioned above may be restricted. If we do not act in accordance with your requests, we will explain why. If you are not satisfied with our response or the way we process your personal data, please contact us at tietosuoja@neve.fi. Alternatively, you can contact our customer service team. If you are still not satisfied with the way your data is being processed, you can contact your national data protection authority.

Neve reserves the right to make changes to this privacy policy. Any changes to this privacy policy will be announced on our website or communicated to you directly. Changes may be necessary due to the development of our services or, for example, changes to relevant legislation.