Digital privacy policy

1. Personal data and its processing

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or online identifiers, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing of personal data is anything done with personal data, that is, any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2. Åland Post's processing of personal data

2.1. Collection and erasure of personal data

When you visit or use Åland Post's digital services or its services, or communicate with Åland Post in our digital services, Åland Post may collect information about you, such as your name, address, postal address, email address, phone number, identification details, information about your use of Åland Post's services and products, transaction history and, for some services, location data. Where applicable, your personal identity number, information about your interest in products or services, how you want to be contacted, background information related to education or work, and information related to a job you are applying for may also be processed.

Åland Post may also collect technical data about the devices you use to access Åland Post's digital services, such as IP address, unique device ID, browser type and cookie information. The actions described in this paragraph may take place, for example, when you fill in forms, sign up for newsletters, communicate with Åland Post via social media platforms, give feedback in contact forms or by phone, or use the customer-specific services that Åland Post provides.

When you contact Åland Post through customer service via our digital services, for example when you make a claim, your contact details and case information will be processed by Åland Post. If you visit or communicate with Åland Post via our social media accounts (that is, third-party platforms such as Facebook, Twitter, LinkedIn, Instagram and YouTube), Åland Post may receive information about your profile and your interactions on the third-party platform from the platform provider.

Åland Post has placed so-called "cookies" in several of its digital services. These cookies collect information about how you use the digital service. More information about which cookies Åland Post has placed in its digital services, and how to remove these cookies, can be found in Åland Post's cookie policy at www.alandpost.ax/cookies. Åland Post will only process personal data for as long as necessary to fulfil the purposes of the processing or to meet Åland Post's legal obligations.

2.2. Storage of personal data

The stored data may be kept in Finland or in another country where Åland Post operates.

2.3. For what purposes is personal data processed?

The personal data about you collected in connection with your use of the digital services and their services will be processed by Åland Post, or its sub-processors, for the following purposes.

1. To enable Åland Post to provide the products and services you have ordered and to administer Åland Post's agreement with you.
2. To enable Åland Post to communicate with you when you contact us via customer service, email forms and Åland Post's social media accounts.
3. To administer marketing activities, such as competitions and prizes, and for marketing purposes, including marketing by post, email and text message.
4. To process your payment or to prevent or detect fraud.
5. To analyse and group visitors by selection, priority and preference, which means that so-called profiling takes place, in order to provide you with relevant and personalised information, recommendations, advertisements and offers. Data from the use of different Åland Post digital services may also be combined for this purpose and for developing products and services. Personal data may also be processed to produce statistics on the use of Åland Post's digital services and their services.
6. To maintain, develop, test and improve Åland Post's digital services and the technical platforms on which they are provided.

2.4. Legal basis and legitimate interests for the processing of personal data

Åland Post always processes your personal data in accordance with applicable legislation. Åland Post processes your personal data when it is necessary to perform an agreement with you or to respond to your customer service request, and when Åland Post has another legitimate interest in processing your personal data, for example an interest in marketing Åland Post to visitors to its digital services or an interest in developing its digital services. If Åland Post were to process your personal data for a purpose that requires your consent under applicable legislation, Åland Post will obtain your consent in advance.

3. Security to protect personal data

Åland Post is committed to a high level of security for your personal data and takes appropriate technical and organisational security measures to protect your personal data from unauthorised access, alteration, dissemination or destruction. Åland Post and its employees are bound by a duty of confidentiality under the Åland Postal Services Act (2007:60). Other information about Åland Post's customers is also treated confidentially.

4. Restrictions on the disclosure of personal data

Åland Post may engage external partners and suppliers to perform tasks on Åland Post's behalf, for example to provide IT services and payment solutions or to help with marketing, analysis or statistics. Providing these services may mean that Åland Post's partners, both within the EU/EEA and outside the EU/EEA, get access to your personal data. Companies that handle personal data on Åland Post's behalf always sign an agreement with Åland Post to ensure a high level of protection for your personal data with Åland Post's partners as well. For partners outside the EU/EEA, special safeguards are taken, such as agreements that include standard contractual clauses for data transfer adopted by the European Commission and available on the European Commission's website. Åland Post may disclose personal data to third parties, such as the police or another authority, if it concerns the investigation of a crime or if Åland Post is otherwise obliged to disclose such information by law or by a decision of an authority. Åland Post will not disclose your personal data to any extent other than as described in this section 4.

5. External links

This privacy policy applies to information that Åland Post processes about you within Åland Post's digital services. Åland Post's digital services may sometimes contain links to external websites or services that Åland Post does not control. If you follow a link to an external website, you are advised to read the principles for processing personal data and the cookie information that apply to that site.

6. Right to information and right to lodge a complaint

In accordance with applicable data protection legislation, you have the right at any time to request access to the personal data processed about you, to have incorrect personal data corrected, to have Åland Post stop processing and erase your personal data, to have the processing of your personal data restricted, to exercise your right to data portability and to object to the processing of your personal data. In such cases, please contact Åland Post at the address given in section 8 below. You also have the right at any time to lodge a complaint with the relevant supervisory authority if you believe that your personal data is being processed in breach of applicable data protection legislation.

7. Processing of personal data about children

Åland Post's digital services are not aimed at children, and Åland Post therefore does not knowingly collect personal data about children. If you are a parent or guardian and become aware that your child has provided personal data to Åland Post, please contact Åland Post at the addresses given in section 8 below so that you can exercise your rights, for example regarding correction or erasure.

8. Contact information

The controller responsible for processing your data is Åland Post Ab. Åland Post has appointed a data protection officer. If you have any questions about how Åland Post processes your personal data, you are welcome to contact Åland Post's data protection officer at dataskydd@alandpost.com or by post:

Åland Post Ab
Dataskyddsombud
PB 1000
AX-22110 Mariehamn Åland, Finland

9. Changes to this privacy policy

Åland Post may make changes to this privacy policy from time to time. The latest version of the privacy policy is always available on Åland Post's website.

10. Processing of employees' personal data

Åland Post only uses employees' personal data to comply with laws and agreements or to protect employees' safety and security. Åland Post holds employees' personal data to administer HR matters, salaries and other HR-related tasks. Åland Post shares personal data in third-party systems to manage HR administration. The processing of employees' personal data follows current legislation, and only data that is legally required is stored for more than two years. Personal data is only shared with persons with specific authorisation.