Autopay Privacy Policy

Updated on: 26.3.2021


EuroPark Finland Oy stores and processes personal data in accordance with the EU's General Data Protection Regulation (GDPR).


We reserve the right to make changes to this privacy notice and/or e.g. the cookie policy of our websites.

 

1. CONTROLLERS

EuroPark Finland Oy, 1544350-9 PL 336, 00101 Helsinki (”EPF”)


All the personal data that is collected when customer registered to www.autopay.io parking system is controlled by 2Park Technologies AS, Martin Linges vei 25, 1364 Fornebu, Oslo, Norway (”2Park”)

 

2. CONTACT PERSON FOR REGISTER MATTERS

Data protection officer Risto Soininen, tietosuoja@europark.fi

 

3. NAME OF THE REGISTER

Autopay customer register

 

4. PURPOSE AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

The purpose of the processing of personal data in the register is to take care of, maintain and develop the relationship between EuroPark Finland Oy and its customers. The personal data of the register may also be used to investigate misuses in connection with the parking service provided by the controller.

The processing of personal data may also be based on the rental of a long-term parking space, in which case the customer relationship remains valid for the duration of the contract. The legal basis for the processing of personal data is the contractual relationship between the controller and the customer and/or our legitimate interest based on the customer relationship or other appropriate connection.

We also process personal data through camera surveillance. The purpose of the camera surveillance is to protect property, prevent vandalism and crime as well as to help with investigating crimes that have already taken place and other incidents that do harm to property and security. In addition, the purpose of the surveillance is to ensure the safety of our premises and persons in our premises. The camera located in the parking garage captures the license plate of each incoming vehicle. The legal basis for processing is our legal interests. A recording camera surveillance system is indicated with signs/labels located near camera surveillance devices. The recordings of the surveillance system are deleted after four weeks.

 

5. THE DATA CONTENT OF THE REGISTER

The register contains the vehicle's registration number, photographs of the vehicle's front and rear plates, as well as information about the parking garage and the date and time of parking. If the customer orders a text message receipt in connection with the payment, the customer's telephone number information is also processed for this purpose. The phone number is deleted after 90 days.


In the case of short-term parking, the camera takes a photograph of the registration plates of the arriving vehicle. When the vehicle is identified, the system links the customer's registration number to the parking system. The customer pays for their parking on site or within 48 hours of departure at https://autopay.io.


If the customer does not pay for parking on site and has not registered as a customer, an invoice will be sent to the customer. Our system retrieves the name and address needed for the invoice from Traficom's vehicle register.


The customer has the opportunity to register as an Autopay customer, in which case the system has, in addition to contact information (first name, last name, e-mail address, telephone number, registration number), the customer's payment card number. Parking is charged automatically from the payment card registered in the system. In these cases the data controller is 2Park.


In the case of contract customers, the register contains, in addition to the above, the contract customer's name, e-mail address, phone number, fax, business ID/personal identity number and billing address, as well as information on the number of parking spaces and of the parking area. For business customers, the contact information of the company's contact person is also stored in the register.

In addition, we process other necessary customer and contract information, such as:

 

  • Information on past and current contracts and orders
  • user profiles that are created based on customer relationships
  • call records
  • correspondence and other communication made with the data subject

 

All the personal data is kept for a time period that is needed to ensure the service and upkeep of the system.

 

6. REGULAR SOURCES OF INFORMATION

In the case of contract customers, personal information and vehicle information are collected from the data subject himself at the time of signing the contract. In connection with suspicions of misuse in short-term parking, the name, address and contact details of the owner/holder of the vehicle are collected from the vehicle register maintained by the Finnish Transport and Communications Agency (Traficom).

 

7. THE TRANSFER AND DISCLOCE OF PERSONAL DATA TO THIRD PARTIES

The vehicle registration number is sent to Traficom to determine the address details of the owner/holder of the vehicle. In addition, we may provide information to a collection agency for the collection of receivables.

We use subcontractors to process personal information. We have outsourced IT management (services related to data systems), accounting and legal services as well as telephone customer service to an external service provider.

 

8. TRANSFER OF PERSONAL DATA OUTSIDE THE EU OR EEA

Personal data is not transferred outside the EU or EEA.


Personal data may be processed outside the EU/EEA by a processor (subcontractor). We have taken care of appropriate safeguards in accordance with the EU General Data Protection Regulation for such subcontractors. An appropriate data processing agreement has been drawn up with such processors, who are also part of EU-U.S. Privacy Shield.

 

9. RETENTION PERIOD OF PERSONAL DATA AND PRINCIPLES OF PROTECTION OF THE REGISTER

We store the personal information for as long as it is justified for the delivery of our products and/or services and/or in accordance with applicable law. Personal data of contract customers will be stored in the register for the duration of the contract, after which they will be deleted from the register. For short-term and contract parking, the photograph of a vehicle's registration plate will be stored for a maximum of two weeks. In connection with suspected misuse, personal data collected from Traficom on the owner/holder of the vehicle will be stored for the time necessary to clear the matter. In addition, we will take reasonable steps to ensure that personal data about data subjects that are incompatible, out of date or inaccurate for the purposes of processing are not stored in the register.


Only our employees who have the right to process customer data based on their work duties are permitted to use systems containing personal data. Each user has their own username and password for the system. The data is collected to databases that are protected by firewalls, passwords and other technical means. Databases and their backups are located on locked premises. The data can only be accessed by persons who are specifically authorized to process the data.

 

10. RIGHTS OF THE DATA SUBJECT

The customer (data subject) has the right to inspect the data stored in the register about them and to demand the rectification or erasure of incorrect, outdated, unnecessary or unlawful information. The customer also has the right to object or to demand the restriction of the processing of their data and to lodge a complaint on the processing of personal data with the supervisory authority.


On grounds relating to their particular situation the customer also has the right to object processing activities concerning them, when the legal basis of processing is legitimate interest. In connection with your request, you shall identify the specific situation, based on which you object to the processing. We can refuse the request of objection only on legal grounds.


However, please note that personal data that is necessary for the purposes defined in this notice or that are required to be retained by law cannot be erased.