Ordering and using Kapseli

Purpose of use

Kapseli is a secure operating environment provided by Findata, where you can process individual level data obtained under a data permit issued by Findata or another authority. Kapseli is used via a remote connection by logging in via a browser.

The controller for the processing of material in Kapseli is defined in the data permit. In this case, Findata acts as a data processor on behalf of that controller.

We process the personal data of Kapseli users as a data controller in order to

provide the functions of Kapseli,
ensure information security and the lawfulness of the processing of personal data and
carry out billing.

We process contact information of Kapseli users to send user notices related to Kapseli and its use.

We also use the number of Kapseli users to develop and administer the service.

We do not use automated decision making or profiling in our data processing.

Data processed and data sources

When ordering Kapseli, we collect the following information about the person ordering Kapseli:

name
telephone number
email address
organisation information

The person ordering Kapseli also enters the information of any other persons who need access rights to the environment. The names and email addresses of these individuals are collected.

The information is obtained either from the data subject themselves or on their behalf from the person who placed the order.

Logging into Kapseli is primarily done through two-step authentication via the Suomi.fi service. The personal data collected by the Suomi.fi service is described in the service’s privacy policy (suomi.fi).

Regular disclosure of data and recipients of data

We do not disclose data about Kapseli users on a regular basis.

We use Tieteen Tietotekniikkakeskus Oy (CSC) to carry out technical maintenance and development. CSC acts as a processor of personal data on behalf of Findata.

Data retention period

We retain the data for the duration of the Kapseli subscription and for as long as necessary for billing purposes.

Transfer and disclosure of personal data to non-EU or EEA countries

We do not disclose data outside the EU or EEA or to international organisations.

Rights of the data subject

The data subject refers to the person to whom the original social and health information relate. When processing personal data of Kapseli users, the data subject has the following rights:

Right to be informed about the processing of personal data (Article 13 of the GDPR)
Right of access to one’s personal data (Article 15 of the GDPR)
Right to rectify one’s data (Article 16 of the GDPR)
Right to restrict the processing of one’s data (Article 18 of the GDPR)
Right to object to the processing of one’s data (Article 21 of the GDPR)

The data subject has the right to object to the processing of personal data by us at any time on grounds relating to their particular situation. In this case, we shall no longer process the data relating to this person, unless there are substantial and legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Legal basis of processing personal data

The processing of personal data of Kapseli users is based on the following laws:

General Data Protection Regulation, Art. 6(1)(e) and
Data Protection Act, Section 4(2).