Alcohol trade register – privacy statement
The alcohol trade register’s privacy policy was prepared on 12 July 2023. The National Supervisory Authority for Welfare and Health (Valvira) acts as the controller.
In addition to Valvira, joint controllers include the Regional State Administrative Agencies that process licences and supervision cases assigned to them in the Alcohol Act in their area and are responsible for the data they have saved in and transferred to the alcohol trade register. Other joint controllers are the State Department of Åland and Ålands miljö- och hälsöskyddsmyndighet (the Åland Environmental and Health Protection Authority) that act as licensing and supervisory authorities in the Åland Islands and process registered data.
Purpose of the processing of personal data
We process personal data when processing the licences defined in the Alcohol Act, during supervisory activities and when compiling alcohol statistics.
Valvira does not use your personal data in automated decision making or profiling.
The personal data processed
Personal data about applicants for licences defined in the Alcohol Act is processed in the register. Regarding companies and other organisations, data about their managers, responsible persons and owners is entered in the register.
The data laid down in section 66 of the Alcohol Act is entered in the alcohol trade register:
- the name and business name, the personal identity code or business ID, and the address, telephone number and other address details;
- the data laid down in paragraph 1 concerning the members of an organisation’s Board of Directors, the CEO and significant shareholders, responsible and silent partners, and their investment inputs;
- data about self-employed individuals and the persons referred to in paragraph 2 concerning police and pre-trial investigations, the consideration and bringing of charges, the legal processing of criminal cases, and criminal convictions;
- data about entry in the VAT and prepayment register and the Finnish Tax Administration’s other registers, and data about outstanding tax debts;
- data about obligations subject to enforcement proceedings;
- data about corporate restructuring and bankruptcies, as well as other court decisions on outstanding debts;
- data about debt arrangements of private persons under guardianship;
- data about activities carried out based on a licence issued under this act, any breaches of regulations and provisions issued in and under this act and the consequences of such breaches, and data about audits conducted by the supervisory authorities and their results;
- other data required for the processing and supervision of licences and the compilation of statistics that does not include any sensitive data referred to in section 11 of the Personal Data Act (523/1999).
Furthermore, data about the processing of licence applications is saved in the records of Valvira or the relevant Regional State Administrative Agency. The names and email addresses of an applicant’s contact people are also processed during the licence application stage.
We process personal data to fulfil the statutory obligation set for Valvira, perform a task carried out in the public interest and exercise the official authority vested in Valvira:
- EU General Data Protection Regulation (EU 2016/679, Article 6, paragraph 1, points c) and e)
- Data Protection Act (1050/2018), section 4, subsection 1, paragraphs 2 and 3
We process data related to crime and violations to fulfil the statutory obligation set for Valvira, perform a task carried out in the public interest and exercise the official authority vested in Valvira:
- EU General Data Protection Regulation (EU 2016/679), Article 10
- Data Protection Act (1050/2018), section 7, subsection 1, paragraph 2
The duties of Valvira and the Regional State Administrative Agencies are laid down in:
- Act on the National Supervisory Authority for Welfare and Health (669/2008), section 2
- Act on the Regional State Administrative Agencies (896/2009)
- Alcohol Act (1102/2017), sections 60, 62 and 66
- Government Decree on the enforcement of the Alcohol Act (151/2018)
- Decree of the Ministry of Social Affairs and Health on oversight of the Alcohol Act (158/2018)
- Food Act (297/2021), sections 28, 79 and 80
- Act on organic production (1330/2021), sections 8, 28 and 29
Retention periods for personal data are determined in accordance with the Archives Act (831/1994), other legislation, the regulations and decisions of the National Archives of Finland, the recommendations of the Information Management Board, and Valvira’s information management plan (eAMS). The retention periods confirmed in eAMS are based on the National Archives of Finland’s screening decision (AL/18145/07.01.01.03.01/2011).
Data about self-employed individuals, the members of an organisation’s Board of Directors, the CEO and significant shareholders, and responsible and silent partners is retained in the alcohol trade register for five years after the most recent addition of data.
Data obtained from the Finnish Tax Administration is retained for three months.
We obtain data from licence applications and notifications. In addition, we obtain data from the Finnish Patent and Registration Office, the Legal Register Centre, the Finnish Tax Administration, the Police of Finland, municipal authorities, and during the hearing of local (especially neighbouring) parties concerned.
The supervisory authorities also obtain data from submitted non-compliance reports and during audits conducted by them.
Data can only be disclosed and the processing of personal data outsourced in compliance with valid legislation. Valvira has entered into agreements to verify that, when outsourcing the processing of personal data, its partners (processors of personal data) comply with legislation on personal data.
The supervisory authorities can disclose data about the financial position or trade or professional secrets of private persons or organisations obtained during the performance of the duties assigned to them in the Alcohol Act to other supervisory authorities if the data is necessary for the authority in question to perform their statutory duties (Alcohol Act, section 64, subsection 1).
Derogating from the provisions laid down in section 16, subsection 3 of the Act on the Openness of Government Activities, the name, licence and notification number, as well as the address and contact details intended for public use of licence holders and notification submitters, are published as open data at avoindata.fi (in Finnish) on the basis of section 64, subsection 2 of the Alcohol Act.
According to legal obligations, data is disclosed to operators engaged in the wholesale and production of alcohol, the Finnish Tax Administration, Statistics Finland, and the Finnish Institute for Health and Welfare.
Documents and registered data to be retained permanently based on the Archives Act will be transferred to the National Archives of Finland for archiving after Valvira no longer needs them for the purposes described in this privacy policy.
Data will be disclosed to those requesting it in accordance with the Act on the Openness of Government Activities (621/1999). Data and documents are public unless specifically determined as confidential by law.
Data will not be disclosed for direct marketing, opinion polls or market surveys unless special provisions on the disclosure of data for such purposes have been issued.
Transfer of personal data outside the EU or EEA
The disclosure of personal data for publication as open data also enables access to personal data outside the EU and EEA. Otherwise, no personal data will be transferred outside the EU or EEA.
A. Right of access: You have the right to know whether Valvira processes your personal data. If we process your personal data, you have the right to obtain a copy of the data unless we have lawful grounds to refuse to fulfil your right.
B. Right to rectification: If the personal data we process is incorrect, inaccurate or invalid, you can request us to rectify your data.
C. Right to erasure: You have the right to request Valvira to erase your personal data in the following situations:
- your personal data is no longer required for the purposes for which it was collected or for which it was otherwise processed;
- you withdraw your consent on which processing was based, and no other lawful grounds for processing exist;
- personal data has been processed illegally; or
- personal data must be erased to comply with a statutory obligation applied to Valvira based on EU law or a Member State’s local legislation.
D. Right to restriction of processing: You may have the right to request the processing of your personal data to be restricted in certain situations laid down by law. For example, processing can be requested to be restricted in any of the following situations:
- you consider your personal data to be incorrect;
- your personal data is processed illegally;
- Valvira no longer requires your personal data for the purposes described in this privacy policy, but you need it to prepare, present or defend a legal claim; or
- you have objected to the processing of your data.
We will therefore restrict the processing of your personal data, including during the time we require to process your request to have your data rectified or your objection to the processing of your personal data. If we restrict the processing of your personal data, we can process your personal data:
- with your consent;
- to prepare, present or defend a legal claim;
- to protect public interests; or
- to protect the rights of another person.
We will also notify you when the restricted processing of your personal data ends.
E. Right to object: You can object to the processing of your personal data on grounds related to a specific personal situation when Valvira processes your personal data to perform a task in the public interest, exercise the official authority vested in the controller or protect the legitimate interests of the controller or a third party.
Requests to exercise the rights above must be submitted to Valvira’s registry office by email ([email protected]) or post (Valvira, PO Box 43, FI-00521 HELSINKI). To ensure the protection of your privacy, we may ask you to verify your identity As a rule, we will reply to you within one month of your request.
Right to lodge an appeal with the supervisory authority
If you consider the processing of your personal data to be in breach of data protection legislation, you have the right to lodge an appeal with the Office of the Data Protection Ombudsman.
More information is available on the website of the Office of the Data Protection Ombudsman.
Swithcboard: +358 29 566 6700
Email: [email protected]
Postal address: PO Box 800, FI-00531 Helsinki