Our privacy policy

Insta respects your privacy and your personal data. Insta follows the European data protection principles and adheres to all applicable legislation related to the processing of personal data.

Data controller and contact details

Insta respects your privacy and your personal data. Insta complies with the European data protection principles and adheres to all applicable legislation in processing of personal data.

Street Address: Sarankulmankatu 20, FI-33901 Tampere, Finland

Phone: +358 20 771 7111

Contact person: Henna Pekkanen, data protection officer, tietosuoja@insta.fi

Privacy Statements

Customer Data

Purposes and legal bases for the processing

The purpose of processing personal data of Insta’s potential and existing customers is communication and customer relationship management, delivery and development of services and products, sales and marketing, customer service and support, as well as organization of events, competitions, and giveaways.

The processing is based on the legitimate interest of Insta to sell, deliver, develop, and market products and services, manage customer relationships, as well as organize events, competitions, and giveaways.

Insta marketing communications may in certain situations be based on your consent. You have the right to withdraw your consent at any time.

Categories of personal data

• Name

• E-mail address

• Phone number

• Company or other organization and title

• Company address

• Possible additional data provided by you

• Customer relationship data, such as contact history, feedback, products and services in use

Sources of Personal Data and Storage Period

Primarily the personal data has been collected from you or your employer. Other sources include the Finnish Trade Register, Suomen Asiakastieto, the website of your employer, various events and public data from different services, such as LinkedIn.

The storage time of your personal data depends on the purpose for the processing. The data is stored only for as long as is necessary for each purpose.

Disclosures and Transfers of Personal Data

Insta uses service providers who process your personal data on behalf of Insta under an agreement and instructions from Insta. Insta also may share personal data within Insta Group.

Insta processes your personal data within the EU/EEA. Some of Insta’s service providers process personal data also outside the EU/EEA. In these cases, the personal data is protected by using the standard contractual clauses by the European Commission or other adequate safeguards as set forth in data protection legislation.

Rights of the Data Subjects

If you have any questions, concerns or requests concerning the processing of personal data by Insta, you may contact the data protection officer of Insta at tietosuoja@insta.fi.

You have the right at any time to request access to your data. Insta will rectify or remove possible incomplete, incorrect or outdated personal data based on your request.

As a subscriber of our newsletter, you have the possibility to unsubscribe from the newsletter through an unsubscribe link included in each newsletter.

In some situations, you have the right to object to the processing of your personal data or request that the processing of your personal data is restricted. You also have the right to lodge a complaint to the data protection authority (www.tietosuoja.fi).

Recruitment

Purposes and legal bases for the processing

The personal data is processed for the purposes of employee recruitment.

The processing is based on the legitimate interest of Insta. The concerned legitimate interest of Insta is the fulfilment of open positions at Insta Group.

During the recruitment process Insta may ask for your permission to carry out a candidate evaluation in accordance with the applicable legislation.

Categories of Personal Data

• Name, phone number, e-mail address

• information provided in the job application, resume and other data provided during the recruitment process

• possible references and/or the names and contact details of the referees

• the results of a demonstration of skill or candidate evaluation (where applicable)

If required for the concerned open position, a background check, a drug test or a credit information check can be carried out.

Sources of Personal Data and Storage Period

Your personal data is mainly collected from you either directly or through the recruitment service.

If candidate evaluation is required for the concerned open position, this is done with your permission and Insta receives the result of the evaluation from the evaluation service provider.

With your permission, Insta may contact the referrers whose contact details you have provided and inquire necessary information about you. The current employees of Insta may also recommend possible candidates by adding names and contact details to the recruitment service.

Your personal data will be retained for 18 months after your most recent application or after you’ve updated the data.

Disclosures and Transfers of Personal Data

Insta uses service providers who process your personal data on behalf of Insta based on an agreement and subject to the instructions of Insta.

Your contact information is disclosed to a service provider in connection with the candidate evaluations.

Some of the service providers used by Insta process personal data also outside the EU/EEA. In these cases, the personal data is protected using the standard contractual clauses by the European Commission or other adequate safeguards required by data protection legislation.

Rights of the Data Subjects

If you have any questions, concerns or requests regarding the personal data processing at Insta, you may contact the Data Protection Officer of Insta at tietosuoja@insta.fi.

You have the right at any time to request access to your data. Insta will rectify or remove possible incomplete, incorrect or outdated personal data based on your request.

In some situations, you have the right to object to the processing of your personal data or request that the processing of your personal data is restricted. You also have the right to lodge a complaint to the data protection authority (www.tietosuoja.fi).

Visiting Insta’s Premises

Purposes and legal bases for the processing

The purpose of processing personal data is to identify Insta’s visitors, manage visitor information, collect confidentiality agreements, and carry out camera surveillance for security purposes.

The legal basis for processing personal data is the pursuit of Insta’s legitimate interests. Insta’s legitimate interest lies in hosting Insta’s visitors and ensuring security.

Categories of Personal Data

• Visitor’s name and organization

• Host and date of the visit

• Facilities involved in the visit

• Personal data included in the confidentiality agreement

• Camera surveillance captures images of individuals on the premises, along with the time and location of events, as well as vehicles at entry gates.

Sources of Personal Data and Storage Period

The personal data is collected either from the visitor or from the host of the visit. Camera surveillance recordings are generated as individuals move within monitored areas.

Your visit information will be retained for two (2) years.

The retention period for camera surveillance recordings is four (4) months, after which the recordings will be automatically overwritten.

Disclosures and Transfers of Personal Data

Insta uses service providers to provide lobby services and property security services. These service providers process your personal data on behalf of Insta according to a contract and Insta’s instructions.

Camera surveillance recordings may be disclosed to authorities in case a crime has occurred or is suspected.

Personal data is not transferred outside the EU/EEA area.

Rights of the Data Subjects

If you have any questions, concerns or requests regarding the personal data processing at Insta, you may contact the Data Protection Officer of Insta at tietosuoja@insta.fi.

You have the right at any time to request your personal data from Insta. Based on your request, Insta will rectify or delete possible faulty, incorrect or expired personal data.

In some situations, you have the right to object to the processing of your personal data or request that the processing of your personal data is restricted. You also have the right to lodge a complaint to the data protection authority (www.tietosuoja.fi).

Visiting Insta’s website

Purposes and legal bases for the processing

The purpose of processing personal data is to manage inquiries received through contact forms or chatbots on the website and to deliver marketing communications to subscribers of newsletters. Additionally, some of the cookies used on the website contain personal data. Cookies are used to ensure the proper functioning and development of the website, remember user choices, and improve advertising targeting.

The processing of personal data for managing inquiries is based on Insta’s legitimate interest. Insta’s legitimate interest lies in maintaining customer relationships and ensuring effective communication.

The processing of personal data for delivering marketing communications via newsletters is based on your consent. You have the right to withdraw your consent at any time. As a newsletter recipient, you have the option to unsubscribe from the newsletter by using the “unsubscribe” button found at the bottom of each newsletter.

Insta requests your consent for the use of all cookies that are not essential for the website to function correctly. The processing of personal data stored in necessary cookies is based on Insta’s legitimate interest to ensure the proper functioning of its websites. Learn more about cookie usage and manage your consent related to cookies in our Cookie Policy.

Categories of Personal Data

• the messages and contact information you provide via contact forms or chatbot, such as name, email address and phone number

• personal data collected through cookies, including IP address, geographical location, device or browser-related information (such as operating system and browser type) and website visit data (such as visited pages and session duration)

Sources of Personal Data and Storage Period

Your personal data is collected from you.

The storage time of your personal data depends on the purpose for the processing. The data is stored only for as long as is necessary for each purpose.

Disclosures and Transfers of Personal Data

Insta uses service providers who process your personal data on behalf of Insta under an agreement and instructions from Insta.

Some of the service providers used by Insta process personal data also outside the EU/EEA. In these cases, the personal data is protected using the standard contractual clauses by the European Commission or other adequate safeguards required by data protection legislation.

Rights of the Data Subjects

If you have any questions, concerns or requests regarding the personal data processing at Insta, you may contact the Data Protection Officer of Insta at tietosuoja@insta.fi.

You have the right at any time to request your personal data from Insta. Based on your request, Insta will rectify or delete possible faulty, incorrect or expired personal data.

As a subscriber to our newsletter, you have the right to unsubscribe from the newsletter through an unsubscribe link included in each newsletter.

In some situations, you have the right to object to the processing of your personal data or ask that the processing of your personal data is restricted. You also have the right to lodge a complaint to the data protection authority (www.tietosuoja.fi).

Whistleblowing reporting channel

Purposes and legal bases for the processing

The purpose of processing personal data is to receive reports of suspected violations and misconduct under the Act on the Protection of Persons Reporting Infringements of European Union and National Law (the Whistleblower Act, 1171/2022), as well as to detect and investigate them. Additionally, the processing aims to receive and investigate reports other than those covered by the Whistleblower Act. These other reports may relate to actions contrary to Insta’s ethical guidelines or other directives.

For reports covered by the Whistleblower Act, the processing of personal data is based on the data controller’s legal obligation. Insta has a legal obligation under the Whistleblower Act to provide a channel for reporting suspected violations and misconduct, as well as to take necessary actions based on the reports to investigate cases.

For reports other than those covered by the Whistleblower Act, the processing is based on Insta’s legitimate interest in obtaining information about misconduct related to the company’s operations in order to address them.

Categories of Personal Data

The personal data processed in the whistleblowing channel varies depending on the nature of the report. The processed personal data may include the following:

• Whistleblower’s name and email address, if provided in the report

• Personal data related to the whistleblower, alleged violation or misconduct perpetrator, and other individuals involved in the case as indicated in the report

• Personal data collected and gathered during the investigation of the case, such as video recordings and log data

• Personal data related to the handler of the report such as name, email address, and data stored in the log data of the whistleblowing channel

Depending on the nature of the report, personal data may include special categories of personal data or personal data relating to criminal convictions and offences. Insta processes such data only when necessary for the investigation of the case and when there is a legal basis under the data protection regulation. Personnel handling the reports are bound by confidentiality obligations.

Sources of Personal Data and Storage Period

Primarily the personal data is collected from the whistleblower. The whistleblowing channel is open to everyone, and the potential whistleblowers include, for example:

• Insta’s employees

• Insta’s suppliers and subcontractors

• Insta’s customers

• Other stakeholders of Insta

In addition, Insta may collect information from other sources during the investigation process, such as video recordings, logs from other systems used by Insta, or from other persons involved in the case.

Insta retains personal data only for as long as necessary for the investigation of the report, up to a maximum of five years from the receipt of the report, unless further retention is necessary for the implementation of rights or obligations stipulated in the Whistleblower Act or other laws, or for the establishment, exercise, or defense of legal claims.

Personal data unnecessary for the investigation will be deleted without undue delay. The necessity of the data is regularly assessed.

Disclosures and Transfers of Personal Data

Insta uses service providers who process your personal data on behalf of Insta under an agreement and instructions from Insta.

Information may be disclosed to authorities in case a crime has occurred or is suspected.

Insta processes your personal data within the EU/EEA. Some of Insta’s service providers process personal data also outside the EU/EEA. In these cases, the personal data is protected by using the standard contractual clauses by the European Commission or other adequate safeguards as set forth in data protection legislation.

Rights of the Data Subjects

You have the right at any time to request your personal data from Insta. Your right to access can be restricted under the Whistleblower Act if it is necessary and proportionate to ensure the accuracy of the report or to protect the identity of the whistleblower. If only part of the data is excluded from the right of access, you have the right to receive the remaining data that concerns you. Your right to access data may also be restricted if fulfilling the data subject’s request would adversely affect the rights and freedoms of others.

Insta will rectify or remove possible incomplete, incorrect or outdated personal data based on your request, unless there is a reason or obligation to retain the data.

You have the right to object to the processing of your personal data based on your particular situation if the processing is based on Insta’s legitimate interest, unless Insta has a compelling and justified reason for the processing or the processing is necessary for the establishment, exercise, or defense of legal claims.

In some situations, you have the right to request the restriction of the processing of your personal data. Your right to restrict processing does not apply to the processing of personal data referred to in the Whistleblower Act.

You also have the right to file a complaint with the supervisory authority regarding any issues related to the processing of your personal data on the website of the Data Protection Ombudsman’s office.

Updated 24.5.2024