Whistleblower System

Prepared 28.2.2025, last reviewed on 28.2.2025

Register controller

Oy NIT Naval Interior Team Ltd. (FI19054949)
Hadvalantie 10, 21500 Piikkiö, Finland

Name of the register

NIT Naval Interior Team (NIT) Whistleblower system

Purpose of processing personal data

The anonymous reporting channel allows reports to be made without providing any data that would allow the reporting person to be personally identified. If the person making a report provides his/her details, or makes a report about another person, then processing of personal data will take place in order to identify and investigate any activity that is contrary to ethical principles, and possibly to bring the matter to a public authority for preliminary investigation, and to monitor the stages of investigation.

Basis for processing personal data

Personal data is processed in order to comply with legal obligations, and on the basis of the data controller’s legitimate interest.

Description of the data controller’s legitimate interest

Through the reporting system, it is possible to obtain important and systematic information about any suspected misconduct and violations, and to respond to them in a timely manner. The existence of a reporting system supports an employer’s good image, as well as a good business culture, by giving employees a channel for sharing grievances and suspicions. Reports can also be made anonymously.

Processed personal data

NIT only collects personal data that is necessary for the investigation of a case. Such data may include basic personal details, if a person provides these via the reporting system. Some examples of such data are a person’s name, phone number, or e-mail address.

It may also include details relevant to a case about a person who is the subject of the report — e.g., the person’s name and position within the company.

Data source and description of data sources

The anonymous reporting system operating on the internet network function as the data source.

Recipients of personal data

The personal data is processed in digital systems and services for the purposes specified in this Privacy Policy. We use external service providers in the production of system and support services.

NIT works to ensure a sufficient level of protection for personal data that is in our partners’ possession, according to what is required by law.

If an anonymous report requires a more detailed investigation, and if anyone’s personal details are given in the report, this personal data may be handed over to the persons in the organization who are responsible for internal investigations.

We disclose data to the authorities within the limits permitted and required by valid legislation when responding to authorities’ requests for information.

Transfer of personal data to third countries or international organizations, and the safeguards employed

We do not transfer personal data to third countries outside the European Union or the European Economic Area, or to international organizations.

Period for storing personal data, or criteria for determining the storage period

The personal data referred to in this privacy policy is only stored for as long as, and to the extent that, it is needed, and the data controller will utilize it for actions related to the reported purposes of processing.

With all other things remaining equal, reports and any associated personal data are stored for 2 years after the end of the investigation. If a case proceeds to court, and the proceedings in court require a longer period of storage, then the data will be stored for the period that the legal proceedings require.

Rights of the data subject

The data subject has the following rights:

• Right to access personal data
• Right to correction of data
• Right to erasure of data
• Right to restriction of processing
• Right to object processing
• Right to be informed of personal data breaches

If a person wishes to exercise his/her rights, or to obtain further information about the processing of his/her personal data, then he/she may contact the data controller mentioned in this privacy policy

People also have the right to lodge a complaint with the supervisory authority if they consider the processing of their personal data to violate the applicable data protection provisions.

Important information on automated decision-making or profiling

No automated decision-making or profiling is done.

Technical and organized safety measures

NIT protects personal data carefully throughout its entire life cycle, by employing the appropriate data protection and information security measures. The supplier of the anonymous reporting channel system (Keskuskauppakamarin Palvelu Oy) processes personal data at secure server facilities. All reports are encrypted, and can only be decrypted by designated personnel. Access to reports is restricted, and those who process reports have an obligation of confidentiality.

NIT protects personal data through anticipatory risk management and security planning, protective measures for data communication, continuous maintenance of data systems, backup copying, and the use of secure equipment facilities, access control and security systems. The granting and monitoring of user rights is a well-managed process. We regularly train those of our personnel who participate in the processing of personal data. We choose our subcontractors carefully.