Privacy Statement
Data Protection Notice for Oy Pohjolan Liikenne Ab's Customer Data File
18.11.2025
1 Controller
Oy Pohjolan Liikenne Ab ("Pohjolan Liikenne")
Business ID: 1003521-5
Veturitie 24
FI-00240 Helsinki, Finland
tel. +358 29 4343
2 Contact person in matters related to the data file
VR-Group Plc
Data Protection Officer
PO Box 488, 00096 VR
00101 Helsinki, Finland
tietosuojavastaava(a)vr.fi
3 Purposes of the processing of personal data
Personal data are processed in connection with customer feedback as well as passenger and traffic accidents. The purpose of the processing is to handle feedback, investigate incidents, and fulfil statutory obligations.
The processing of personal data is based on the controller's legitimate interest and on a legal obligation.
4 Sources of data
Personal data are primarily obtained from the data subject themselves, for example in connection with customer feedback or the submission of an incident report. In addition, information may be received from partners, such as transport commissioners, city transport authorities or insurance companies, when necessary for the processing of the matter.
5 Data subjects
The data subjects referred to in this data protection notice are individuals who have provided feedback to Pohjolan Liikenne or who are involved in passenger or traffic incident cases.
6 Data content of the data file
The following personal data may be processed of data subjects:
- Basic information and contact details (such as name, email address, phone number)
- Contacts (information related to the contact as well as the content of feedback or notification, which may include details such as travel time and destination)
- Information related to the incident (such as a description of the event, details of the parties involved, and the nature of the damage)
- Possible information related to communication with authorities or insurance companies (for example, reference number or decision details)
7 Recipients of personal data
Personal data can be disclosed to the authorities to the extent permitted by law. Data can be disclosed to companies belonging to the same group in order to present legal claims and to insurance companies for processing incident cases.
We use external parties to support the processing of personal data in the maintenance and development of IT systems, for instance. These service providers process personal data commissioned by us and on our behalf.
The data processing follows current legislation and is always carried out in accordance with this data protection notice. This is ensured, among other things, through contracts between the organizations.
8 Transfer or disclosure of data outside the EU or the EEA
Data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers to have an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.
9 Data retention period
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and in accordance with applicable legislation. After this, the personal data will either be deleted or anonymized.
10 Rights of the data subject
As our customer, you have a right to access your personal data of which we are the controller. You can exercise your rights by submitting a data protection request for this register by email tietosuojavastaava@vr.fi. Alternatively, you can submit the request in writing by delivering it to the address VR-Group Plc, Data Protection Officer, PO Box 488, 00096 VR.
You will receive a response to your request no later than one month after sending the request. We ensure these rights as described here by taking the applicable legislation and restrictions set therein into account. A reasonable fee can be charged in case the requests are recurrent and unreasonable.
Right of access to data
You have the right to receive a confirmation of whether we have processed your personal data, and a right to receive a copy of your personal data stored in this data file.
Right to rectification
You have the right to request us to rectify inaccurate or erroneous data about you.
Right to erasure ("right to be forgotten")
You have the right to request us to erase your personal data. Requests are handled on a case-by-case basis.
Right to restriction of processing
You have a right in certain special situations stipulated by the regulation to request the restriction of the processing of your personal data.
Right to object
When the processing of personal data is based on a legitimate interest, you can object to the processing of your data on grounds related to your personal situation.
Right to lodge a complaint with an authority
We seek to resolve any disputes primarily directly with our customers. If a data subject finds that we have not processed personal data as stipulated by law, the customer may lodge a complaint with a data protection authority.
11 Principles of data file protection
We ensure the data security of the processing of our customers' personal data processing and personal data confidentiality, integrity and accessibility with appropriate technical and organisational measures in accordance with data security principles of Pohjolan Liikenne.
Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by Pohjolan Liikenne to such tasks. We provide data protection training and guidance to our employees who process personal data.
Data Protection Notice for Oy Pohjolan Liikenne Ab's camera surveillance (CCTV)
4 November 2025
1 Controller
Oy Pohjolan Liikenne Ab ("Pohjolan Liikenne")
Business ID: 1003521-5
Veturitie 24
FI-00240 Helsinki, Finland
tel. +358 29 4343
2 Contact person in matters related to the data file
VR-Group Plc
Data Protection Officer
PO Box 488, 00096 VR
00101 Helsinki, Finland
tietosuojavastaava(a)vr.fi
3 Purposes of the processing of personal data
Personal data is processed to ensure the maintenance of order and safety, to protect property and to prevent and look into criminal offences, incidents or accidents in premises, properties, outdoor areas and buses of Pohjolan Liikenne.
The processing of personal data is based on the controller's legitimate interest.
4 Sources of data
A camera surveillance system that consists of recording surveillance cameras in Pohjolan Liikenne's premises, properties, outdoor areas and buses.
5 Data subjects
All persons moving in the camera surveillance area and recorded by the surveillance cameras are data subjects. These may include, for example, bus passengers, employees of Pohjolan Liikenne and other persons moving in the area.
6 Data content of the data file
Time and location specific visual recordings from premises of Pohjolan Liikenne, properties, outdoor areas and rolling stock, recorded by the camera surveillance system.
• in outdoor areas in the immediate vicinity of the bus
• at the bus entrances
• inside the bus (including the driver's workplace)
• at the premises of Pohjolan Liikenne
7 Recipients of personal data
Personal data can be disclosed to the authorities to the extent permitted by law. Data can be disclosed to companies belonging to the same group in order to present legal claims and to insurance companies for processing accident cases.
We use external parties to support the processing of personal data in the maintenance and development of IT systems and safety monitoring room duties, for instance. These service providers process personal data commissioned by us and on our behalf.
The data processing follows current legislation and is always carried out in accordance with this data protection notice. This is ensured, among other things, through contracts between the organizations.
8 Transfer or disclosure of data outside the EU or the EEA
Data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers to have an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.
9 Data retention period
Normally, camera recordings are stored for one month at the maximum. Data may be stored for a longer time, if necessary upon authorities' request, for instance.
10 Rights of the data subject
As our customer, you have a right to access your personal data of which we are the controller. You can exercise your rights by submitting a data protection request for this register by email tietosuojavastaava@vr.fi. Alternatively, you can submit the request in writing by delivering it to the address VR-Group Plc, Data Protection Officer, PO Box 488, 00096 VR.
In order to implement the request, you must provide a sufficiently precise and individualized description of the time and place where the video was recorded.
You will receive a response to your request no later than one month after sending the request. We ensure these rights as described here by taking the applicable legislation and restrictions set therein into account. A reasonable fee can be charged in case the requests are recurrent and unreasonable.
Right of access to data
You have the right to receive a copy of your personal data from Pohjolan Liikenne and a confirmation of whether we have processed your personal data.
Right to rectification
You have the right to request us to rectify inaccurate or erroneous data about you.
Right to erasure ("right to be forgotten")
You have the right to request us to erase your personal data. Requests are handled on a case-by-case basis.
Right to restriction of processing
You have a right in certain special situations stipulated by the regulation to request the restriction of the processing of your personal data.
Right to object
When the processing of personal data is based on a legitimate interest, you can object to the processing of your data on grounds related to your personal situation.
Right to lodge a complaint with an authority
We seek to resolve any disputes primarily directly with data subjects. If a data subject finds that we have not processed personal data as stipulated by law, the customer may lodge a complaint with a data protection authority.
11 Principles of data file protection
The premises of Pohjolan Liikenne where personal data is processed are protected with access control as defined in the facility security guidelines.
We ensure the data security of the processing of our customers' personal data processing and personal data confidentiality, integrity and accessibility with appropriate technical and organisational measures in accordance with data security principles of Pohjolan Liikenne.
Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by Pohjolan Liikenne to such tasks. We provide data protection training and guidance to our employees who process personal data.