Barona Työkykypalvelut Oy privacy policy

This privacy notice is valid starting from April 22, 2025.

Introduction

At Barona Työkykypalvelut, it is important to us that you can trust us to process your personal data in a careful and transparent manner while ensuring your privacy. We strictly comply with the General Data Protection Regulation (GDPR) and other data protection legislation, and we strive to act in accordance with good data protection practices. Barona Työkykypalvelut Oy is part of the Bravedo Group. 

This data protection notice describes how we collect, process and protect your personal data in the provision of vocational rehabilitation, career maintenance and other coaching services. In vocational rehabilitation, pension insurers partly act as data controllers (kuntoutu.net) and Barona Työkykypalvelut acts as a processor of personal data. This means that, in addition to this notice, the pension insurers’ own data protection notices will also apply in some cases of vocational rehabilitation.

This data protection notice is updated regularly. The current version is always available at https://policies.barona.fi/barona-tyokykypalvelut-oy-tietosuojaseloste/.

Data controller’s contact information

Barona Työkykypalvelut Oy
Business ID 1970081-6
Pasilan Asema-aukio 1, 00520 Helsinki

Contact information of the data protection officer

Lauri Huhtanen
privacy@barona.fi
+358 20 198 3460

Processing of personal data

Purpose of processing	Legal basis	Types of personal data	Retention periods
Management of customer data	Consent	Name, personal identity code or date of birth, phone number, email address, place of residence, employer, type of income, employer, customer relationship data, coaching-related data	Anonymised one year after the end of the assignment
Providing career maintenance	Consent	Name, phone number, email address, the information about the client in the assignment referral and the reasons for referral to the service	Anonymised one year after the end of the assignment
Providing rehabilitation services	Consent (collected by the client)	Name, personal identity code, phone number, email address, address, bank account number, location, the information and attachments in the assignment referral regarding the client, the rehabilitee and the reasons for referral to the service	Erased one year after the end of the assignment
Collection of customer feedback	Consent	Name (optional), age (categorised), income (optional), pension insurance company, place of service use, email address or phone number (optional, for further contact), employer, type of coaching service, opinion and satisfaction with the process (categorised)	Erased one year after the end of the assignment
Producing psychological tests for career counselling	Consent	Aptitude test results	Paper data collection forms are destroyed immediately after the end of the assignment, test records will be retained for 12 years from the preparation of the document on the basis of the appeal period related to legal protection in healthcare
Provision of courses	Consent	Name, email address	Erased no later than one year after the end of the assignment

Sources of personal data

Personal data is collected from any preliminary information received from the client who ordered the service and from you.

Disclosure of personal data

Disclosure refers to an event in which the controller (here Barona Työkykypalvelut) provides personal data to a third party that uses it for its own purposes. Personal data may be disclosed to the following parties:

The client organisation or the client for service-related reporting, for example
An employer offering a work try-out or job coaching place
An educational institution offering a place to study

Recipients of personal data

We use external service providers, such as system providers, to process the data. The service providers process personal data as data processors on behalf of Barona Työkykypalvelut. We use contractual and technical measures to ensure that the service providers we use process your data in accordance with legislation and good data protection practices.

We use third-party processors to process personal data for the following purposes:

Customer data and document management
Completing courses on the digital coaching platform
Communications
Invoicing

In some of our coaching programmes, we use Easy Generator as our digital coaching platform, for which you can register separately with your name and email address. The use of Easy Generator is also subject to the service provider’s own privacy policy, which is available at https://www.easygenerator.com/en/privacy-policy-data/. 

Data transfers outside the EU/EEA

In some cases, the service providers we use may process personal data outside the EU/EEA, e.g. in the United States. Personal data will only be transferred outside the EU/EEA area when the requirements of the data protection legislation are fulfilled. The service providers we use are contractually obligated to ensure that an adequate level of data protection is guaranteed in all processing of personal data.

Safeguarding your personal data

We use appropriate technical and organisational safeguards to protect personal data against loss, unauthorised access and other misuse. Examples of such measures include the use of firewalls, encryption technologies, backups and secure computer rooms. Access to your personal data is internally restricted through electronic and physical access control, as well as through policies for granting and controlling access to different systems. Access to personal data is restricted to those employees who have the right to access it within the scope of their duties.

Rights of data subjects

The data subjects have various rights that they can exercise to influence the processing of their personal data. The rights below can be exercised by sending a request on the matter by email to privacy@barona.fi.

Right to obtain information	The data subject has the right to obtain information on the processing of their personal data we perform in a transparent and easy-to-understand way. This data protection notice describes the basics of the processing of personal data. If you have any questions regarding data protection, please ask for additional information by using the contact information provided at the beginning of this notice.
Right of access	The data subject has the right to obtain information on what personal data regarding them we are processing and receive a copy of the data in question. As requested, the data controller will deliver a copy of the personal data being processed or information that the data subject’s personal data is not being processed.
Right to rectification	Data subjects have the right to request rectification or correction of their data, in which case we will complete inaccurate or incorrect data.
Right to erasure (“right to be forgotten”)	The data subject has the right to have all their personal data erased, i.e. the right to be forgotten. This right may be limited, for example, by a legal obligation to retain the personal data in question.
Right to restrict processing	The data subject has the right to request the restriction of personal data processing. The limitation of processing means that the data will be retained, but they will be processed in other ways only based on permission, for legal request, for protecting the rights of another person, or for an important reason related the common interests of the EU or a Member State. The restriction of processing is applicable in case, for example, the legality of processing has been disputed. Then, the processing of data is limited until its legality has been ensured.
Right to data portability	Data subjects have the right to request the transfer of personal data from one system to another. This right is applicable when the personal data has been collected directly from the data subject and the processing is based on a contract or consent.
Right to object	The data subject has the right to object to the processing of personal data on the basis of a personal reason if the grounds for processing is legitimate interest, public interest or exercise of official authority. The processing of the data is stopped unless the processing is necessary for some other justified reason.
Rights related to automated decision-making	The data subject has the right to not be subject to decision-making based solely on automated processing and which results in legal effects or other significant effects. The data subject has the right to request that a human reviews decisions that are based on automated decision-making. We do not make decisions based solely on automated processing of personal data that would have legal or other significant effects.
Right to withdraw consent	If the processing of personal data is based on your consent, you have the right to withdraw the consent at any time. However, this does not affect the lawfulness of any processing based on consent that took place before the withdrawal of consent. The processing of personal data may continue after the withdrawal of consent if another legal basis for the processing is applicable.
Right to lodge a complaint with the supervisory authority	The data subject has the right to lodge a complaint on the processing of personal data with a competent supervisory authority. In Finland, the data protection authority is the Office of the Data Protection Ombudsman.