Data controller contact information
The data controller is Veritas Pensions Insurance Company Ltd. (0141187-2). Our address is PO Box 133, (Lemminkäisenkatu 34), 20101 Turku
For what purpose and on what lawful grounds is Veritas processing your personal data?
Veritas manages statutory pension security in accordance with the Employees’ Pensions Act (TyEL) and Self-employed Persons’ Pensions Act (YEL). For the purposes of this duty, we store and process personal data concerning pension recipients. Processing is lawful as processing is necessary for compliance with a legal obligation to which the controller is subject.
Your personal data is processed in the following situations:
- Management of a pension or rehabilitation matter, including the payment of benefits
- Procedures related to the taxation of pensions
- Pension advice, calculation of pension estimates and forming of pension record
- Determination of pension liabilities and related statutory statistics
- Uniform application of legislation.
- In testing of system development if it is deemed necessary to ensure the correct operation of the system
- In incident management and quality assurance
- For registering and follow up of issues in the online service for insured customers
The procedures required for us to fulfil our statutory duties are comprehensively defined by law. We do not process your personal data for any reason other than the aforementioned purposes.
This document is based on the requirements of the EU General Data Protection Regulation.
To whom can Veritas disclose your personal data?
We disclose the necessary personal data only to those parties that have a statutory right to receive data for a purpose specified by law. Such parties include, for example, different authorities. Additionally, for the purpose of processing and storing the data, we use the services of subcontractors and we are, by virtue of the law, liable for their activities as strictly as we are for our own.
For the purpose of processing your pension or rehabilitation matter, the following parties are legally entitled to receive your personal data:
- Your employer
- Finnish Centre for Pensions
- Tax authorities
- Other pension and insurance institutions
- Social Insurance Institution of Finland Kela
- Unemployment fund
- Social welfare authorities
- Labour market authorities
- Execution authorities
- Pension Appeal Court
- Insurance Court
Is your personal data transferred and processed outside the EU/EEA?
Yes. Transfers outside EU/EEA are carried out using transfer mechanisms described in the GDPR.
For how long and on what grounds does Veritas store your personal data?
Veritas Pension Insurance has a legal obligation to store your personal data for the purpose of the implementation of your earnings-related pension security. With regard to the storage of this data, we comply with the provisions of the statutory pension legislation (TyEL, Section 218, and YEL, Section 160). Your personal data is only stored for the period of time that is determined as being necessary for the management of a pension or rehabilitation matter. At the end of the set period, we shall remove your personal data from Veritas’ data systems.
The set time periods are as follows:
- For the management of pension and rehabilitation matters, payment of pensions: throughout the individual’s lifetime plus 5 calendar years thereafter
- For survivor’s pension: for the duration of the payment of the survivor’s pension plus 5 calendar years thereafter
- For pension advice: 5 calendar years (e.g., pension estimates are saved for 5 years from the calculation date)
- For appeals: 50 years, unless the data is required to be stored as pension or insurance documents for a longer time
- Calculation of pension liabilities for an employer: throughout the individual’s lifetime plus 6 calendar years thereafter.
- Information sent using Online service for private customers Messages and activities service is stored for 24 months.
Are you entitled to obtain information about personal data concerning yourself?
You are entitled to get a confirmation about whether personal data concerning you is being processed by Veritas.
If we are processing your personal data, you are entitled to get a copy of this processed information.
Please submit your information request through our website at veritas.fi. An information request requires strong authentication.
We will send the requested information to you no later than one month from the date on which we receive your request. This time limit can be extended to a maximum of two months in certain situations. If the time limit is extended, we will notify you thereof within one month after receiving your request.
How can you complete, correct or remove your personal data?
If the personal data that we send to you is deficient, incorrect or erroneous, you are entitled to request that your information be completed or corrected. This also concerns outdated information. We ask that you submit your completion or correction request to Veritas through our website.
The right to require the removal or deletion of personal data, as intended by the data protection legislation, does not apply to data processing within Veritas’ statutory pension insurance activities, nor to situations in which the data is necessary for the purpose of drafting, issuing or defending a legal claim. Personal data pertaining to pension insurance cannot, therefore, be removed, even on the basis of a demand, during the period of time when the data is necessary for the management of the statutory pension insurance.
However, your personal data will be removed, without any separate request, after the prescribed period of storage has ended.
Can you refuse or restrict the processing of your personal data?
As our activities involve the implementation of statutory pension security, we are obligated to process your personal data and, thus, you cannot refuse or restrict this processing, unless there are clear grounds for such restrictions.
Can you demand the transfer of your personal data to another system?
The right to require the transfer of personal data to another system, as intended by the data protection legislation, does not apply to statutory pension insurance activities and, thus, the transfer of personal data is not possible.
To whom can you lodge a complaint about the processing of your personal data?
In case we refuse to take measures as requested by you, we inform you without undue delay of the legally justifiable reason for our refusal and no later than one month from the date on which we received your request.
If you have received a negative response to your request from Veritas, you can submit the matter for review to the Office of the Data Protection Ombudsman. The contact information to the Office of the Data Protection Ombudsman is provided in our response. You can appeal the decision of the Office of the Data Protection Ombudsman to the Administrative Court in accordance with the Administrative Judicial Procedure Act (Hallintolainkäyttölaki 586/1996). The decision of the Office of the Data Protection Ombudsman contains appeal instructions that guide you through the process of appeal to the Administrative Court.
Is your personal data used for making automated decisions or profiling?
Veritas uses automation in pension processing. With the help of automation, the pension processing is accelerated.
Pension decisions can be appealed. Instructions for appeal are included in connection with the decision.
What personal data does Veritas process?
In order to fulfil our statutory duties, we process information about you that falls within the following two categories of personal data:
• Basic information for identification and communication purposes,
• Information required for the management of pension or rehabilitation matters, pension advice and pension payments and collection.
This information includes:
- Basic information and information for communication and identification purposes: last name, first names, date of birth, language, personal ID number, contact information (address, postal code, town, country of residence, phone number, e-mail address) and contact information for the use of electronic services
- Information required for the management of pension or rehabilitation matters, such as information related to pension calculations (work history and earnings information), benefit solution history, pensionable age, pension accrual information and employer and profession/occupation, possible date of death, familial relations (guardianship, children, marital status or registered relationship), spouse’s last name, first name and personal ID number, and information about the legal validity of the marriage or relationship.
- Information related to the payment of benefits, such as banking information for payments, amount, benefit recipients, tax information
- Information related to recovery and distraint, such as payments collected and settled that are deducted from the pension, distraint deductions from the pension
- Information about other paid or denied social benefits based, for example, on motor vehicle and accident insurance, benefit applications to Kela and related decisions
- Information based on a pension estimate and other pension advice
- Information concerning trusteeship, such as the name and contact information of the trustee
Your health information will only be processed when required for the handling of your matter and only in the manner specifically intended by the law.
From where does Veritas obtain the personal data that is necessary for handling your matter?
For the management of your pension or rehabilitation matters, we regularly receive personal data from the following sources:
- Your employer
- Finnish Centre for Pensions
- Tax authorities
- Registers of the authorities
- Arek earnings and accrual system and information service
- Doctors, hospitals and health centres
- Unemployment funds
- Labour market authorities
- Population Register Centre
- Other pension institutions and insurance companies
- Social welfare authorities
- Execution authorities
- Social Insurance Institution of Finland Kela
- Banks.
The aforementioned parties are bound by obligations for confidentiality. They are permitted to disclose to Veritas only such personal data that is necessary for the handling of your matters and only in accordance with the regulations concerning confidentiality.
What type of security measures does Veritas use to protect your personal data?
We always process your personal data carefully and in a manner that protects your privacy. This is ensured through the use of the necessary technical and administrative measures.
Through access rights management, we ensure that your personal data is only accessed and processed by persons who have the authority to do so.
Our personnel are bound by the statutory obligation of confidentiality and every employee has signed a separate confidentiality agreement. Our personnel are trained and instructed on the processing of personal data and the prevention of related risks. Through internal supervision, we ensure that our personnel comply with the principles for processing personal data.
The same provisions relating to secrecy and confidentiality agreements also apply to our subcontracting partners.
With the help of access control and different security systems, your information is safely stored in protected data centres and Veritas’ own premises. We also utilise separate technical data security solutions to ensure that the reliability, integrity, usability/accessibility and fault tolerance of your personal information meets the criteria specified in the data protection legislation.
Where can you get more information about the processing of your personal data?
If you would like further information about the processing of your personal data at Veritas, please read the ‘Data protection’ section on our website at veritas.fi.
With regard to personal data requests, please contact us primarily through our website at veritas.fi.
You can also contact Veritas by phone, mail or via a protected e-mail service.