Processing of personal data in customer services

Purpose of processing personal data

Finnish Customs customer services (information services) give advice and provides services related to customs transactions.

The customer information services are divided into general information services and information services for businesses. Personal data in matters concerning information for customers are processed as follows:

Customs’ general information service provides private customers and small businesses with support for online declarations and customs information services by telephone, by letter, as email consultation and via chat (including a chatbot service).
Finnish Customs information service for businesses provides customers with general advice related to customs transactions and message exchange. Further, the information service for businesses provides procedure-specific advice on import and export procedures, transport and warehousing procedures as well as for safety and security declarations (AREX). The information service for businesses also advises on matters involving the use of the TRACES system and approves the user roles for the system. Business information is provided by telephone, letter, email, as a chat service (includes a chatbot) and via Skype as well as during business information visits arranged in advance, either at the customer’s facilities or Customs’ facilities if required. The business information service also processes certain authorisation decisions.
Personal customer registration data and customer data of Customs Statistics are processed by the customer information service.
The customer information service processes information in control reports of personal data, collected from the Customer Register and Authorisation Register.
The customer information service processes compiled lists of email addresses of customers in the Customer Register and Authorisation Register for the purpose of customer surveys.
The customer information service processes data on customs clearance, authorisation services and tax collection to provide customer support, and for the development of customs clearance services, authorisation services and tax collection services.
The customer information service responds to customer feedback and organises surveys regarding customer satisfaction and needs (customer surveys) as well as collects customer needs and viewpoints in the context of development projects for the improvement of the customs declaration systems.
The customer information service receives feedback on accessibility, processes the feedback and responds to it as well as transfers the feedback for processing and response by other functions at Customs.
The customer information service receives customer registrations for Customs’ projects, events and trials.
The customer information service takes care of the cooperation with customers together with Customs’ customer cooperation groups and customer networks.
Customs’ switchboard provides the customer with information via a chat service and directs the customer to Customs’ services.

Personal data collected by the above mentioned customer information service are also processed in Customs’ notifications provided by the customer service and interest groups, in the maintenance of customer relations, in the follow-up of the quality and correctness of Customs’ activity, in the planning of customer services as well as in the development of the service function.

The e-services of the customer services develop Customs’ electronic online services, are responsible for data protection matters of the Foreign Trade and Taxation Department and process requests regarding documents and information. Personal data in matters concerning e-services are processed as follows:

The e-services process personal data of the customer information service, customs clearance, the tax collection and authorisation services as well as customer data of Customs’ Statistics, when developing Customs’ electronic services. The e-services process customer feedback, customer contacts and customer surveys concerning the abovementioned functions and responds to them. The e-services also process customer registrations. The e-services process personal data of the abovementioned functions in cooperation and in contact with customers, in customer surveys and in contacts with suppliers, in service design projects, in tracking the quality of customer service and correctness of customs activities, and in the planning and development of e-services and transaction channels.
The e-services process and respond to feedback on accessibility concerning customer services.
In the development of message exchange in e-services, the list of suppliers of direct message exchange software is handled. The list is published on Customs’ website with the approval of the contact persons of the companies.
The e-services process information in control reports of personal data, collected from the Customer Register and Authorisation Register. The legal counsel of the e-services processes control requests related to personal data as well as data requests that concern documents and information.
The e-services process compiled lists of email addresses of customers in the Customer Register and Authorisation Register for the purpose of customer surveys.
The e-services provide statements in legal matters concerning the customer services.
The e-services process personal data of Customs’ customer registrations when carrying out tasks of the master user and the application administrator when giving advice to other users of customs services.
In the electronic services on Customs’ website, the visitors’ IP addresses are collected for measuring the number of visitors and for the development of the service based on the customers’ consent to the use of cookies. The data for the e-services are collected by the tool Fonecta Oy:n Snoobi Analytics, which deletes personal information from the data. Statistics on visitor numbers to be used by the Authorisation Services and Customs Statistics are generated from the data.

In Customs’ chat service on the web, IP addresses are collected for disruption management. The data are collected for Customs by Elisa Oyj.

Personal data for the performance of Customs’ statutory tasks are processed in accordance with the Customs Act (304/2016) and the Union Customs Code (EU 952/2013). Personal data are processed as prescribed by the Finnish Administrative Procedures Act (434/2003), in order to implement the service principal and the authority’s duty to provide service. The basis for the legal processing of personal data in accordance with the Data Protection Regulation is compliance with the controller’s statutory obligation.

Categories of personal data

The following personal data of private customers are collected to the customer services:

first and last names, personal identity codes, email addresses, and phone numbers (mobile phones), web addresses and IP addresses
first or last names, dates of birth, home addresses, registration numbers of vehicles and passport numbers
position, occupation, status, country of residence, status of representation, native language, communication language, citizenship as well as details on transactions and customer transactions

The following personal data of businesses are collected to the customer services based on transactions and on becoming a customer:

first and last names of responsible persons and contact persons, personal identity codes, email addresses, and phone numbers (mobile phones)
first or last names of responsible persons and contact persons, their dates of birth, other than mobile telephone numbers, home or other addresses, identification details of vehicles and passport numbers
position of responsible persons and contact persons, occupation, status, country of residence, status of representation, native language, communication language, citizenship as well as details on transactions and customer transactions

Personal data belonging to special categories (previously called sensitive personal data) may be included in customer feedback and in questions by customers.

Sources of personal data

Data to be processed by the customer services are obtained from Customs’ private and business customers. Data of the customer registrations are obtained from Customs’ customer register. Data of Customs’ clearances, authorisation services and tax collection are obtained from the customs clearance systems, authorisation systems and tax collection systems. Data of identification transactions are obtained from the Suomi.fi service maintained by the Digital and Population Data Services Agency.

Regular disclosures of personal data

Data from the customer information service are disclosed to parties concerned. The e-services do not disclose data of the customer information service that are needed for development, or transfer other data received from the other functions, except for personal data in responses to requests for audits, document requests and data request by parties concerned.

For the performance of Customs’ official tasks, details from the customer services can be transferred on reasonable grounds to other functions within Customs. Furthermore, data can be transferred to the National Archives of Finland insofar as they are to be stored indefinitely.

Furthermore, data may be disclosed to other authorities for the performance of official tasks according to the Act on the Openness of Government Activities of Finland (621/1999) and according to the Act on the Processing of Personal Data by Finnish Customs (639/2015). The data are disclosed when the right to information has been prescribed by special provisions in legislation.

The following personal data are only processed by personnel at Customs’ customer service, who have separate user rights required for customer service duties (customer information and e-services):

personal data in customer feedback, enquiries, contacts and registrations (forms, letters and emails as well as conversations via Skype, chat and telephone)
materials related to customer training arranged by the Customs School
personal data of customer registrations and customer data of Customs Statistics
materials of customer cooperation groups and customer cooperation networks (if needed, the data are processed by Customs’ Communication and the General Staff if there is a well-founded reason related to customer cooperation)
contact information of customers required for the development cooperation and customer cooperation (if needed, the data are processed by Customs Communication and the General Staff if there is a well-founded reason related to customer cooperation)
list of contact persons of software companies providing systems for direct message exchange
control requests regarding personal data as well as control requests related to documents and information

Other Customs personnel process data of the customer services as follows:

Customs officials at the customs offices receive oral and written customer feedback and customers questions, respond to them as well as transfer them to the customer services for responses. Officials at the customs offices also take care of the appointment service of the customs offices.
Customer service personnel at Customs’ switchboard receive and process customer communications that arrive to customs services via the Chat service and directs the customer to Customs’ services.
Customs’ Communication receives customer surveys from the customer services to be transferred to the customer information service.
The Customs School sends feedback surveys to customers who have participated in the webinar training, processes summaries of the surveys and feedback from the training as well as transfers this information to the customer information service.
The ICT Services process details of customer registrations for opening and testing customer connections.
The officer responsible for TRACES at the Enforcement Department processes the messages sent to the system’s email address for advice.

All customs officials process the following personal data:

customer cards with contact information of Customs’ business customers recorded in the ASPA workspace, details of message exchange authorisations and procedure authorisations as well as details of business consultation memorandums
details recorded in memorandums of customer cooperation group meetings

Other parties who process customer services details:

Fonecta Oy’s Snoobi Analytics tool, processes IP addresses of visitors of the e-services on Customs’ webpages when anonymising/pseudonymising personal data from addresses.
Elisa Oyj’s Elisa Desk platform, which is located in the Google Cloud of Finland, processes IP addresses of those who use Customs’ chatbot service. Ultimate.ai in the Google Cloud anonymises the personal data of the discussions in the chatbot service and no personal data remain in the service.
The Paytrail payment service processes the personal details of Customs’ customers (name, payment amount, reference number and payment method details) when customers select Paytrail as the method of payment in our e-service. Paytrail also receives our customers’ email addresses for sending a payment confirmation message.

Personal data retention and disposal times

Customer feedback that has arrived to the customer services by email or on forms via the Customs website, are stored for two years at most. After that, the customer’s name and contact information is removed for the archiving of the feedback. Questions that have arrived to the customer information service in written form, details of customer registrations and other customer contacts are stored for a maximum of two years. Replies to customers from the customer services are stored for a maximum of two years. Customer contacts that have arrive to personal email addresses of personnel at the customer information service are not stored. Anonymised customer feedback is stored on the network drive for a maximum of ten years.

Data of registrations that have arrived through Webropol to webinar training courses are stored for a maximum period of three years for requesting feedback and for outlining needs.

Data of customer service transactions in the Chat service (chat conversations and data of a technical nature) are stored for two years, after which the data, after anonymisation, can be used for machine learning, chatbot teaching and service development. Personal data are not stored in the chatbot service.

Feedback on accessibility and related replies, are saved indefinitely.

Customer surveys and replies to them are stored for ten years. Data of recipients of customer surveys and of those who have replied to the surveys are stored for three years.

Customer cards of customer services are stored for the current year plus six years counting from the end of the customer status.

Memorandums of consultations are archived for the current year plus ten years.

Memorandums drafted at Customs in meetings of customer cooperation networks and customer network groups are stored indefinitely, and those drafted by other parties for six years. Other personal data in customer cooperation groups and customer cooperation networks are stored for the time of the membership. The data is deleted once the membership has ended. However, non-recurring contact details of customer cooperation groups are stored for three years to safeguard development and feedback obtained regarding the development.

Data related to in-house control of AEO operators are stored for 10 years. The authorisation services and the Corporate Audit are responsible for the storage of other AEO material.
The list of contact persons of software suppliers for direct message exchange are updated and stored on Customs’ website for as long as the software suppliers provide direct message exchange software required for customs declarations.

Data received from customer registrations, customs clearance systems and authorisation services, are included in the abovementioned data of the customer information service, where they are stored for a pre-determined time.

Control requests regarding personal data and control requests related to documents and information as well as replies to them, are stored indefinitely.

Lists of customers’ email addresses collected are stored until they are transferred to a survey medium or a communication medium (e.g. letter or email distribution). Email addresses of a survey medium are stored until the survey is completed.

IP addresses collected by Fonecta Oy’s Snoobi Analytics tool, are not stored, rather they are destroyed during anonymisation/pseudonymisation.

IP addresses collected by the Chat service are retained for 30 days in Elisa Oyj’s technical log.

The authorisation service is responsible for retaining and deleting message exchange authorisations and processing authorisations. The authorisation service is also responsible for retaining and deleting amendment requests regarding trader office details.

The Customs School is responsible for retaining and deleting personal data contained in customer training materials.

Data of the customer services are deleted after the retention period ends.

Contact person of the data controller and additional information

Sini Sandberg
sini.sandberg(at)tulli.fi