Leppäkosken Sähkö Oy Etusivulle

Privacy Notice: Customers of Leppäkosken Sähkö Oy

This Privacy Notice explains how Leppäkosken Sähkö Oy (hereinafter also referred to as the “Data Controller”) collects and processes the personal data of its customers and prospective customers, as well as their contact persons.

 

1. Data Controller

Leppäkosken Sähkö Oy
Business ID: 3086071-4
Address: Eino Salmelaisen katu 23, FI-39500 Ikaalinen, Finland
Telephone: +358 3 453 400
www.leppakoski.fi

For data protection matters concerning the Leppäkoski Group, please contact us by email at tietosuoja@leppakoski.fi.

 

2. Purposes and legal bases for processing personal data

We process personal data for the following purposes:

  • establishing, maintaining and developing customer relationships
  • maintaining customer information
  • invoicing, payment monitoring and debt collection
  • providing, quality-assuring and developing services and products
  • communicating about services and products
  • organising competitions and prize draws
  • organising customer events
  • customer service and customer communications, including customer service and control-room calls
  • responding to and processing enquiries and other communications
  • providing electronic services
  • maintaining and improving occupational safety
  • enabling, analysing and developing website functionality
  • possible statistical analysis and scientific research

The processing of personal data may be based on:

  • the data subject’s consent, for example when using Leppäkoski’s online services
  • the performance of a contract or taking steps at the request of the data subject prior to entering into a contract, such as customer agreements with consumer customers
  • compliance with a legal obligation, such as requirements under the Electricity Market Act and the Accounting Act
  • the Data Controller’s legitimate interests, such as customer agreements with organisational customers or the development of services
  • the protection of the vital interests of the Data Controller’s personnel, for example when reporting safety observations

Where processing is based on legitimate interests, our legitimate interests are conducting our business and providing, supporting and developing our services.

To the extent that personal data is used for statistical or scientific purposes, the processing is based on the performance of a task carried out in the public interest, namely scientific research.

Personal data is not used for automated decision-making or profiling.

 

3. Personal data processed

We process the personal data necessary for managing customer relationships and providing services. This includes:

  • the data subject’s basic information, such as their name, personal identity code, customer number and point of electricity use
  • contact details, such as their telephone number, email address and postal address
  • information concerning contact persons of corporate customers, such as information about their employer and professional position
  • information relating to the customer relationship and agreements
  • invoicing and payment information
  • information relating to energy consumption and generation
  • marketing consents and objections, as well as information concerning any marketing activities
  • non-disclosure orders
  • audio recordings and timestamps of customer service and control-room calls
  • information collected through forms or other communications, and the history of such communications
  • any other information voluntarily provided by the data subject and collected with their consent

 

4. Sources of personal data

Personal data is generally obtained directly from the data subject in the following situations:

  • when a customer relationship is established or during the customer relationship
  • when services are used or the data subject registers for them
  • when requesting a quotation or completing an online form
  • when consent is given to add information to the customer information system

Information concerning a corporate customer’s contact persons is obtained either directly from the individuals themselves or from the organisation they represent.

Providing personal data is not a statutory or contractual requirement. However, providing certain personal data is necessary for us to provide services and establish a customer relationship.

Personal data may also be obtained from other sources, including:

  • other energy companies operating in the electricity market
  • the centralised information exchange system for the electricity market, Datahub, where the exchange of information is based on applicable legislation or official regulations
  • registers maintained by public authorities and other data controllers, such as the Population Register Centre or Suomen Asiakastieto Oy
  • other address and data update services

Customer service communications may be recorded to ensure and improve the quality of customer service. Calls to the electricity network control room are recorded to maintain security of supply.

 

5. Recipients of personal data

As a general rule, personal data is not disclosed to parties other than subcontractors engaged by the Data Controller. These subcontractors process personal data on behalf of and for the account of the Data Controller in order to provide services. A processor of personal data may, for example, be a provider of a customer relationship management system. We ensure that our subcontractors process personal data only for the purposes described in this Privacy Notice, in accordance with our instructions and applicable legislation.

Personal data may be disclosed to other companies within the Leppäkoski Group. Such disclosures are based on the Data Controller’s legitimate interests, namely improving business efficiency and reducing overlapping processing activities. Personal data is not disclosed for the marketing communications of other Leppäkoski Group companies.

Personal data may also be disclosed to public authorities, electricity market participants and the centralised information exchange system for the electricity market, Datahub, to the extent permitted or required by electricity market legislation and other applicable legislation.

In addition, data may be disclosed for the purposes of scientific research, within the limits permitted by law, for example to universities with which we cooperate.

 

6. Transfers of personal data outside the EU or EEA

As a general rule, personal data is not transferred outside the European Union or European Economic Area.

Where personal data is transferred outside the EU or EEA, the transfer will always be carried out in accordance with applicable legislation and on the basis of an adequacy decision adopted by the European Commission or by using standard contractual clauses approved by the European Commission, together with any necessary supplementary safeguards.

 

7. Retention period

Personal data is retained only for as long and to the extent necessary for the purposes described in this Privacy Notice.

To comply with legal requirements and prepare for potential liability claims, personal data is retained for at least ten years after the termination of the agreement. However, the company may be required to retain your personal data for longer than is necessary for a particular processing purpose. Further information on personal data retention periods is available in the table on our website.

 

8. Rights of the data subject

The data subject has the right to:

  • request access to their personal data and obtain a copy of the data we process
  • request the rectification of inaccurate or incomplete personal data
  • request the erasure of personal data in certain circumstances
  • withdraw their consent to the processing of personal data
  • request the restriction of processing or object to processing in certain circumstances
  • receive their personal data in a commonly used, machine-readable format and request that the data be transferred to another system in certain circumstances

Requests to access or rectify personal data may be submitted using Leppäkoski’s online form or in person at Leppäkoski’s premises at Eino Salmelaisen katu 23, FI-39500 Ikaalinen, Finland.

The data subject also has the right to lodge a complaint with the Data Protection Ombudsman. Further information on lodging a complaint is available on the website of the Office of the Data Protection Ombudsman at www.tietosuoja.fi.

This Privacy Notice was last updated on 30 September 2025.