Date: April 25th, 2017
Based on the General Data Protection Regulation, Articles 13 and 14
1. Controller / Company
Orion Corporation (Company Identification Number: 1999212-6)
Tel. 010 4261
2. The person in charge / contact person
Taru Blom, Vice President of Development R&D
Orion Corporation Orion Pharma
Tengtströminkatu 8, P.O.Box 425
Tel. 010 426 7836
3. Name of the data file
Data file of the external participants in the Oriontation idea competition
4. The purpose for processing the personal data / the purpose for the use of the data file / recipients (or categories of recipients) of personal data / the legal basis for processing the personal data
The purpose for use of this data file is to enable external participants submitting their ideas via the Internet in a Webropol-form or information through other means (e.g. e-mails) to the Oriontation idea competition.
The enabling of the collection of ideas for the competition and the related communication shall require the collection of personal data of the participants in order for the participant to be able to identify himself/herself in the application for the competition and for Orion Corporation to be able to identify the participant and the ownership of application of the idea and to keep contact with the participants.
The company will not disclose the collected data for commercial purposes. Company uses services of Webropol Oy for purposes of technical maintenance of the file.
The legal basis for processing of the personal data is consent of the data subject. (General Data Protection Regulation Article 6.1.a).
5. Content of the data file
The participant provides the personal data via an application form and/or e-mail. Webropol questionnaire will be used as the application form for the collection of personal data. Through the webropol, the following data can be collected: name, address of the institute he/she is working for or studying in, phone number and e-mail address and name of the research group he/she is working in.
Only nominated Orion employees involved in the Oriontation –competition, either as organizers or those evaluating the ideas, have an access to the personal information. Should the idea go forward in the competition or be rewarded, more information may be needed by e-mail, phone or mail (such as personal identity code and information to enable taxing), also the names and contact information of the others in the research group will be requested. All other information and a consent to process personal information will be requested separately and individually from the other group members. Unless such a consent is acquired, the received information will be destroyed before entered to the file.
6. Regular sources of information
When applying via the Internet, the participant enters data about himself/herself. Also, additional information may be requested by e-mail or phone or in other personal individual contact and if the participant provides such information, it will be included in the data file. During the competition, the participant may be requested to provide the names and contact info of the other members of the research group. More information and a consent to process personal information will be requested separately and individually from the other group members. Unless such a consent is acquired from the group member, the received information will not be entered into the file.
7. Regular destinations of disclosed data and whether the data is transferred to countries outside the European Union or the European Economic Area
Personal data is not assigned nor transferred to countries outside the European Union or the European Economic Area except for the data becoming public (such as names of the research group members and the institute) due to the success of the idea in the competition (nominee or winner) or due to the collaboration with Orion continued based on the competition.
8. Retention period of the personal data
The personal data shall be retained by the controller for a period of one year after announcing the winners of the competition. After the announcement of the winners, the information may be used to establish the collaboration with Orion related to the submitted idea or to publicly inform about the nominees and the winners of the competition.
9. The principles how the data file is secured
Webropol Oy shall be responsible for the technical maintenance of the data file. Technical data protection is being used in the application, by which the entered information shall remain unchanged and is available only for the authorized persons. Additional excel sheets including the data of the other members of the research group may be compiled and stored in Orion Corporation in a secure way with restricted access.
10. Right of access and realization of the right of access, right to data portability
The participant shall have the right of access, after having supplied sufficient search criteria, to the data on himself/herself in the personal data file, or to a notice that the file contains no such data. The controller shall at the same time provide the data subject with information of the regular sources of data in the file, on the uses for the data in the file and the regular destinations of disclosed data.
The participant who wishes to have access to the data on himself/herself, as referred to above, shall make a request to this effect to the person in charge at Orion Corporation by a personally signed or otherwise comparably verified document.
The data subject shall have the right to data portability, i.e. the right to have his or her data, which has been provided to the controller by the data subject, and that is being processed by automated means, to be ported to the data subject in a structured and machine readable format where the basis for processing is consent or the fulfilment of a contract between the controller and the data subject.
Requests for the above rights shall be made by contacting the representative of the controller named under section 2. hereof.
11. Right to withdraw consent
In case the legal basis for processing the personal data is the consent of the data subject, the data subject has the right to withdraw the consent. Data subject shall make a request to this effect to the person in charge at Orion Corporation by a personally signed or otherwise comparably verified document in writing to the representative of the data controller named under section 2. hereinabove.
12. Rectification, erasure and realization of the rectification
A controller shall, on its own initiative or at the request of the data subject, without undue delay rectify, erase or supplement personal data contained in its personal data file if it is erroneous, unnecessary, incomplete or obsolete as regards the purpose of the processing. The controller shall also prevent the dissemination of such data, if this could compromise the protection of the privacy of the data subject or his/her rights.
If the controller refuses the request of the data subject of the rectification of an error, a written certificate to this effect shall be issued. The certificate shall also mention the reasons for the refusal. In this event, the data subject may bring the matter to the attention of the Data Protection Ombudsman.
The controller shall notify the rectification to the recipients to whom the data have been disclosed and to the source of the erroneous personal data. However, there is no duty of notification if this is impossible or unreasonably difficult.
Requests for rectification shall be made by contacting the representative of the controller named under section 2. hereof.