This Privacy Policy describes the processing of personal data in the Electronic Voting Service provided by Trevea.
Description of the service
The Electronic Voting Service is a service provided by Trevea for organisations to arrange their election voting electronically. The Service contains a electronic voting user interface which the voters can use to cast their vote.
How do we collect your personal data
When you use our Service, we may process personal data about you collected from the following sources:
- From the organisation, which has agreed to use the service, and you are a member of
- Directly or in-directly from you when you use the Service
The data controller for the personal data is the client. Trevea is a data processor which processes the personal data on behalf of the client.
What personal data do we process on you
We may process the following personal data on election candidates:
- Name and additional descriptive information (like title or nickname),
- electoral coalition,
- candidate number, and
- number of received votes.
We may process the following personal data on persons who are entitled to vote:
- Name,
- identifier to uniquely distinguish the person (personnel/student number, national learner id and/or username),
- elections in which the voter is entitled to vote,
- status of your right to vote including possible voting method and time, and
- additional information needed for providing statistics on voting behaviour required by the client organisation.
For what purposes do we process your personal data
Trevea processes personal data related to Electronic Voting Service on the basis of a contractual relationship and in order to provide the Service to its client. The purposes for the customer to process personal data are describe in customer’s privacy policy.
How do we protect and safeguard your personal data
To protect your personal data, Trevea has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.
To whom do we disclose your personal data
We do not disclose your personal information with third parties in other extent than what is required by law.
We may also process anonymized or statistical data that cannot be associated with you as a person. Such information can also be disclosed to third parties for other purposes than those described in the Privacy Policy.
How long do we store your personal data
The personal data is stored for the period of providing the service to the client organisation. The personal data will be deleted without undue delay once the service has been delivered to the customer and the customer has accepted the delivery. In most cases the delivery ends when the client organisation has confirmed the result of voting and all applicable appeal periods regarding the election have passed.
What rights and options do you have
Your rights and options depend on the purposes of the processing of personal data and on the situation.
- The right to access: You have the right to receive a confirmation of whether your personal data are processed, and if they are, to gain access to the data. If less than six months have passed since your previous inspection request, data controller may charge you for the inspection request according to the price-list.
- The right to give and withdraw your consent: If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time.
- The right to rectify data: You are entitled to have your personal data rectified or, in certain cases, to have defective personal data supplemented.
- The right to object to the processing of personal data: You are entitled to object to the processing of your personal data based on Trevea’s legitimate interests, including profiling. Trevea may reject the request, if the processing is necessary in order to implement Trevea’s mandatory and legitimate interests. You are always entitled to oppose to the processing of your personal data for direct marketing purposes and for profiling related to direct marketing.
- The right to data portability: You have the right to receive your personal data you have submitted to us for processing based on your consent or the implementation of an agreement. You are entitled to receive the data in a structured, commonly used and machine-readable format, and the right to transmit the data to another controller.
- The right to be forgotten: You are entitled to ask Trevea to erase data related to you, for example, if (i) you consider them unnecessary for the purposes described above, (ii) you cancel the consent you have given, (iii) you consider Trevea to process your personal data unlawfully, or (iv) you object to the use of your personal data for direct marketing purposes.
- The right to restriction of processing: You have the right under certain circumstances to require the controller to restrict the processing of your personal data.
How can you exercise your rights and contact us
You can exercise all the rights of a data subject by emailing us at helpdesk@trevea.fi.
You can send any questions related to the processing of personal data or the Privacy Notice to the address above.
If you think that Trevea has acted contrary to the Privacy Notice or the valid legislation, you are entitled to file a complaint about the matter. You can also file a complaint with the Data Protection Ombudsman, who monitors the lawfulness of the processing of personal data.
Changes to the Privacy Policy
The development of our services and products may require changes to this Privacy Policy. You can find the latest version in the Electronic Voting Service.