Employee RegisterData protection policy statement (effective 25 May 2018)General Data Protection Regulation (EU) 2016/679, Articles 12, 13, 14, and 19Data Controller: Turun Osuuskauppa (TOK), TOK HR Postiosoite: PL 186, 20101 Turku Käyntiosoite: Aurakatu 8, 20100 Turku Y-tunnus: 0142122-9 Contact information of the Data Protection Officer: tietosuojavastaava@sok.fi Person in charge of Register Matters: tok.tietosuoja@sok.fiName of the Register: Employee RegisterPurpose of Processing: Personal Data Employment relationship managementGrounds for the Processing of Personal Data Performance of a contract or pre-contractual measures – primarilyConsent of the data subject – e.g. wellness benefit (ePassi) Controller’s legal obligation – e.g. work permits, official permissions, occupational accident and pension insurance, biological exposure lists, rehabilitation and disability pension arrangements, qualification-based training and apprenticeships, payroll calculation and paymentLegitimate interest – e.g. digital communication environment (Workvivo, Creamailer), organizational development pulse tools (such as Celkee), workplace surveys, Teams meeting recordings and transcripts, bot-based surveys (such as Tytti-bot), salary surveys, and Office 365- services.Description of the Data Controller’s Legitimate Interest Creamailer: It is both justified and necessary for the employer to provide managers with up-to-date HR information through a newsletter (Creamailer). Only minimal personal data—limited to contact details—is transferred from employees.Workvivo (replaces Workplace as of 10 April 2025). In modern times, reachability requires an electronic and real-time method of employee communication that is easy to use. Workvivo is used for employee communications and interactions that are necessary—even essential—for the S Group employers’ business operations and can be regarded as a normal part of business. Given today’s business needs, the use of Workvivo is justified. The service includes essential work-related details to identify the user and define their role within the platform. The use of basic employee information does not materially impact the employee’s rights or freedoms. Furthermore, the extent and nature of communication within the service remain largely at the user’s discretion.Pulse tools (such as Celkee): Effective use of an organizational development pulse tool requires processing some personal data; anonymous processing alone would not fulfill the survey’s objectives. Employee responses help identify areas or roles that may need further clarification or change support. The analysis primarily focuses on role, task, unit, and business area, and scores are processed anonymously. Employees can typically choose whether to answer open-ended questions anonymously or with their name. Responses are used solely to allocate resources and set priorities for the change initiative. Since scored answers cannot be linked to individuals, respondents can safely share their views. In some cases, depending on the survey’s purpose, providing a name may be required.Office 365: Office 365 is a key tool and system for the employment relationship and job performance. Office 365 is a modern cloud service independent of time and place, in which the data subject has extensive possibilities to influence how they use Office 365 apps. The data subject can, for example, manage the visibility of documents they create, and files are visible only to the data subject by default.Bot-based surveys (such as Tytti-bot): the employer is obligated to guide employees in their tasks and foster the development of the work community. Bot-based surveys are conducted under the employer’s legitimate interest. The collected data is processed solely to support operational development and competence building, and no names are included in the processing. Participation is voluntary, and employees may always choose not to respond.Workplace surveys: To support the employer’s operations and promote the overall well-being of the work community, it is justified to conduct workplace surveys that capture employees’ experiences. The results are used to develop organizational practices and, in some cases, to recognize and reward supervisors. Processing certain personal data is necessary to ensure reliable comparison with previous surveys and to identify trends over time. These surveys and related actions are intended to benefit employees as well. Participation is voluntaryPerformance management (such as Digivinkki): The employer has the right to manage work and monitor performance. Employee-specific monitoring related to work tasks, including system-based tracking, is carried out under the employer’s legitimate interest, provided that only work-related and necessary data is collected. Team leads may access employee-level data for supervisory purposes, while aggregated data is used for operational development.Salary surveys: To ensure competitiveness and fairness in remuneration, it is justified for the employer to obtain market salary data.Teams audio recordings and transcripts (text records): To ensure smooth operations and effective information flow within the work community, it may be necessary to record Teams meetings and process these recordings afterward.Personal Data Processed The type of data processed varies depending on the specific process; see the detailed HR process description.Data Subjects and Categories of Personal Data Employees—i.e. persons who are currently employed by, have been selected for employment with, or have been employed by the controller. Typically, for example: employee’s name and contact details, organizational details, employment details, payroll data, special details required for foreign employees, details of official permits, data needed for working time tracking and shift planning, data related to statutory leaves and absences, data on workplace exposures and work ability, competence, training, experience and qualification details, data needed for work tools and access rights, and data related to job satisfaction (pulse surveys).Data source As a rule, the data is obtained directly from the employee or accumulated during the employment relationship in the employer’s systems or manual records, or consists of agreed information such as salary and other benefits.Recipients of Personal Data Personal data is disclosed to fulfill the employer’s statutory obligations, for example to the Tax Administration, Kela, and pension and accident insurance companies. To meet obligations arising from law and collective agreements, the employer also shares employee data with employee representatives and, for instance, with the election committee responsible for organizing occupational safety elections.Regarding payroll, the employer may be legally obliged to provide information e.g. to authorities and the employee’s trade union. The payslip is delivered from the CGI payroll system to the ePayslip service, which the employee accesses via their online bank.When hiring a foreign employee, the law requires notification to the TE Office, the occupational safety authority, and the employee representative.Employee data is shared with the S Group’s customer-owner register to ensure that the employee receives the purchase benefits to which they are entitled.Basic employee and employment details are shared with occupational health services to ensure employees receive the services to which they are entitled. Medical certificates obtained outside occupational health are provided to occupational health as required by law, unless the employee has expressly prohibited disclosure. Early support discussions and work ability negotiations are likewise communicated to occupational health. Information on employees exposed to biological agents in the workplace is disclosed, upon request and as required by law, to the occupational safety authority, occupational health services, the municipal or hospital district physician responsible for infectious diseases, or occupational safety personnel.For employees taking job alternation leave, personal data must be disclosed to the TE Office and the unemployment fund.For apprenticeships, data is disclosed as required by law to the apprenticeship center via the SopimusPro system.For business travel, employees’ contact details are disclosed to the service partner (Amex GBT).Personal data is disclosed to the company conducting the salary survey to obtain up-to-date market data on salaries.The controller may also use service providers that process personal data on controller’s behalf. These include, for example (non-exhaustive list): Eezy Spirit Oy (TYT survey implementation),Elisa Oyj (phone and broadband subscriptions),Fujitsu (user accounts, mailbox, Service Desk support), ePassi Payments Oy (wellness benefit, only with the employee’s consent),LeasePlan (company cars),Korn Ferry (salary surveys and job evaluation),Competence Dimensions Oy, Thomas International Oy,AON Assessment (assessments), Celkee Oy (pulse tool for organizational development, Creamailer Oy (platform for managers’ newsletter), Microsoft (Office 365); Gravicon Modelspace Scudo pro, Grano Sokopro (construction-related systems), Coupa, Cognicount Oy and Accenture (invoice and order processing), Eezy flow (workplace survey).Transfer of personal data to third countries or international organisations and data protection safeguards used We use subcontractors in the processing of personal data, and data is transferred on a limited basis outside the European Union (EU) or the European Economic Area (EEA) for the provision of services, technical maintenance, and support. We may carry out such transfers if the European Commission has decided that the destination country or organisation ensures an adequate level of data protection, or if we can otherwise ensure an adequate level of protection for personal data in accordance with applicable legislation, for example by using the European Commission’s approved standard contractual clauses.We require our subcontractors to comply with the data protection and information security requirements set by legislation and by Data Controller.No personal data is transferred to international organizations.Retention period of personal data (or criteria for determining it) Retention periods vary by process; see the detailed HR process description. As a main rule, no employee data is processed after 10 years have elapsed from the end of the continuous employment relationship with the last company belonging to the S Group (the statutory obligation under the Employment Contracts Act to issue a reference ends at that time). In some processes, retention periods are shorter and are based on statutory limitation periods under labor law, statutory retention periods under accounting law, and ultimately on the employer’s assessment of the necessity of the data.Data Subject Rights The data subject has the right to access his/her own personal data as laid down in Article 15 of the General Data Protection Regulation (GDPR). The data subject has the right to demand that the data controller corrects eventual incorrect or erroneous information as laid down in Article 16 of the Data Protection Regulation. The data subject has the right to have their personal data removed in case the preconditions stated in Article 17 of the Data Protection Regulation are met. The data subject has the right to restrict the processing of their personal data in case the preconditions stated in Article 18 of the Data Protection Regulation are met. The data subject has the right according to Article 20 of the Data Protection Regulation to move the personal data from one system to another for the part for which the data was received from the data subject, its processing is automatic and its processing is based on consent or agreement. The data subject has the right, based on Article 21 of the Data Protection Regulation, to object to the processing of the data that applies to them, in case the data was gathered in order to perform a task that concerns the common good, or based on legitimate interest, in case the other criteria included in the Article are met.If a data subject wishes to exercise their rights or to obtain further information on the processing of their personal data, they may contact the data controller named in this data protection policy.The data subject has the right to file a complaint with the supervisory authority.Withdrawal of Consent Where processing is based on consent, the data subject has the right under Article 7 of the GDPR to withdraw consent at any time. Withdrawal ends the controller’s right to process personal data for purposes that have no other legal basis than consent. Consent can be withdrawn by informing the controller.Effect of not providing personal data The impacts vary depending on the specific process. The employer, as controller, collects only data necessary for the employment relationship; therefore, failure to provide data may have consequences. Where processing is based on the employee’s consent (e.g., wellness benefit), The employee may refuse to give consent without any adverse consequence.Automated Decision-Making or Profiling No automated decision-making or profiling is associated with the personal data processing.General description of technical and organisational security measures We diligently protect personal data throughout its lifecycle by employing the appropriate data protection and information security measures. System providers process personal data at secure server facilities. Access to personal data is restricted and the personnel are subject to a confidentiality obligation.Within the S Group, we protect personal data through, among other things, proactive risk management and safety planning, protection of communications, continuous maintenance of information systems, backups, secure facilities, access control, and security systems. Physical documents containing personal data are stored, after initial processing, in locked and fire-safe storage.Granting and monitoring access rights is controlled. We regularly provide training to our personnel who participate in the processing of personal data, and ensure that our partners’ personnel also understand the confidential nature of personal data and the importance of secure processing. We choose our subcontractors with care. We continuously update our internal practices and guidelines. If, despite all safeguards, personal data falls into the wrong hands, identity theft or other misuse may be possible. If we detect such an event, we will start investigating it immediately and attempt to prevent any damage it may cause. We will inform the relevant authorities and data subjects of any information security breaches in accordance with legislative requirements.