Privacy statement for Valio’s corporate client and partner register

This privacy statement describes how Valio Ltd (“Valio”) processes personal data of the representatives of Valio’s corporate clients, prospective corporate clients, Valio’s partners (such as service providers, journalists and merchants) and prospective partners. In this privacy statement, such above mentioned persons may also be referred to as a “data subject”.

Valio may update this privacy statement as necessary, for example, due to possible amendments in legislation. Valio notifies the data subjects of any material changes in this privacy statement.

1. Controller

Valio Ltd (Business ID: 0116297-6)

Meijeritie 6

00370 Helsinki, Finland

2. Contact person

Privacy officer of Valio: privacy.office@valio.fi, +358 10 381 2185, address: Valio Ltd/Privacy Officer, Meijeritie 6, 00370 Helsinki, Finland.

The data subject may contact Valio’s Privacy Officer in all matters regarding processing of personal data and fulfilling the rights of data subjects.

3. Purpose and Grounds for Processing of Personal Data


3.1 Existing Clients and Partners

If the data subject is a representative of Valio’s existing client or partner, Valio processes personal data of the data subjects for the following purposes:

  • managing and maintaining the customer or partner relationship between Valio and the organization represented by the data subject;
  • carrying out customer satisfaction inquiries;
  • organizing customer, partner and press events;
  • providing, sales and marketing of Valio’s products and services (such as sending newsletters and other marketing materials, and drawing lots); and
  • carrying out market or other surveys, compilation of statistics, and product and service development of Valio Group.

The legal grounds for processing personal data are Valio’s legitimate interests based on the client or partner relationship between Valio and an organization represented by the data subject, or on executing direct marketing or survey. Processing personal data of the data subjects is necessary in order for Valio to take care of communication towards its clients or partners, to inform the clients and partners of the products and services, and to develop its products and services to meet the needs of the clients and partners.

3.2 Prospective Clients and Partners

If the data subject is a representative of Valio’s prospective client or partner, Valio processes personal data of the data subject for the following purposes:

  • marketing of Valio’s products and services (such as sending newsletters, other marketing materials and event invitations, organizing events, product demonstrations, and professional communication); and
  • responding contact requests and product queries.

The legal grounds for processing personal data are Valio’s legitimate interests based on the execution of direct marketing or the appropriate relationship between Valio and the data subject, which ensues, when the data subject leaves a product query or other contact request for Valio. Processing personal data of the data subjects is necessary in order for Valio to be able to respond the data subject’s contact requests and to inform prospective clients or partners of its products and services.

4. Personal Data to be Processed

Valio processes the following personal data of the data subjects:

  • first name and last name;
  • email address and phone number;
  • IP address;
  • the organization represented by the data subject and its location (country), the data subject’s title or position in the organization;
  • customer phone call records;
  • information on the participation for customer, cooperation or press events, and the diet information provided by the participants; and
  • information regarding possible restrictions on direct marketing.

5. Data Sources

Valio collects personal data from the data subject himself/herself (data subject’s contact requests via Valio’s website, exhibitions, etc.), from the data subject’s employer (which is Valio’s customer or partner), and from public sources (e.g. from the website of the organization represented by the data subject). Valio further collects personal data of the representatives of prospective clients from registers of third parties (such as Taloustutkimus).

6. Recipients of Personal Data

Personal data of the data subjects is maintained in the CRM, customer feedback, ERP and ordering systems, whose service providers process personal data on behalf of Valio. In addition, service providers and event organizers who produce Valio’s newsletters, marketing messages and customer satisfaction surveys process personal data on behalf of Valio. On a case-by-case basis, Valio may also disclose data subjects’ personal data to restaurants, hotels, and other partners organizing customer, cooperation or press events, and who process personal data as controllers for their own account.

7. Transfer of Personal Data Outside the EU or EEA

Valio does not transfer personal data outside the European Union or European Economic Area.

8. Retention Period of Personal Data

If the data subject is a representative of Valio’s existing client or partner, Valio retains the personal data for the duration of client or partner relationship between the employer of the data subject and Valio, and for a maximum period of six (6) years calculated from the end of the client or partner relationship.

If the data subject is a representative of Valio’s prospective client or partner, Valio retains the personal data for as long as the data subject works in a position that relates to the marketed product or service. If the data subject wishes to refuse the processing of his/her personal data for direct marketing purposes, Valio retains merely the information regarding the restriction.

9. Protection of Personal Data and Data Security

Valio looks after the data security of personal data with appropriate administrative and technical protection measures. Only such persons to whom processing of personal data is necessary in order to perform their work tasks may process the personal data. The systems containing personal data can be accessed only with separately granted personal usernames and passwords.

The systems and databases containing personal data processed by Valio are located in servers in locked facilities. Only named persons authorized to have access in order to perform their work assignments can access these facilities. Valio has secured the servers and the data network with appropriate firewall and other technical protection. The server platforms are protected by access control systems.

10. Right to Object Processing of Personal Data

The data subject has the right to object the processing of his/her personal data at any time, including the right to object processing of personal data for direct marketing purposes. If the data subject objects the processing for direct marketing purposes, the data subject is no longer able to receive direct marketing messages from Valio. The data subject may also refuse e.g. direct marketing messages sent by email but allow marketing letters.

The data subject must present the request regarding the objection to the contact person specified in Section 2 above. In the request, the data subject must specify the purpose or purposes of processing for which part he/she objects the processing. In addition, if the data subject objects the processing for other than direct marketing purposes, the data subject must specify the grounds for such objection, at the time of presenting the request (e.g. the data subject no longer works for Valio’s corporate client or partner).

If the data subject objects the processing of his/her personal data, Valio may ask the data subject to verify his/her identity or to specify the request before the implementation thereof. Valio may also refuse to fulfill the data subject’s request on the basis of a ground prescribed in the data protection legislation, in which case Valio informs the data subject of such grounds.

11. Other Rights of the Data Subject

According to the applicable data protection legislation, the data subject has at any time the right to:

  • have access to their personal data (right to review)
  • obtain rectification or completion of personal data that are inaccurate;
  • obtain erasure of personal data; and
  • obtain restriction of processing of personal data (e.g. for the time during which the data subject awaits a response for the request to rectify personal data)

The data subject must present the request regarding the exercise of his/her rights to the contact person mentioned in Section 2 above. Valio may ask the data subject to verify his/her identity or specify the request before the implementation thereof. Valio may also refuse to fulfill the data subject’s request, on the basis of a ground prescribed in the data protection legislation. In such case, Valio notifies the data subject of such grounds.

12. Right to Lodge a Complaint with Supervisory Authority

The data subject has a right to lodge a complaint with the competent supervisory authority in case the data subject considers that Valio has not processed his/her personal data in accordance with the applicable data protection legislation. The data subject can lodge the complaint with a supervisory authority of the EU member state where the data subject habitually resides or works, or where the alleged breach of data protection legislation has taken place.


Date: June, 19th 2018