1. Data controller

L-Fashion Group Oy
Business ID: 0149158-5
Postal address: PL 55, 15501 LAHTI, Finland
Telephone: +358 (0)3 822 111 (switchboard)

2. Contact information for matters related to the register

If the matter pertains to the processing of personal data or the use of the rights based on GDPR in the L-Fashion Group Oy’s whistleblowing channel, you may contact the Data Protection Officer of L-Fashion Group Oy. You can contact the Data Protection Officer by email at dataprotection@luhta.fi.

3. Register name

Privacy policy for L-Fashion Group Oy’s whistleblowing channel.

4. What data do we process?

L-Fashion Group Oy aims to collect only necessary personal data in order to investigate cases reported through the whistleblowing channel. L-Fashion Group Oy may collect and process the following personal data:

•first name and last name
•date of birth
•social security number
•address, postal code and city
•email address
•phone number
•gender
•preferred language of communication
•profession and employer
•any other information provided regarding the suspected offence or misconduct
•photos and video footage
•other report details or information provided

The personal data processed typically concerns the person filing the report or the object of the report.

The person filing the report decides what information they wish to disclose. The report form has free text fields that allow the reporter to disclose information other than the aforementioned personal data, including data belonging in special personal data categories. Personal data included in the report that is clearly not relevant to the investigation will be erased without undue delay.

L-Fashion Group Oy’s whistleblowing channel allows you to file a report completely anonymously. Anonymity reduces the amount of personal data processed. Anonymity may delay or hinder the investigation.

5. Purpose and legal basis of processing personal data

The purpose of processing personal data is to process reports filed through the whistleblowing channel. Data is processed during the investigation of reported cases and the processing of any subsequent consequences.

L-Fashion Group Oy collects and processes personal data referred to in this privacy policy for purposes such as:

•to process, investigate and report on reports filed through the whistleblowing system and related decision-making
•to ensure that legal, contractual and L-Fashion Group Oy’s own guidelines and regulations are observed
•to prevent and address criminal offences and other cases of misconduct and forward them for further investigation
•to protect legal rights
•to fulfil statutory obligations.

The fulfilment of statutory obligations and L-Fashion Group Oy’s legitimate interest constitute the legal basis for processing personal data.

6. Where is data collected from?

Personal data is mainly collected from the person filing the report through the whistleblowing channel. Reports are filed by L-Fashion Group Oy employees and external stakeholders.
L-Fashion Group Oy may also collect personal data from L-Fashion Group Oy’s internal systems, entities related to the report and relevant authorities, if necessary for the investigation process.

7. Information on the recipients of the personal data

Personal data is only processed by named L-Fashion Group Oy employees.
Data may be disclosed to third parties, such as authorities or external auditors, to the extent permitted and obliged by law, for example, when responding to authorities’ information requests or if L-Fashion Group Oy’s legitimate interest so requires, for example, for the purpose of reporting an offence, preliminary investigation or court proceedings.

8. Transfer of data outside the EU or EEA

Data shall not be transferred outside the EU or EEA.

9. Register protection principles and data retention period

Only the employees authorised by the data controller shall have the right to access the register and process reports. The processors shall observe professional confidentiality. The register and reports are protected with conventional firewalls and/or passwords.

The appropriate level of security and privacy protection of personal data, including protecting the data against unauthorised processing and accidental destruction, has been ensured by using Webropol Oy’s secure whistleblowing channel platform and providing the data controller’s authorised employees with training on secure report processing.

The data is stored only as long as, and to the extent that, it is necessary for the purposes specified in this privacy policy. Data received through the whistleblowing channel shall be erased within five (5) years of the receipt of the report, unless it is necessary to store the data longer for the purpose of enforcing statutory rights or obligations or preparing, presenting or defending a legal claim. Personal data that is clearly irrelevant to the processing of the report shall be erased without undue delay.

10. Rights of data subjects

The data subject has the right to know what data has been collected of them and access data concerning them.

The data subject also has the right to request the rectification or erasure of their data. The data shall be erased if there is no legal basis or obligation for the processing of the data.

The data subject may, under certain conditions, request the restriction of the processing of their data or object to the processing of their data.

The data subject may exercise their rights under valid data protection legislation by contacting L-Fashion Group Oy at dataprotection@luhta.fi.

L-Fashion Group Oy shall address data subjects’ requests, as referred to herein in section 10, as soon as possible. L-Fashion Group Oy may request the data subject for more information.

L-Fashion Group Oy may charge a fee for fulfilling the data subject’s request or refuse to fulfil the request if L-Fashion Group Oy deems the request manifestly unreasonable or unfounded.

11. Information about automated decision-making and profiling

L-Fashion Group Oy does not use automated decision-making or profiling in the processing of personal data as described herein.

12. The right to lodge a complaint

If the person filing the report or other person considers the processing of their personal data by L-Fashion Group Oy to violate the provisions of the EU’s General Data Protection Regulation, the person may lodge a complaint with a supervisory authority in their permanent place of residence or place of work or where the person considers the violation of the provisions to have happened. In Finland the authority in question is the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

Street address: Lintulahdenkuja 4
00530 Helsinki, Finland

Postal address: PL 800
00531 Helsinki, Finland
Phone (switchboard): + 358 29 56 66700
Email: tietosuoja@om.fi