Privacy Policy
Updated 11.3.2026
1 Name of the register
Kerava Energy companies’ customer, subcontractor, and marketing register
2 Joint controllers
Keravan Energia Oy (0891026-0) ja Sipoon Energia Oy (1030712-9)
Address: Tervahaudankatu 6, 04200 Kerava
Mailing address: PL 37, 04201 Kerava
Telephone: 09-5849 5526
3 Inquiries regarding the register
tietosuoja@keoy.fi
Tervahaudankatu 6, 04200 Kerava
Tel. 09-5849 5526
4 Data content of the register
In our register, we process the personal data of our customers, representatives of our corporate customers, and potential customers. In addition, we process the personal data of our subcontractors’ employees.
We collect and process the following information:
- basic personal details, such as name, age, and year of birth or personal identity code
- contact details, such as postal address, email address, and phone number
- contacts with customer service, such as customer calls between the customer and the data controller
- information related to the customer’s use of products and services, such as details of the energy supply location, information on equipment at the location, and energy consumption data
- information required for billing purposes
- customer credit information, within the limits permitted and required by law
- basic details of a subcontractor’s employee, such as name and date of birth
- contact details of a subcontractor’s employee, such as postal address, email address, and phone number
- information related to the employment of a subcontractor’s employee, such as tax number, employer, employer’s Business ID, and country of residence
- information on the training, qualifications, and courses of a subcontractor’s employee, as well as information regarding any A1 certificate
Kerava Energy Companies also process personal data collected via the whistleblowing channel. You can view information regarding the processing of personal data collected through the channel here [link].
You can find information about the processing of personal data regarding our subcontractors’ employees in the Ilmoita service here. [link to Vastuu Groups privacy policy].
5 Purpose and legal bases for the processing of personal data
The controller or a partner authorized by the controller (acting on the controller’s behalf) uses the personal data of customers, potential customers, and subcontractors in accordance with personal data legislation for the following purposes:
- managing and developing customer relationships, such as sending service disruption notifications
- offering, delivering, and providing products and services
- contract management and invoicing
- payment, payment monitoring, and debt collection
- developing business operations, services, and customer service
- marketing, advertising, and selling products and services
- segmentation for marketing purposes (the categories used for segmentation may be based, for example, on electricity consumption)
- compliance with information disclosure obligations related to construction and obligations under the Act on the Contractor’s Obligations and Liability.
The controller has the right to process personal data on the following grounds:
- The processing of personal data is necessary for the performance of a contract between the controller and the customer or in order to take steps prior to entering into a contract. If we do not receive the previously listed personal data or the necessary consent to process it, the provision of the service may be restricted or prevented entirely.
- The processing of personal data is necessary for compliance with a legal obligation to which the controller is subject, such as fulfilling obligations arising from the Act on the Contractor’s Obligations and Liability when Work is Contracted Out.
- The controller has a legitimate interest, based on the customer relationship, to use customer data for service development and for the marketing of products and services, subject to the conditions and limitations defined by law.
- Based on the data subject’s consent, where the data subject has given their consent to electronic marketing or to another purpose explicitly defined by the controller.
6 Regular sources of information
Information about customers is obtained from customers, e.g. in connection with requests for offers, orders, contracts and other contacts, as well as the information that is or will be saved from the use of the customer’s products or services. Information is also collected with the help of cookies and similar technologies in accordance with the procedures allowed by the regulations in force at any given time. Potential customers’ information is obtained when the potential customer is in contact with us and in connection with possible raffles.
All customer contacts can be saved. The recordings are used e.g. in the authentication of business transactions and in the development of customer service.
Personal data can also be collected and updated from the registers of the Population Register Center, Suomen Asiakastieto Oy and other similar service providers. The information is also updated based on the rules for exchanging information on the electricity market published by the Energy Industry.
In the case of employees of our subcontractors, personal data is collected directly from the registered persons or their employers.
7 Data processors and other recipients
As a general rule, personal data is not disclosed to third parties. However, data may be disclosed to public authorities as required by applicable legislation.
In accordance with electricity market legislation and supplementary industry guidelines, data is disclosed to other parties involved in electricity trading (such as electricity sellers and distribution system operators) and to the data controller responsible for the electricity market data exchange solution (Fingrid Datahub Oy) via electronic messaging.
Data may also be processed automatically within Keravan Energia Oy.
Data may also be transferred for processing to Keravan Energia Oy’s partners, subsidiaries, service providers, or subcontractors for the purposes specified in section 5. Our partners and subcontractors may process personal data only for tasks related to managing or maintaining the customer relationship on our behalf. We always ensure that our partners do not process the transferred personal data for any other purposes.
8 Transfer of data outside the EU or EEA
Data is not transferred outside the EU or the EEA unless necessary for the service or the technical implementation of data processing. In such cases, the data transfer complies with the data protection and information security requirements set by data protection legislation.
9 Principles for the retention of personal data
Personal data covered by this privacy notice is retained for as long as the controller uses the data for the purposes described in section 5. Personal data stored in the register is deleted when there is no longer a legal basis for its processing.
In the customer data system, personal data is retained for a maximum of ten years following the end of the customer relationship or until the customer requests the deletion of the data. Personal data may need to be retained for longer than this if applicable legislation or contractual obligations binding us to third parties require a longer retention period.
Personal data concerning subcontractors is retained for six years from the end of the year in which the construction site was completed.
If we process personal data based on consent, the consent given may be withdrawn at any time. Personal data processed based on consent is deleted immediately after the withdrawal of consent, provided there is no other legal basis for the processing.
10 Principles of register protection
The data security of the register, as well as the confidentiality, integrity, and availability of personal data, are ensured through appropriate technical and organizational measures.
Access to the data is restricted to personnel employed by the Kerava Energy Group or its authorized agents whose duties require the processing of personal data. The registry data is protected by personal user IDs and passwords. Viewing and editing rights are restricted based on access privileges. We require our personnel and partners to commit to maintaining the confidentiality of customer data.
11 Rights of the data subject
The data subject has rights under data protection legislation. Please note that the specific application of these rights in any given situation depends on the purpose and context of the personal data processing.
The data subject must submit requests concerning their rights in writing and signed to the following address:
Keravan Energia Oy
PL 37
04201 Kerava
or send an email to tietosuoja@keoy.fi.
Requests concerning one’s rights may also be submitted in person to the controller.
As a general rule, the controller does not charge the data subject a fee for processing the request. However, if the data subject’s requests are manifestly unfounded or excessive—for example, if they are submitted repeatedly—the controller may charge the data subject a reasonable fee based on the administrative costs incurred in processing the request.
Right to access personal data and obtain a copy of personal data
The data subject has the right to obtain confirmation as to whether their personal data is being processed, as well as the information regarding the processing of personal data specified in data protection legislation. In addition, the data subject has the right to obtain a copy of the personal data being processed.
Right to access and rectify data
The data subject has the right to inspect the data concerning them that has been stored in the register. The data subject has the right to demand the correction of incorrect or inaccurate personal data.
Right to erasure of data
The data subject has the right to have personal data concerning him or her erased without undue delay, provided that:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws the consent on which the processing is based and there is no other legal ground for the processing;
- the personal data have been processed unlawfully; or
- the personal data have to be erased for compliance with a legal obligation under Union or national law.
Right to restriction of processing
Rekisteröidyllä on oikeus siihen, että rekisterinpitäjä rajoittaa käsittelyä, jos
- the data subject contests the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data in question for the purposes of the processing, but the data subject requires them for the establishment, exercise, or defence of legal claims.
Right to withdraw consent
If the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. However, the data subject’s personal data may be retained if compliance with a statutory obligation to which the controller is subject requires the retention of the personal data.
Right to transfer data from one system to another
The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller, where technically feasible.
Right to lodge a complaint with a supervisory authority
The data subject has the right to lodge a complaint with the supervisory authority if they consider that the processing of their personal data infringes applicable data protection regulations.
The supervisory authority for data protection is the Data Protection Ombudsman.
Instructions for lodging a complaint and the relevant forms can be found at
https://tietosuoja.fi/yksityishenkilot
12 User tracking
We use Leadoo’s user tracking to monitor how our Users move around our website and combine this data with the user’s information, which is collected through e.g. Chat interactions. Leadoo uses e-tag tracking, which technically differs from cookie-based tracking, but which is subject to the same laws as cookies. Check Leadoo Marketing Technologies Oy’s Privacy Policy (https://leadoo.com/privacy-policy/) to learn more about what is tracked in the system. For GDPR purposes, we act as the controller and Leadoo as the data processor. If you do not wish to be tracked, you can clear your browser cache. For more information on how Leadoo works, check out https://leadoo.com/privacy-policy-processor
Privacy Notice for Video Surveillance
PDFs in Finnish: