Privacy notice for security and access control

Employees of VTT, visitors, and other persons moving within VTT premises.

Data Controller

VTT Technical Research Centre of Finland Ltd (“VTT”) 
Business ID: 2647375-4
Address: Tekniikantie 21
02150 Espoo, Finland

Data Protection Officer (DPO) – Contact Details 

Address: VTT Technical Research Centre of Finland Ltd
Registry Office
Kivimiehentie 3
02150 Espoo, Finland
Email: [email protected]

Contact Person for the Processing Activity Name: 

VTT Security Unit 
Address: Kivimiehentie 3
02150 Espoo, Finland
Email: [email protected]

The following categories of personal data may be processed:

• Name, email address, telephone number, organisational information, date of birth
• Image and audio of a person in connection with CCTV surveillance and intercom systems
• Access control data relating to access events (e.g. timestamp and location of the access event)
• Visit date and time in the visitor management system
• Change logs and processing metadata relating to the above data categories

Data subjects are persons accessing or present within VTT premises. These include VTT employees, representatives of VTT’s customers and stakeholders visiting VTT, and other persons present on VTT premises.

Personal data is processed for the protection of VTT’s information, property, premises, and people; for the prevention, detection, and investigation of crimes and misuse; and to ensure the safety and legal protection of VTT employees as well as persons visiting or moving within VTT premises.

The data are used for:

• Identifying and investigating access events within the premises
• Monitoring space utilisation (statistical purposes)
• Restricting access to authorised persons only
• Surveillance of premises

Personal data is not processed for employee performance monitoring or working time tracking.

Legitimate Interest (Article 6(1)(f) GDPR)

The processing is based on the data controller’s legitimate interests. These legitimate interests include ensuring the safety and legal protection of employees and visitors, protecting the employer’s and employees’ property, and preventing and investigating crimes and misuse.

In these situations, the controller’s legitimate interests are assessed to override the interests and fundamental rights and freedoms of the data subjects, which are limited only to the extent necessary.

Legal Obligation (Article 6(1)(c) GDPR)

In premises requiring enhanced security, VTT is subject to obligations related to radiation safety as an operator. For this purpose, individuals must be identified in accordance with the Radiation Act (859/2018, Section 22) and the guidance of the Radiation and Nuclear Safety Authority (STUK). On this basis, personal identity numbers and/or data concerning date and place of birth may be processed.

Access Control Systems: Used in all VTT-managed properties to manage personal access rights. Data are obtained from HR systems, directly from the individual, and through use of access credentials.

• CCTV Surveillance Systems: Recording camera systems monitor VTT premises indoors and around property exteriors.
• Intercom Systems: Calls are received via intercom terminals; image and audio are processed and recorded.
• Key Management Systems: Used to manage lock systems and user keys. Data is obtained from HR systems, directly from the individual, and through use of keys.
• Visitor Management Systems: Data is obtained directly from the individual or from the event organiser.

The controller may outsource the processing of personal data to third parties where necessary for the provision of services related to the processing purposes or for ensuring and developing the operation of related technical systems. As a contracting authority, the controller competitively tenders its service providers.

Processing has been outsourced to the following service providers acting on behalf of the controller:

• Employees of the company providing VTT reception services
• Employees of the company providing VTT security control room services
• Providers of other VTT security systems

Applicable legislation may require disclosure of personal data in individual cases. Personal data are disclosed to the police or other competent authorities in cases specifically provided by law, for example for the investigation of crimes. Disclosures are always based on a specific request from the authority.

Personal data are not transferred outside the European Union or the European Economic Area.

No automated decision-making, including profiling, is carried out in connection with this processing.

Personal data are retained for as long as necessary for the purposes of processing or for compliance with the controller’s statutory obligations. Thereafter, the data are deleted or anonymised unless a valid legal basis for further processing exists. Retention periods take into account, for example, statutory limitation periods.

• Access control data: Retained for the duration of the employment or service relationship and for two (2) years thereafter
• CCTV recordings: Generally retained for one (1) month
• Intercom recordings: Generally retained for one (1) month
• Key management system data: Retained indefinitely
• Visitor management system data: Retained for one (1) year

Personal data are processed in secure information systems and controlled premises. Personal data are processed by VTT employees and employees of VTT’s service providers who have a justified need to process the data based on their job duties and who are bound by confidentiality obligations.

Data subjects have the following rights, which may be restricted in accordance with the GDPR. These rights may be exercised by contacting the controller using the contact details in Section 2.

Exercise of rights requires reliable identification of the individual. If the controller cannot identify the data subject, the rights generally do not apply unless additional identifying information is provided. Any restrictions or derogations are assessed on a case-by-case basis.

Right of Access

The data subject has the right to obtain confirmation as to whether personal data concerning them are being processed and to access those personal data, including the information required under the GDPR.

Right to Rectification

The data subject has the right to have inaccurate or incorrect personal data rectified and incomplete data completed.

Right to Erasure

The data subject may request erasure of personal data, for example where:

• the data are no longer necessary for the purposes for which they were collected;
• the data have been unlawfully processed;
• erasure is required to comply with a legal obligation; or
• the data subject objects to processing based on legitimate interests.

Right to Restriction of Processing

The data subject has the right to request restriction of processing, for example where:

• the accuracy of the data is contested;
• processing is unlawful and erasure is opposed;
• the controller no longer needs the data, but the data subject needs them for legal claims; or
• the data subject has objected to processing.

Right to Object

The data subject has the right to object, on grounds relating to their particular situation, to processing based on the controller’s legitimate interests.

Right to Lodge a Complaint

The data subject has the right to lodge a complaint with a supervisory authority if they consider that their rights under the GDPR have been infringed.

Contact details of the Finnish Data Protection Ombudsman: [email protected]