VILPE Oy is committed to the responsible management, use, and protection of our business partners’ personal information. This text sets out VILPE Oy’s Supplier Privacy Policy, which applies to our business partners and their agents or representatives.

Privacy Policy: Supplier Register

Section 24 of the Personal Data Act (523/1999)

Section 7 of the Act on the Protection of Privacy in Electronic Communications


1. Controller

VILPE Oy (0558172-1)
Kauppatie 9, FIN-65610 Mustasaari, Finland
Sales and technical support tel. +358 20 123 3233

2. Contact Person in Data File-Related Matters

VILPE Oy
Office Manager Mervi Koskela
Kauppatie 9, FIN-65610 Mustasaari, Finland
Tel. +358 20 123 3226
mervi.koskela(at)vilpe.com


3. Name of the Data File

Supplier register of VILPE Oy.


4. Purpose of Processing Personal Data

The register contains contact and other information about suppliers, clients and other partners and affiliates. The main use of the register is to manage, handle and maintain relationships with the aforementioned parties. The personal data in the register is used to communicate, co-ordinate and co-operate, as well as billing and handling obligations and commitments. In addition, the data is used to evaluate and give feedback to the subjects of the data.

The basis for handling personal information is the legitimate interest of the register holder.


5. Data Content of the File

General identification details and basic information will be entered into VILPE Oy’s corporate information system:

  • Date and time of registration
  • Person’s name
  • Person’s phone number
  • Person’s email address
  • Person’s gender
  • Department in organisation
  • Title
  • Responsibilities within the organisation
  • Date of birth
  • Open text, focused information for suppler relationship management
  • Log of communications


6. Storage Time of Personal Data

Personal data is stored for up to a maximum of two (2) years after the termination of the supplier relationship, or up to two (2) years after the supplier has informed the register holder of the termination of employment of the subject of the data. The subject of the data can demand the removal of the data from the register after all obligations and commitments between the register holder and the supplier have been fulfilled. The data can also be marked as archived/non-active before this time.


7. Collection of Personal Data

Personal data is collected after a relationship has been formed or when the supplier is being evaluated, either from the supplier or from a person directly registered by the supplier. Data can also be collected regarding the organisation from third party registers such as the Finnish patent and registration office (PRH).


8. Transfer of Data

The data can be transferred to the register holder’s parent and daughter companies for the purposes described in this document’s article 4., for the register holder’s direct marketing purposes, or to the register holder’s personal data records. Transfers are always made in accordance with current data protection and security regulations.


9. Transfer of Data to Outside the EU or EAA

The data will not be transferred outside the EU or EAA.


10. Principles of Securing the Data File

A. Manual material
Kept in a place where access is restricted to designated persons.

B. Electronically recorded data
The personnel of VILPE Oy and external persons acting on its behalf who participate in processing the data are bound by an obligation of confidentiality regarding all data in the register. Access to the data file is protected by usernames, passwords and access rights.


11. Profiling

The register holder can use the data for supplier profiling. Supplier profiling is achieved with the help of identifiers, with which the data generated by the service, concerning the subject of the data, can be combined. The resulting profile can be used, for example, for comparisons with other profiles created in a similar manner. The purpose of supplier profiling is to examine the demand for products and services, as well as other behaviour.


12. Data Subject Right to Object to Handling of Data and Direct Marketing

The subject of the data has the right to object to supplier profiling and other data handling activities which the register holder may perform using the subject’s data, when the basis for the data handling activities is the supplier relationship between the subject of the data and the register holder. The subject of the data can present their objections by the means specified in this document’s article 14. (‘Contact’). The subject of the data will need to specify the particular instances which their objections are based on. The register holder can abstain from carrying out requests regarding objections on the basis of current laws and regulations. The subject of the data can at any time accept or withdraw their consent for the use of their data for direct marketing and supplier profiling purposes.


13. Other Rights of the Subject of the Data

Right to Inspection

The subject of the data has the right to inspect what data concerning them has been stored in the register holder’s register. The request for inspection must be made according to this document’s article 14. (‘Contact’). The register holder can abstain from requests to inspect the data on the basis of current laws and regulations. Data inspection requests are usually free of charge when made only once a year.

The Right to Demand Correction of Data, Removal of Data or to Restrict Its Use

The subjects of the data have the right to demand the correction of incorrect data, as well as the right to prohibit the use of their data for direct marketing or similar purposes. Such requests must be made according to this document’s article 14. (‘Contact’). The subject of the data also has the right to restrict the handling of their data: for example, during the process of requesting the removal or correction of data concerning them.

The Right to Transfer Data from the Register

The subject of the data has the right to acquire any information which they have provided to the register (which has been used with their consent or mandate) in primarily machine-readable format to themselves or to be transferred to another register holder.

The Right to Make a Complaint to a Supervisory Authority

The subject of the data has the right to make a complaint to a supervisory authority when the register holder has not acted in accordance with the applicable privacy and data security regulations.

Other Rights

When personal data is being handled on the basis of the consent given by the subject of the data, this subject has the right to withdraw their consent by informing the register holder according to this document’s article 14. (‘Contact’).

14. Contact

In all matters regarding the handling of personal data and in all cases which involve evoking their rights, the subject of the data will need to contact the person specified in article 2. of this document. The register holder or the person specified in article 2. can then, when necessary, ask the subject of the data in writing to clarify their request. The subject of the data’s identity can also be verified, if necessary, before taking action on the request.