Privacy statement of Ilmarinen's marketing register
According to the European Union’s General Data Protection Regulation (GDPR) 679/2016, articles 12–14.
1. Name of personal data register
Ilmarinen’s marketing register
2. Controller
Ilmarinen Mutual Pension Insurance Company
Porkkalankatu 1
FI-00180 Ilmarinen
Helsinki
Contact person for matters related to the register:
Data Protection Officer
Anttipekka Murhu
anttipekka.murhu@ilmarinen.fi
Tel. +358 10 284 2249
3. Forwarding of data subject’s requests
Written requests concerning the rights of the data subject, in accordance with sections 10–15, shall be addressed to:
Personal data matters
Ilmarinen Mutual Pension Insurance Company
Porkkalankatu 1, FI-00018 ILMARINEN
4. Grounds for processing of personal data
The processing of personal data of potential customers of Ilmarinen’s marketing register is based on a legitimate interest in accordance with the General Data Protection Regulation, a contract, and the consent of the data subject.
5. Purposes
The personal data in Ilmarinen’s marketing register is processed for the following purposes:
- Marketing, direct marketing and the implementation and follow-up of marketing campaigns by Ilmarinen and Ilmarinen’s partners
- Opinion polls or market surveys, as well as the implementation and follow-up of comparable addressed mailings
- Recording of calls by Ilmarinen in order to verify service events, develop customer service, implement rights and obligations, and ensure safety
6. Categories of personal data
Personal data of potential customers and current client companies’ employees are saved in Ilmarinen’s marketing register, such as:
- Name of data subject
- Title or profession
- Personal identity code, business ID or other identifier linked to the data subject
- Age
- Gender
- Native language
- Contact details: postal address, telephone number and email address
- Data describing the data subject’s task and position in business or public office
- Data collected while using the services and on the online services
In order to implement the consent and prohibition obligations laid down in the law, information on consents and prohibitions given by data subjects is also processed in the marketing register.
7. Use of cookies
Ilmarinen uses cookies and other online identifiers in its online services. Cookies and other similar technologies are used for:
- Enabling and improving the technical functioning, security and user-friendliness of services
- Targeting and measuring marketing
- Analysing usage and developing services
Based on data collected in the online service, Ilmarinen may create target groups to which Ilmarinen and its marketing partners can direct marketing and optimise marketing measures. The setting of essential cookies does not require consent, but non-essential cookies require consent, which the user can give or withdraw in our services. Read more about Ilmarinen's cookie policy.
8. Regular data sources
Personal data in Ilmarinen’s marketing register is collected from:
- The data subject themself, in connection with contact, use of services or participation in campaigns and events
- Ilmarinen’s customer information systems and other internal systems
- Public and private registers, such as the Population Information System and the information system of the Finnish Patent and Registration Office
9. Disclosures and transfers
Ilmarinen discloses personal data only to the extent permitted and required by legislation in force at any given time. In special cases, personal data may also be disclosed with the consent of the data subject.
Personal data may be transferred to Ilmarinen’s partners that participate in the production, provision or development of services, or that are otherwise involved in the processing and protection of personal data.
Ilmarinen processes personal data primarily in Finland, the EU/EEA area or in other countries with an adequate level of data protection approved by the EU Commission. For other countries, an adequate level of data protection is ensured in accordance with the General Data Protection Regulation.
10. Right of access
The data subject has the right to know what information about him or her has been stored in Ilmarinen’s marketing register or that the register does not contain information about him or her.
A request for access to personal data must be made to Ilmarinen in a signed or otherwise comparably reliably verified document, or in person.
11. Right to data portability
The data subject has the right to receive, in a file, the personal data concerning them that they have provided to Ilmarinen and to transmit those data to another controller, if this is technically possible and the statutory conditions for data portability are met.
12. Right to rectification
The data subject has the right to demand that inaccurate, unnecessary, incomplete or outdated personal data be rectified or erased.
Requests for rectification must be made in writing and specify which information is requested to be rectified, on what grounds, and how the information should be rectified.
13. Right to object
The data subject is entitled to object to the processing of personal data that applies to him/her when the processing is based on a general or legitimate interest, such as direct marketing.
The data subject is entitled to object to the use of his/her personal data for marketing at any time. To do this, the data subject must inform Ilmarinen of a marketing ban or withdraw his/her consent.
14. Right to restriction of processing
The data subject can request that Ilmarinen restrict the processing of his/her personal data when:
- The accuracy of the personal data is contested by the data subject.
However, there is no right of restriction on the part of Ilmarinen’s statutory operations if the request for restriction is manifestly unfounded. - The processing is verifiably and justifiably unlawful and the data subject opposes the erasure of the personal data.
- When Ilmarinen expresses that it no longer requires the personal data
that has been requested to be restricted for the purposes of the
processing as specified in the privacy statement, but the data subject
requires them for the establishment, exercise or defence of legal claims. - The data subject has objected to the processing of the personal data,
pending the verification whether the legitimate grounds of the controller override those of the data subject.
The request must contain the name and identity number of the data subject and a specific and justified request for restriction.
15. Retention periods and data erasure rights
Ilmarinen retains personal data for as long as any one of the processing grounds presented in section 4 of this privacy statement is valid and the personal data is necessary for its processing purposes. Telephone recordings are retained for 6-12 months. Once the retention period of personal data has expired or the data subject objects to the processing of personal data based on a legitimate interest and there are no other grounds for processing the data, the data will be erased.
16. Right to appeal to a supervisory authority
The data subject is entitled to bring the matter before the Data Protection
Ombudsman, if the data subject considers that the processing of the personal data that apply to him/her breach the relevant legislation.
17. Principles of register protection
At Ilmarinen, information security and the protection of personal data are an integral part of the information systems’ functionality and data architecture. Requirements for the information systems’ security and the integrity, confidentiality, availability and continuity of the data processing are always established beforehand when the systems are designed. Ilmarinen processes all personal data securely and pursuant to legislation and develops and inspects information security systematically.
Privacy statement of Ilmarinen’s marketing register updated 28 November 2025.