Survey privacy policy

May 2018

In brief

This privacy policy covers how F-Secure handles personally identifiable information in its surveys.

F-Secure collects survey data on our customers' experience of working with us and our products and services. The data is used by F-Secure to improve our products, services, and collaboration with our customers.

In full

This service-specific policy focuses on the items we believe are the most relevant for you. Such items are in particular 1) the type of personal and private data that the service collects, 2) what we use it for, 3) our justification, 4) typical disclosures, and 5) for how long we store it. More information on such topics as well as on other aspects (data subject rights, contact information, etc.) of the processing of your personal data is also available via the embedded links.

What data do we collect?

We prepopulate our survey with the data that we have on you. This typically includes your email address, phone number, name, language, country, and other customer relationship data. We may additionally ask for some more information, such as age and gender, to help categorize responses. In the survey we ask about your experience with us.

Choices

We collect this data only where you consent to it by responding to our survey. You do not have to respond to us. However, we would very much appreciate that you do so, so that we know what you value to better serve you.

You can choose to no longer receive this type of survey invitation from us through the opt-out link in each survey invitation email.

Transfers and disclosures

F-Secure shares customer contact data with its affiliates and subcontractors so that they can contact customers for conducting surveys and to provide visibility of survey results to the relevant affiliates.

The affiliates and subcontractors agree to process personal data solely as instructed by F-Secure. The subcontractors are not allowed to use survey data for any other purposes. They are themselves responsible for cookie practices on their sites.

Retention

F-Secure creates a separate data set for each query. Query-specific data sets of survey recipients are destroyed from the survey system six (6) months from the launch date of the respective survey – unless you request that it to be deleted sooner. The purpose for retention is to ensure enough time for conducting a successful survey and analyzing the data. After this, the results will be anonymized and continue to be stored as aggregate results.

If you are our direct consumer customer and have responded to our Customer Care/Support survey, we store your survey results for as long as you are our customer (using our services) and six months thereafter or as long as you have subscribed to our newsletters.

If you are our corporate customer, your survey responses are stored in our customer registry in accordance to its retention rules.

Learn more

This text complements the service-specific retention times. The default rule under the law is that personal data should be deleted or anonymized once it is no longer needed for its purpose.

However, some personal data needs to be nonetheless stored for longer periods of varying lengths due to varying reasons.

Typical reasons why we deviate from the primary retention times include the following examples:

  • grace periods and backups (e.g. keeping your personal data stored for a designated time after the end of your subscription, so that we can safeguard the data against erroneous deletion);
  • applicable laws require us to store the data (e.g. to keep track of the purchase and payment of our services);
  • to pursue available remedies or to limit any damages that we may sustain (e.g. due to an ongoing dispute or investigation);
  • to solve or contain a recurring problem or to have enough information to respond to future issues (e.g. your support ticket related to a problem that was not permanently corrected during your customership);
  • to prevent fraudulent activity (e.g. to enforce a ban on our community);
  • your personal data is incorporated to other data for a secondary purpose (e.g. retaining logs);
  • other similar circumstances, where there continues to be a legitimate need for the ongoing storage of personal data.

The final removal of your account may be delayed to avoid disturbing the other interactions you have with us. This is the case when you have an F-Secure account (e.g. you have subscribed to our consumer services with your email address) and also i) have an F-Secure Community account or ii) you continue to subscribe to our marketing messages. The F-Secure Community account deletion policy is set out in its terms of service. You can opt out from our marketing messages at any time.

If you have purchased our service via one of our operator partners, account deletion is controlled by said operator partner. Upon the partner notifying us that your subscription has been terminated, F-Secure subsequently removes the account. This removal leads to the deletion or anonymization of any personal data related to the account.

If we have received your information when providing you with technical support, the information is stored as long as the respective support case remains unsolved. Once solved, the information is gradually deleted or anonymized within two years from closing the case.

Analytics data collected with the user’s consent is retained for statistical purposes and is not deleted on removal of personal data and the user account. After termination of the account, analytics data cannot be linked to any personally identifiable user.

Data that does not contain personal data (e.g. security data and aggregate analytical data) is retained as long as such data continues to be useful for the purpose it was collected.

Security

Information on the security practices that we employ to keep your data secure.

Learn more

We apply strict security measures to protect the confidentiality, integrity, and availability of your personal data when transferring, storing, or processing it.

We use physical, administrative, and technical security measures to reduce the risk of loss, misuse, or unauthorized access, disclosure, or modification of your personal data.

All personal data is stored on secure servers operated by F-Secure or our partners with access limited to authorized personnel only.

Your rights

Information on your statutory rights and how to contact us.

Learn more

You have the right to the data that we have on you. In particular, you have the following rights to the personal data that we hold on you:

  • Access and rectification. You have the right to ask us what personal data we have on you and to get a copy of the data that we can identify pertaining to you in this context. Should you find any errors (e.g. obsolete information) in such data, we urge you to contact our customer care to resolve the issue. Some of our service portals allow you to update your customer information. For such, you should update any changes to your personal data, for example change of address or email address. If you cannot update the changes yourself, you may inform us of the necessary changes.
  • Objection. You are entitled to object to certain processing of personal data, including for example the processing of your personal data for marketing purposes or when we otherwise base our processing of you on a legitimate interest. In the latter case, you need to establish a legally valid rationale for your objection.
  • Right to be forgotten. You also have the right to request us to cease storing your personal data and erase it. In this case you need to establish a legally valid rationale for your request.
  • Portability. You also have the right to ask for personal data that you yourself have provided – pursuant to a contract or your consent. You may request the data in a structured, commonly used, and machine-readable format and further that the data is transmitted to another controller, where technically feasible.
  • Withdrawing consent. In cases where the processing is based on your consent, you have the right to withdraw your consent at any time via relevant settings. For identifiable service analytics data, you can find the settings in the service user interface. You also have the right to opt out from our marketing communications via the preference center accessible through the link.
  • Restriction. If you establish that the data we have on you is incorrect or we have no legal right to use it, you may request that we cease any further processing of your personal data, and merely keep it in store until the issue is resolved.

You can exercise your rights via our customer care function. The links to contact us are in the "Contact information" section.

Note that there may be situations where our confidentiality obligations, our right of professional secrecy, and/or our obligations to provide our services (e.g. to your employer) may prohibit us from disclosing or deleting your personal data or otherwise prevent you from exercising your rights. Your above rights are also dependent on the legal grounds based on which we process your personal data.

If you have any complaints about how we process your personal data, or would like further information, please contact us at any time. If you feel that we are not enabling your statutory rights, you have the right to lodge a complaint with a supervisory authority. In most cases, this authority is the Finnish Data Protection Ombudsman (www.tietosuoja.fi).

Contact information

If you have any questions or concerns about the matters discussed in our privacy policies, please contact:

F-Secure Corporation
Tammasaarenkatu 7
PL 24
00181 Helsinki
Finland

How to contact us:

  • If you are a client of our consumer line of products, please contact us via f-secure.com/support.
  • If you are a client of our corporate line of products, please contact us via f-secure.com/corporate-support.
  • If you are a client of MWR Infosecurity, please use the contact information at mwrinfosecurity.com/privacy-policy/.
  • You can contact F-Secure’s Data Protection Officer by sending a message to privacy-office@f-secure.com. If you wish to exercise your rights as a data subject, please use the above links instead.

 

General

Information on definitions and change management.

Learn more

Definitions

This is what we mean when we make certain references within this policy.

"Client", "you", refers to a private or corporate user or any other data subjects who buy, register for use, or use our services, whose devices and data traffic are protected by our services, and who may have submitted personally identifiable information to us. This information may have been submitted through the use of our services, websites, telephone, email, registration forms, or other similar channels.

"Personal data" refers to any information on private individuals that is identifiable to them or their family or household members. This information may include names, email and mailing addresses, telephone numbers, billing and account information, and other, more technical information that can be linked to you, your device, or the behavior of either, that we process while providing our services.

"Services" refer to any services or products that are manufactured or distributed by F-Secure, including software, web solutions, tools, and related support services.

"Website" refers to the www.f-secure.com website or any other website that F-Secure hosts or controls, including subsites and browser-based service portals.

Changes

This version of the policy clarifies, updates, and replaces the previous version. To continue keeping this document up to date, we will make changes and additions to this from time to time also in the future.

We will publish the changed policy document on our website or at another interaction point where it has previously been made available. If the changes are significant, we may also notify you by other means. Any changes will apply starting from the date that we publish the revised policy document.