This Privacy Statement describes, in accordance with the General Data Protection Regulation (EU) 2016/679, how the Bank of Finland processes the personal data of contractual and cooperating partners and potential contractual and cooperating partners and of their responsible personnel, representatives, owners and beneficial owners, and the rights of the data subjects.
Purpose of the processing of the personal data and the legal basis for the processing
The personal data are processed
- to plan and implement procurement,
- to prepare and enforce contracts,
- to prepare and implement cooperation, and
- for the planning and development of the activities of the Bank of Finland.
The basis for the processing of the personal data is compliance with the legal obligations of the Bank of Finland, when the data are processed
- to fulfil the obligations laid down under the Act on Public Procurement and Concession Contracts, the Act on Public Procurement in the Fields of Defence and Security or the Act on the Contractor’s Obligations and Liability,
- to comply with international sanctions regulations,
- to fulfil obligations related to accounting, financial statements preparation and auditing, or
- to fulfil the obligations set out in the Act on Information Management in Public Administration.
In other processing, the basis for the processing of the personal data is the Bank of Finland’s performance of tasks in the public interest, the preparation and enforcement of contracts, or consent.
The personal data are also processed for archiving purposes in the public interest.
Categories of data subjects, the personal data processed and information sources
Categories of data subjects:
- Members of the governance, management and supervisory bodies, employees, owners, beneficial owners, representatives and persons registered in the Trade Register or an equivalent foreign company register, of candidates and tenderers participating in procurement procedures and of potential subcontractors.
- Reference contact persons indicated by candidates and tenderers participating in procurement procedures.
- Representatives of candidates invited to market surveys and other potential contractual or cooperating partners .
- Members of the governance, management and supervisory bodies, employees, owners, beneficial owners, representatives and persons registered in the Trade Register, or an equivalent foreign company register, of contractual and cooperating partners (including customers and counterparties and their customers) and of potential subcontractors.
- Candidates and tenderers participating in procurement procedures, as well as contractual and cooperating partners and their subcontractors, who are natural persons or sole traders.
- Representatives of public authorities, international institutions and organisations.
The personal data processed are:
- Name, represented organisation, and position in the organisation, including signing rights and possible signature samples
- Contact information
- Personal data contained in the register extracts of the represented organisation
- Date of birth
- Information about sanctions (management, owners and beneficial owners of tenderers and contractual and cooperating partners to the extent required by sanctions regulations)
- Criminal records and business links (candidates and tenderers participating in procurement procedures and members of their governance, management or supervisory bodies or those exercising powers of representation, decision-making or control: no criminal record information is retained, only information on whose criminal record information has been checked and when the information was checked is retained)
- The data subject’s consent to the performance of personal security clearance vetting and the information required for this as well as the results of the vetting (if security clearance vetting is performed) and possible information on integrity monitoring related to an existing security clearance that is in force
- Information possibly obtained through facility security clearance vetting
- Applications to the Defence Forces for exemption of key personnel from military service and the decisions on exemptions if the data subject carries out a task for which an exemption application is justified
- Personal interviews and personal assessments
- Information on the education and professional qualifications as well as the experience and other relevant skills with regard to the procurement object (those participating in tender evaluation, personal interviews and personal assessments).
- Possible contracts with the data subject and the commitments and consents of the data subject
- Invoicing information
- Information regarding the processing of contractual matters and the negotiation and fulfilment of the contract
- Information obtained in connection with monitoring the financial situation and risks of the contractual parties selected through the procurement procedure (e.g. tax debt certificates).
- Visiting information (including any information provided on food restrictions)
- Materials from meetings and appointments
- Communication with the data subject (including identity and log information about any Teams meetings).
Information is mainly obtained from the data subjects themselves or from the organisation they represent. The Bank of Finland also obtains information from public sources such as the Trade Register maintained by the Finnish Patent and Registration Office, the Reliable Partner service maintained by Vastuu Group Oy, Rakentamisen Laatu RALA ry’s business search service and qualification register, Suomen Asiakastieto Oy’s business credit information registers, and the websites of organisations. Information may also be obtained from the public tender documents of other procurement units. Contact information may also be obtained from joint procurement units used by the Bank of Finland. The results of security clearance vetting are obtained from the Finnish Security and Intelligence Service (SUPO).
Recipients or categories of recipients of the personal data
The Bank of Finland may disclose personal data to the Finnish Financial Supervisory Authority (FIN-FSA) or another party if the procurement object will also be used by the FIN-FSA or the other party or if the FIN-FSA or the other party has an option to join the end result of the procurement.
Information on customers, counterparties and representatives of their customers may be disclosed to the ECB and the national central banks participating in the ESCB to the extent that the information is contained in documents disclosed to them.
The Bank of Finland does not, as a rule, otherwise disclose personal data.
Personal data may, however, be disclosed in possible requests for information concerning the data insofar as the data are public on the basis of the Act on the Openness of Government Activities or the party requesting the data otherwise has the right to receive the data (e.g. to the Finnish Competition and Consumer Authority for the purposes of its supervisory tasks).
In a possible dispute or in procurement-related appeal proceedings, the data may be disclosed to a provider of legal services or to the court considering with the matter.
The data may also be disclosed to auditors to the extent that they consider the data necessary for conducting an audit as well as to professional service providers to the extent that they consider it necessary for the provision of professional services.
The following entities are used in the processing of the personal data:
- IT system and IT service providers
- communications service providers
- external consultants used in procurement procedures
- providers of tendering services used in procurement procedures
- the supplier of the Handi invoicing and ordering system
- other providers of financial management services
- providers of translation services
- providers of restaurant services.
Information on the possible transfer of personal data to a third country or an international organisation
The personal data are not, as a rule, transferred outside of the EU or the EEA. In individual cases, however, processors of the personal data may have access to personal data from outside the EU or EEA in connection with support and maintenance activities. If the data are transferred outside of the EU or the EEA, an adequate level of protection of personal data is ensured as required by data protection legislation, for example by transferring data to a country where, by decision of the European Commission, an adequate level of data protection is ensured or using standard contractual clauses approved by the European Commission.
If a candidate or tenderer eligible for participation from outside the EU/EEA region participates in the procurement procedure, personal data may have to be provided to such a tenderer in notifications, decisions and justifications for decisions related to the procurement procedure, in requests for information, and in possible appeal and rectification request processes.
Period for which the personal data will be retained, or the criteria used to determine that period
The personal data will be retained for as long as necessary for the purposes of processing the personal data or to comply with statutory obligations. Insofar as the personal data are included in material that must be archived on the basis of a decision by the National Archives of Finland, the data will be retained permanently in the archives.
General description of technical and organisational security measures
In order to protect the personal data against unauthorised access, disclosure, destruction or other unlawful processing, the personal data are processed in systems that have been protected with appropriate technical data protection solutions, taking potential risks into consideration. Manual material is located in premises to which unauthorised persons are prevented from accessing. Only those employees who need to process the personal data in order to perform their duties have access to the personal data being processed.
Rights of the data subjects
The data subjects in the register have the right:
- to request from the controller access to personal data concerning them and the right to request the rectification or erasure of such data or to restrict or object to processing,
- insofar as processing of the personal data is based on consent, to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, and
- to lodge a complaint about the processing of the personal data with the supervisory authority.
Statutory or contractual requirement to provide information and consequences of failure to provide such information
If a data subject does not provide the necessary information, the contract or planned cooperation cannot be entered into and any contract or cooperation already entered into or initiated might have to be terminated.
