PRIVACY POLICY STATEMENT

Controller

Neles Oy 30 Years Foundation, business ID0760172-2, Vanha Porvoontie 229, 01380 Vantaa, Finland / Helena Airaksinen, helena.airaksinen@valmet.com, +358 50 564 4211, secretary.

Contact person

Markku Ahlbäck, markkuahlback@gmail.com, +358 400 430 367, Chair of the Board

Purpose of processing personal data

Neles Oy 30 Years Foundation is a grant foundation that awards grants based on applications to fulfill its purpose. It
has established a register to process grant applications, award decisions and the related payments. The purpose of the processing in connection with grants is the legitimate interest of the controller, and mainly consent in relation to partners.

Information content of the register

In connection with its grant operations, the foundation processes personal data in accordance with the principles of good information management and good processing practices as stated in the General Data Protection Regulation. Data protection applies to all personal data collected, recorded, used, processed and disclosed by the foundation. Data is processed when assessing applications, paying grants, processing reports related to the use of grants and when communicating the foundation’s activities. After making decisions concerning grants, the foundation is obliged to report the grant holders’ personal data and the amounts of grants to pension insurance companies and the tax authorities.

Purpose of processing personal data

Only the details necessary to assess applications are collected via the foundation’s electronic application system. Necessary
details in an application: name, address, year of birth and contact details. Further information needed to pay the grant: bank account number and personal identification number. Based on consent, the foundation may publish the grant holders’ names, the titles of funded applications, the amounts of awarded grants and the possible summary written on the use of a grant on the website of the foundation. Consent is obtained after awarding the grant and before making the payment.

When the foundation uses its electronic grant system and processes payment details related to grants, only authorized
people can process data, and data is only processed to the extent necessary to carry out assessment. Data recorded in the register is not sold, transferred or otherwise disclosed to third parties.

Retention of data

As the controller, the foundation stores grant holders’ every detail delivered via the electronic application system for
ten (10) years starting from the end of the year the grant is awarded. The details from other applications are stored for two (2) years from the end of the year of application. Details of the applicants who have received a grant are stored in relation to the funding of multi-annual projects, ensuring consistent assessment and monitoring the use of grants.

Applicants’ details are retained to serve applicants and monitor the assessment of applications. After the end of the retention period, based on the grant holders’ consent, the foundation retains the details concerning the grant holders’ names, the themes of their applications and sums allocated to them on the website of the foundation.

Destruction of data

Recorded data is destroyed after the end of the retention period mentioned above.

Data processing

The foundation’s grant process is initiated when the Board of the foundation approves the notification concerning the start
of the application period. The notification is published on the website of the foundation and in other channels if necessary.

Grant applications are submitted electronically in accordance with the instructions stated on the website of the foundation. After the end of the application period, the Board of the foundation studies the grant applications using their personal password-protected credentials. Based on their assessment, the Board of the foundation decides which projects are funded. When assessing the applications, attention is paid to whether the projects are in line with the framework provided in the deed of the foundation, the novelty value/innovativeness of the project, practical application, the amount of grant and the intended use.

Decisions only include the applicants’ names, themes of the applications/central content and proposed amounts of grants.

Handling of data requests and rectification requests

Data subjects have the right to request access to their personal data, the rectification or erasure of personal data, or the restriction of processing concerning the data subject, or to object to processing, as well as the right to data portability. However, the foundation does not disclose the comments of the assessors or persons giving their statements or the assessments made for internal use to the applicants. Data subjects always have the right to lodge a complaint with a supervisory authority (data protection supervisor).

Data subjects may send their information or rectification requests to the secretary of the foundation by email. The Board
of the foundation will respond to these requests concerning the content of its registers.

Publishing awarded grants electronically

In accordance with the recommendations given by the Association of Finnish Foundations, Neles Oy 30 Years Foundation publishes the grant holders’ names on its website. It is in the public interest to do so: society must know how foundations use their assets. The grant holders’ names and the titles of the projects are published to provide information about the operation of the foundation and the development of the fields it supports. The grant holders’ names are also published to prevent suspicions that foundations favor their related parties or a too limited public interest.