​​General privacy statement​

This general privacy statement (hereinafter referred to as ‘Statement’) describes how we collect, process, and disclose personal data in connection with the management of customer relationships and the provision of services.

1 Controller 

The controller is the Helsinki Region Environmental Services Authority (hereinafter referred to as ‘HSY’, ‘we’). HSY is responsible for ensuring that your personal data is processed in accordance with this Statement and applicable data protection legislation.  

Contact information of the controller: 

Helsinki Region Environmental Services Authority HSY 
Business ID: 2274241-9
Address: Ilmalantori 1, 00240 Helsinki, Finland 

Data protection officer: Miikka Pekkarinen
Email address: tietosuojavastaava@hsy.fi

2 Collection of personal data 

Personal data is collected primarily from individuals themselves in connection with the establishment and management of customer relationships. As a rule, we collect and process personal data that  

  • you provide to us when you join our water and waste management services, contact us, deal with us e.g. through our customer service or at our locations, subscribe to our newsletter, or participate in a survey or event.  

In addition, we may obtain personal data 

  • from other sources to the extent permitted by applicable laws, including the Land Information System, the Population Information System, Suomen Asiakastieto, or the Business Information System. 

We collect and process personal data in the following contexts and categories of personal data: 

  • conclusion of a contract; ordering and use of services 
  • basic data of water services and waste management customers, such as first and last name, personal identification number, contact information (email, address and phone number), preferred language of communication, billing information (invoice recipient details and bank account details) 
  • details of the water service provided, including property details, connection types, connection point data, water consumption data for the property and the amount of wastewater to be received based on this data 
  • details of the waste management service provided, including the types of waste to be collected and property details 
  • information needed to submit work orders for water services, such as property details, contact information and billing information  
  • information collected at the waste reception location, such as contact information, information on the batches of waste and the amount of waste, vehicle registration number and billing information 
  • the billing and contact information and delivery address collected in connection with the sale of topsoil  
  • contacts and call recordings received by customer service, and the related contact information 
  • documents received by the registry, such as applications and the related personal data provided by the applicant 
  • data related to events, studies, surveys and competitions, such as responses, interviews, videos and photos 
  • requests regarding the rights of the data subject and the responses given based on them 
  • camera surveillance at properties managed by HSY 
  • other data determined on a case-by-case basis based on your consent

3 Purpose of processing personal data and legal bases for the processing 

The main purpose of the processing of personal data is to provide water services and waste management services to customers, as well as to carry out other statutory tasks of the municipal federation and ones falling under its charter. We only collect and process personal data that is necessary to our operations and for the management of customer relationships. 

The processing of personal data is generally based on the execution of an agreement between the customer and HSY, legislation binding HSY, and the data subject’s consent. In some situations, the basis for the processing may be a task carried out in the public interest/exercise of official authority, or the legitimate interest of the controller/a third party. (Article 6(1)(a), (b), (c), (e) and (f) of the General Data Protection Regulation). 

We process your personal data for the following purposes: 

  1. Management of customer relationships and provision of services to customers 

    We process your personal data primarily for the purpose of managing the customer relationship and providing services. This includes, for example,     customer service, contract management, invoicing, settling of applications and claims, and other use of personal data in administrative tasks.

  2. Compliance with statutory obligations

    The provision of services is primarily related to HSY’s statutory obligations in providing water services and waste management services, and we process your personal data to fulfil our statutory obligations. HSY handles the waste management and related activities of its member municipalities in accordance with the Waste Act (646/2001), and acts as a water utility within the meaning of the Water Services Act (119/2001). HSY’s statutory tasks are also defined in the Act on Cooperation Between Municipalities in the Helsinki Metropolitan Area in Waste Management and Public Transport (6 November 2009/829).

    In this case, the purposes of processing personal data include the organisation of HSY’s statutory waste management services, the management of water services in its area of operation, the management of customer relationships, and the implementation of customers’ rights and obligations. These obligations include, for example, connecting a property in the area of operation of a water utility to the utility’s water networks, concluding connection and usage agreements for water services, organising waste transports, waste treatment, waste reception, as well as invoicing and customer service related to these tasks.

  3.  Customer communications and disturbance notification

    We process your personal data for the purpose of sending disturbance, information and news messages, and for the performance of related tasks.
  4. Organisation of studies, customer surveys, competitions and events

    We process your personal data in connection with studies, competitions, customer surveys and events organised by HSY. The information obtained from studies and surveys may be used to develop HSY’s services or, for example, to target advice and communication and to select priorities (campaigns). 

  5. Other purposes

    Your personal data may also be used to develop HSY’s operations and for statistical purposes. For example, water consumption data from properties can be used to manage the water networks and to detect leaks. In these situations, the personal data is anonymised. In addition, we may process your personal data for other purposes if you have given your consent to such processing. 

4 Transfers and disclosures of personal data 

HSY may use contractual partners acting on behalf of HSY in the technical, commercial or operational execution of data processing tasks, to whom personal data necessary for the tasks may be transferred. 

The provision of water services and waste management services, as well as the performance of HSY’s other statutory tasks and ones falling under its charter, may require the disclosure of personal data to HSY's member municipalities and partners. 

The above-mentioned contractual and cooperation parties may use the personal data only for the purpose for which the data was disclosed. 

The personal data contained in HSY’s customer registers is disclosed to third parties and organisations where necessary as follows: 

  • when our partners process personal data on our behalf and in accordance with our instructions; 
  • upon separate request, the data contained in the register may be disclosed to the authorities within the permitted and binding limits of the legislation in force; 
  • to comply with a request for information in accordance with the Act on the Openness of Government Activities (621/1999); 
  • to forward feedback or a claim for compensation, etc. to the parties responsible for carrying out the repair work related to the feedback or for processing the claim; 
  • to provide the information required for acting on behalf of another person to the party entitled to do so; and 
  • to carry out studies on our behalf. 

5 Transfers of personal data outside the EU or EEA 

The starting point is that personal data will not be transferred outside the EU or the European Economic Area. However, if we transfer personal data to our partner located outside the EU or EEA, we will take the appropriate protective measures to ensure the rights and freedoms of data subjects in accordance with the data protection legislation and official recommendations in force at the time. 

6 Storage of register data 

Personal data is only stored for as long as is necessary for the purposes specified in this Statement. 

HSY applies the following storage period principles: 

  • order, delivery, purchase and payment information is stored for the period required by applicable legislation; 
  • basic customer relationship data is stored for the duration of the customer relationship and thereafter for as long as is necessary to fulfil the rights and obligations of the parties; and 
  • service-specific information is stored in accordance with service-specific principles. 

In addition to the above-mentioned storage period principles, HSY generally stores personal data for a maximum of three (3) years, unless there are valid grounds for a longer storage period. 

Please note that your personal data may also need to be stored for longer than the above if applicable legislation, such as the Waste Act (646/2011), the Accounting Act (1336/1997), the Act on Debt Collection (513/1999) or the Archives Act (831/1994), or the contractual obligations of HSY to third parties so require. The information in the connection agreement for water services customers and the waste management order confirmations for waste management customers will be stored permanently. 

HSY assesses the necessity of storing data annually and erases data if there are no grounds to keep it. In addition, HSY takes every reasonable step to ensure that personal data that is inaccurate, incorrect or outdated with regard to the purposes for which it is processed is erased or rectified without delay. 

Personal data is destroyed or anonymised when there are no longer any grounds to keep it. 

7 Rights of the data subject 

You have the right to be informed about the processing of your personal data, the right to review the data concerning you stored in the register, and to request the rectification of incorrect data. In certain situations, you have the right to request that processing be restricted, to object to processing, or to request the erasure of your data. However, please note that personal data that must be stored in accordance with section 6 cannot be erased. 

When we process your personal data based on consent, you have the right to withdraw your consent at any time. We will then not process your personal data unless there is another legal basis for the processing. 

A request for the exercise of the above-mentioned rights can be submitted using the form for the right to inspect your own data on HSY’s website. The request can also be made in person at HSY’s locations by filling in the form for the right to inspect. If necessary, HSY will ask you to specify the request in writing and to verify your identity before processing the request. HSY will refuse to carry out the request only on grounds provided by law. 

If you feel that the processing of your personal data has not been appropriate, you have the right to contact the Data Protection Ombudsman. The contact information of the Data Protection Ombudsman is available on the website of the Office of the Data Protection Ombudsman.

8 Information security 

We take appropriate steps (including physical, digital and administrative measures) to protect personal data against loss, destruction, misuse, and unauthorised access or disclosure. As an example, access to personal data is restricted to persons who need it to perform their duties. 

Please note that even appropriate measures cannot prevent all possible information security breaches. In the event of a personal data breach, we will notify you in accordance with applicable laws. 

9 Changing the statement 

HSY may make changes to this Statement, if necessary. Any changes will be announced on HSY’s website at www.hsy.fi, where you can find the latest version of this Statement. 

Updated on 24 March 2025