Data privacy and accessibility
STORM- Smart freight TranspOrt and logistics Research Methodologies is a project funded by European Union’s Horizon 2020 research and innovation programme
STORM project aims at investigating the transformation and structural changes in freight and logistics business operations from different perspectives. In particular, the project is focusing on future challenges and requirements of the sector by developing new procedures and tools to support digitalisation, sustainability transition, and future policy requests.
Contact information in matters regarding data privacy
Data Protection Officer (DPO)
Name: Seppo Viinikainen
Address: Teknologian tutkimuskeskus VTT Oy, Koivurannantie 1, 40400 Jyväskylä, Finland
Email: dataprotection@vtt.fi (Data Protection Officer, Information Security Manager and Legal Counsel) or seppo.viinikainen@vtt.fi (Data Protection Officer)
STORM Project Coordinator
Name: Dr. Yancho Todorov, Senior Scientist
Address: Teknologian tutkimuskeskus VTT Oy, Tietotie 4C, 02100 Espoo, Finland
Email: yancho.todorov@vtt.fi
The STORM consortium respects laws and acts governing privacy protection when processing personal data. Data is processed diligently and in compliance with our obligations towards our partners and users. We collect and process only the personal data relevant to the purpose of each processing.
STORM and Data Privacy
We are especially diligent regarding data security. This is done to secure the data from undue access (the confidentiality and secrecy of our data), the immutability of data (the integrity of our data) and the usability of data.
Categories of the personal data
The categories of the personal data collected are:
Contact information, such as:
- first name, last name,
- e-mail address,
- status of consent where consent is relevant, and date and the manner how consent was recorded or collected, and possible objections to processing.
The data subjects are natural persons representing the STORM project potential and current results users and other interest groups, and subscribers.
Purposes of the processing and the legal basis for the processing
The personal data is primarily processed for the following purposes:
- Identifying and contacting the data subject for purposes of registering the data subject’s consents and objections to processing
- Project results dissemination and communication activities, including direct marketing, such as:
- Newsletter communication via Mailchimp service
- Webinar participation and invitation arrangements and communication
- Email communication
- Event invitations
The personal data is processed on the basis of 1) legitimate interest of the data controller, or 2) consent of the data subject may be requested and constitute legal basis for the processing, as applicable. The legitimate interest of the data controller is the right to conduct dissemination and communications activities related to STORM project.
Regular sources of information
Contact information and Other basic information is collected either from the data subject or filled in on the basis of public sources or services where the information is automatically collected from the data subject.
Status of consent for processing purposes, where consent is relevant, is acquired when the data subject has provided its consent in connection with registration or otherwise and may thereafter be changed by the data subject (i) in the subscription service e-mail and/or by (ii) other means listed below.
Transfer of data outside the European Union or the European Economic Area
The personal data is not regularly but may exceptionally be transferred outside the EU or EEA if this is necessary to ensure appropriate and cost-effective implementation of the processing purpose, such as in case of technical reasons related to a certain service provider. In such cases, the transfer is done in accordance with requirements of GDPR and applicable legislation.
In case of absence of European Commission (“EC”) adequacy decisions, EC standard contractual clauses are used as appropriate or suitable safeguards for these data transfers. Whenever EC adequacy decisions are applicable VTT may rely on them.
The used STORM website subscription system is based on Mailchimp commercial service, which is GDPR compliant, but depending of the technical implementation some exports outside of EU area are possible. https://mailchimp.com/gdpr/
The existence of automated decision-making, including profiling and cookies
The personal data is NOT processed for profiling of the data subject for purposes of targeting marketing, communication, and sales activities to the data subject in accordance with the data subject’s areas of interest and preferences, especially for direct marketing purposes. NO automated decision-making or profiling which produces legal effects or has similar material effects concerning the data subject is made. NO cookies are used to implement the site’s technical functionality.
The period for which the personal data is stored, or the criteria used to determine that period
The personal data is processed as long as it is needed for the purpose of project STORM until its completion by 30.06.2023. After this or in case the data subject withdraws his or her relevant consent earlier, the data subject’s personal data is deleted unless other applicable legal basis for processing remains.
Principles of protection of the register
Personal data is stored in a technically secure location. Physical access to the data is restricted by means of access control and other security measures. Only named STORM project persons have the right to process personal data contained in the register. These persons are bound by confidentiality obligations.
Rights of the data subject
The data subjects have the following rights that the data subject can always establish by contacting the STORM Project Coordinator in writing, preferably by email, or as detailed below. Some of the rights may be subject to limitations, in accordance with GDPR and applicable legislation.
The data subject is requested to contact VTT from an email address which VTT presumably has in its register(s). VTT may also request further information or documentation in order to verify person’s identity.
Right to withdraw consent
The data subject may change the status of subscriptions in the subscription service e-mail The data subjects have the right to withdraw their consent on which the processing is based, by contacting VTT in writing, preferably by email to the following address: yancho.todorov@vtt.fi .
Right of access
The data subjects have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed and access to his or her personal data and information concerning the processing.
Right to rectification
The data subjects have the right to obtain from the controller rectification of inaccurate personal data concerning him or her, and the right to have incomplete personal data completed.
Right to erasure
The data subjects have the right to obtain from the controller the erasure of personal data concerning him or her, to the extent permitted by law.
Right to restriction of processing
The data subjects have the right to obtain from the controller restriction of processing, as set forth in GPDR.
Right to data portability
Where the processing is based on the data subject’s consent or contractual relationship and is carried out by automated means, the data subjects have the right to receive the personal data concerning him or her, which he or she has provided to the controller and have the right to transmit those data to another controller.
Right to lodge a complaint with a supervisory authority
The data subjects have a right to lodge a complaint with a supervisory authority (Finnish Data Protection Ombudsman, https://tietosuoja.fi/en/home ) if the data subject considers that the processing of personal data breaches the data subject’s rights pursuant to GDPR.