Privacy statement for invoice and cash desk information

Controller

Finnish Patent and Registration Office (PRH)
Mailing address: Finnish Patent and Registration Office, FI-00091 PRH, Finland
Street address: Sörnäisten rantatie 13 C, Helsinki, Finland
Tel. +358 029 509 5000

Representative of controller

Ms Tiina Honkanen
tiina.honkanen[at]prh.fi
Tel. +358 029 509 5984

Data protection officer

tietosuojavastaava(at)prh.fi
Tel. +358 50 413 6500

Purpose of and legal basis for processing personal data

The data processed in the register of invoice information consists of invoices the PRH sends for its customers (sales invoices) and invoices the PRH receives from its suppliers (purchase invoices). The data processed in the register of cash desk information consists of information on payments customers have made at the PRH’s customer service point.

The processing is necessary to comply with the controller’s legal obligation.

Personal data and categories of data subjects in the register

The following customer information on sales invoices is saved:

• Name and Finnish Business ID of the customer company
• VAT number of the customer company
• Name and customer identification number of the customer’s representative
• Personal identity code of the customer
• Street and mailing addresses
• Country, region, time zone, and language
• Phone number, fax number, and e-mail address
• Address for online invoices (EDI Identification Code) and Transmission Identification Code (operator)
• Information on consumer online invoices

The following supplier information on purchase invoices is saved.

• Name and Finnish Business ID of the supplier company
• VAT number of the supplier company
• Name and supplier identification number of the supplier’s representative
• Personal identity code of the supplier’s representative
• Street address and mailing address
• Country, region, time zone, and language
• Phone number, fax number, and e-mail address
• Bank account information (IBAN and SWIFT codes)

The following information on cash desk payments is saved:

• Payment card type
• Last four digits of the payment card
• Payment amount
• Name of the item purchased
• Finnish Business ID of the customer, patent number, trademark number, or name of the person

Sources of information

The regular sources of information include the PRH register system as well as the systems for cash desk, e-commerce, and payment transactions, and other systems relating to financial administration.

The customer and supplier information are transferred to a financial administration system (Kieku). The information on sales and purchase invoices are transferred to their own customer account group in Kieku.

The information is also transferred to the HANDI system in order to archive the invoices and the service cash desk’s matching reports and to approve the purchase invoices.

The information on the payments to the cash desk is received from customers.

Disclosure of personal data to third parties

The data can only be disclosed within the limits that the legislation in effect will oblige and permit.

The data is regularly disclosed to the National Audit Office of Finland, the bank, execution authorities, and the Finnish Tax Administration. Information on cash desk payments is transmitted to ReceiptHero Ltd if the customer making the payment at the customer service point has entered into a contract on the provision of structured receipt information with the company in question.

Transfer of personal data to countries outside the EU or the EEA or to international organisations

No data are transferred to countries outside the EU or the EEA or to international organisations.

Storage periods of personal data

The storage periods of personal data are based on the legislation, which specifies the storage periods of accounting material.

Profiling and automated decision-making

The registered data are not used for profiling, and no automated decision-making is performed on the data.

Right of access to personal data

As the data subject, you have the right to check what personal data about yourself has been entered into the register, or to find out that there are no such register entries. You can ask the controller for access to your personal data. Read our instructions on how to request access to data.

Right to rectification of data

As the data subject, you have the right to demand that the controller rectify without undue delay any inaccurate or incorrect personal data about yourself. You should address your request to the controller. Read our instructions on how to request rectification of data.

Right to restriction of processing

As the data subject, you have the right to demand that the controller restrict the processing of data if you contest the accuracy of the personal data. The idea is to restrict the processing while the controller verifies the accuracy of the personal data.

Right to lodge complaint with supervisory authority

As the data subject, you have the right to lodge a complaint with the supervisory authority (the Data Protection Ombudsman).