Privacy Statement for Ilmarinen’s Surveys service

1. Name of the personal data register

Ilmarinen’s Surveys service (hereinafter the Service) 

2. Controller

Ilmarinen Mutual Pension Insurance Company 
Porkkalankatu 1
00018 Ilmarinen
Helsinki

Contact person in matters concerning the register:
Ilmarinen’s Data Protection Officer
Anttipekka Murhu
tietosuoja@ilmarinen.fi
Tel. +358 (0)10 284 2249

3. Addressing data subject access requests

Written requests concerning data subject rights under paragraphs 11‒16 can be sent to: 
Henkilötietoasiat
Ilmarinen Mutual Pension Insurance Company 
Porkkalankatu 1, 00018 ILMARINEN

4. Grounds for the processing of personal data 

The customer using the Service (hereinafter the Customer) discloses to Ilmarinen the names and email addresses or separate identifiers of the employees belonging to the survey’s target group. In addition, the Customer may disclose to Ilmarinen any additional, employee-related details that they consider necessary for the reporting groups, such as information on specific team memberships or employee supervisors. The processing of this data disclosed by the Customer and the delivery of the survey link to the respondents are based on a legitimate interest.

The processing of the survey responses is based on consent. The data subject has the right to withdraw their consent until the end of the survey, after which the survey responses are anonymised as described in section 14. After the data has been anonymised, it is no longer possible to withdraw consent.

5. Purposes of use 

The Service is a work ability risk management service offered by Ilmarinen to its customers. The purpose of the surveys included in the Service is to assess the work ability risk associated with Ilmarinen’s insurance business by identifying the work ability risk of Ilmarinen’s Customers. Based on the received survey responses, Ilmarinen generates anonymous reports for its Customers for the purpose of assessing their work ability risk, understanding the underlying causes of this work ability risk, and creating a situational picture of work ability management. 

Ilmarinen’s Surveys service processes personal data for the following purposes:

• Implementing surveys related to work ability risk management
• Assessment and management of disability risk included in Ilmarinen’s insurance portfolio
• Planning and development of work ability management services
• Anonymous reports and statistics generated for the employer to support their work ability management

6. Data contents

The following personal data can be stored in the Service:

• Respondents’ contact information (name, email address, and possible identifier)
• Respondents’ language information
• Respondents’ reporting groups: possible teams and identifiers
• Data entered by respondents

The Customer or Ilmarinen’s personnel are not, at any point, informed of an individual Respondent’s responses or whether they have responded to the survey. An exception to this is when a Respondent writes identifiable information in an open-ended response. Respondents are reminded of this fact in connection with any open-ended questions. The Service does not generate reports that could be used to identify individual respondents.

7. Use of cookies

Cookies are not used for respondents. When the survey administrator signs in to Ilmarinen’s online service, Ilmarinen’s cookie policies apply.

The cookies and other online identifiers used in Ilmarinen’s online service enable the implementation of the online services and are used to improve the security and user-friendliness of the service.

Based on the data collected in the online service, Ilmarinen can analyse and develop its services by assessing which data contents interest its users and how its online service is used. This data can also be used for targeting and optimising the communications and marketing done by Ilmarinen and its marketing partners.

The user of the online service may give their consent or prohibit the use of cookies in their browser settings or through a service intended for this purpose. If cookies are not enabled, some of the services on Ilmarinen’s website may become unavailable.

Read more about Ilmarinen’s cookie policies.

8. Regular data sources

Ilmarinen receives personal data from the Service’s data subjects themselves in connection with the surveys. Ilmarinen also receives the respondents’ contact information from the Customer for the purpose of delivering the survey link and defining report groups.

9. Disclosures and transfers

Ilmarinen does not disclose personal data stored in the Service to third parties. An anonymous report of the survey responses is generated for the Customer, and this report cannot be used to identify individual respondents, unless a respondent has entered identifiable information in their open-ended responses. If a Respondent includes any identifiable information in an open-ended response, despite the provided warnings, this information will be disclosed to their employer. Respondents are reminded of this fact in connection with any open-ended questions.

Personal data may be transferred to Ilmarinen’s service providers acting on behalf of Ilmarinen. The processing of personal data on behalf of Ilmarinen is always based on commission agreements and instructions that specify the rights and obligations of the parties for the processing and protection of personal data.

Ilmarinen primarily processes personal data in Finland, the EU/EEA or other countries with an adequate level of data protection approved by the EU Commission. For others, an adequate level of data protection is ensured by means of standard contractual clauses approved by the EU Commission. In addition, when transferring personal data to the United States, the EU–US Data Protection Framework can also be used as the basis for transfer.

10. Right of access

The data subject has the right to review what information about them has been stored in the Service.

The data subject must present their name and personal identity code in the review request in order to find their information. The response to the request is sent to the confirmed address of the data subject.

11. Right to data portability 

The data subject has the right to obtain their personal data that is processed in information systems which the data subject has provided to the controller and whose processing is based on the consent of the data subject. The data subject may also request the controller to transfer this data to another controller where technically possible. For survey responses, the right to data portability is valid until the end of the survey.

12. Right to rectification

The data subject has the right to request the rectification of incorrect or inaccurate personal data.

The request must include the data subject’s name, organisation, and unique identifier (e.g. email address), and it must justify the request for rectification and explain how the information should be rectified.

13. Right to object

The data subject has the right to object to the processing of personal data concerning them to the extent that the processing is based on a legitimate interest.

14. Right to restriction of processing

The data subject may request Ilmarinen to restrict the processing of their personal data when:

• The data subject disputes the accuracy of personal data
• Processing is verifiably and justifiably unlawful and the data subject objects to the erasure of personal data
• When Ilmarinen states that it no longer needs the personal data requested to be restricted for the purposes of processing expressed in the privacy statement, but the data subject needs them in order to prepare, present or defend a legal claim.
• The data subject has objected to the processing of personal data and is awaiting verification whether the legitimate grounds of the controller override the grounds of the data subject.

The request must state the name and personal identity code and specify and justify the restriction requirement.

15. Storage periods and right to erasure

The personal data stored in the Surveys service is retained until the end of the survey, i.e. until the Customer’s administrator generates a report of the survey. The report is generated automatically 14 days after the end of the survey, in the event that the Customer’s administrator does not generate a report before this date. After this, the responses are anonymised, and Ilmarinen will no longer be able to link the survey responses to any individual respondents.

The contact information and additional details disclosed by the Customer will be removed from the Service 18 months after the delivery of the survey. If the Customer carries out a new survey before this deletion, the information previously exported to the Service can be used in the new survey. The new survey is considered to constitute a new disclosure of information, in which case the Customer is responsible for ensuring that the contact information is up to date and that it has the right to disclose the contact information of the employees belonging to the survey’s target group to Ilmarinen.

The contact information and additional details provided by the Customer will also be deleted if a data subject objects to the legitimate interest-based processing of their personal data.

The personal data disclosed by the Customer to Ilmarinen is deleted from the Service by Ilmarinen whenever the Customer ceases its use of the Surveys service.

16. Right of appeal to supervisory authorities

The data subject has the right to refer the matter to the Data Protection Ombudsman if the data subject considers that the processing of personal data concerning them violates the relevant legislation.

17. Principles of register protection

At Ilmarinen, information security and protection of personal data are an integral part of the functionality and information architecture of information systems. Requirements for the security of information systems and the integrity, confidentiality, availability and continuity of data processing are always defined in advance at the system design stage. Ilmarinen processes all personal data securely and in accordance with legislation, and systematically develops and inspects information security. For more information, visit Ilmarinen’s information security page.

The Privacy Statement for the Surveys service was last updated on the 28th of August 2025.