Processing of personal data in procurement

Purpose of processing personal data

Finnish Customs processes personal data when procuring goods and services. Finnish Customs processes personal data in accordance with the legislation concerning public procurement.

We need the contact details of the tenderers’ contact persons so that we can communicate with them during the procurement procedure, such as when we notify tenderers of our procurement decisions. We ask companies to include the contact details of the contact persons for the references in their tenders so that we can check the authenticity of the references. We also ask companies to name the experts for the contract subject to the competitive tendering to ensure that the key people with the necessary skills and experience are available at the time specified in the call for tenders.

We include the tender information in the procurement contract and therefore need to process the personal data included in the tender for the duration of the contract in order to implement the contract. Procurement documents, such as tenders, are stored in the Cloudia service that we use to communicate with the companies submitting a tender during the procurement process. We store the corresponding information in the tendering services of the joint procurement unit Hansel Oy (the Kisa-apuri tendering service, Charter Bus Services, and a vehicle tendering service) when we procure goods and services under contracts offered by Hansel. We save the tenders and other procurement documents as well as contracts that we receive from the systems in our case management system.

In the event of an appeal or a request for an administrative review of a procurement decision by an interested party, we must process the personal data in the procurement documents subject to the appeal in a manner appropriate to the outcome of the appeal or administrative review during the appeal process and any legal proceedings. For example, we may carry out a new comparison of the tenders, if a court order requires us to do so.

During the contract period, we use the government’s common Handi service to manage orders and pay invoices. We use the invoicing information provided in the tender or contract for orders and invoices, which may also include the supplier's personal data.

Legal basis for processing personal data

The processing of personal data is based on compliance with a legal obligation to which the Finnish Customs is subject and the performance of a task carried out in the public interest (Article 6(1)(c) and (e) of the General Data Protection Regulation).

Competitive tendering

As a public procuring entity, we must comply with public procurement legislation, such as the Act on Public Procurement and Concession Contracts (1397/2016), the Act on Public Procurement and Service Concessions in the Water, Energy, Transport and Postal Services Sectors (1398/2016) and the Act on Public Contracts in the Fields of Defence and Security (1531/2011). Public procurement laws require a competitive tendering process for public procurements above a certain threshold.

In addition to legislation, we follow the government guidelines and recommendations on public procurement, such as the Public Procurement Handbook, the procurement code of Finnish Customs and our internal guidelines. Extracts from the criminal records of the tenderer’s selected personnel are checked in accordance with the Criminal Records Act (770/1993) in addition to the legislation on public procurement. The Act on the Contractor’s Obligations and Liability when Work is Contracted Out (1233/2006) obliges us to verify that contractors fulfil their legal obligations as employers and parties to a contract.

Under the Council Decision (CFSP) 2022/578 of the EU, the Ministry of Finance obliges us to take the EU restrictive measures, or sanctions, into account in our procurement. The sanctions checks we carry out apply to both companies and their beneficiaries.

Other procurements

We also need to process personal data for procurements that do not exceed the thresholds set in the procurement legislation or that are not subject to competitive tendering due to special provisions concerning the scope of the legislation. In that case, we have grounds for processing personal data during the procurement in order to perform a task carried out in the public interest to carry out the statutory duties of Finnish Customs cost-effectively and with high quality when we verify the qualitative characteristics of the tenders and communicate with the tenderers.

Other processing situations

Our processing of personal data is also based on legislation in the context of appeals against procurement decisions, audit procedures under the legislation on the State budget and the processing of requests for information concerning procurement documents.

Personal data processed and groups of data subjects

We process personal data relating to companies that provide us with products and services and their designated subcontractors, such as:

  • contact persons for tenders and contracts
    • names, position, contact details and business ID
  • persons involved in deliveries
    • names, descriptions of experience and professional skills, contact details and business identity number
  • contact persons for reference customers
    • names, contact details and business ID
  • members of the administrative, management or supervisory bodies or persons with powers of representation or decision-making or supervisory authority
    • extracts from criminal records
  • the sender of a delivery invoice
    • the name, contact details, business ID and invoice reference of the sender of the invoice.

Sources of personal data

We receive personal data from the companies that offer us products and services. In addition, we receive personal data from public sources, such as the trade register maintained by the Finnish Patent and Registration Office, the Reliable Partner service maintained by Vastuu Group Oy, and the corporate credit rating register and the sanctions data register maintained by Suomen Asiakastieto Oy. We will switch to using the sanctions list check service by the Finnish Government Shared Services Centre for Finance and HR (Palkeet) during the autumn of 2025.

Disclosures of personal data

Disclosure of personal data to authorities and funders

Data is disclosed regularly by the Cloudia and Handi services to the Ministry of Finance’s administrative operators for the collection of statutory procurement data.

The National Audit Office may request procurement documents as part of an audit under the State Budget Act (423/1988) and the acts adopted based on it.

For procurements with external funding, the funder may request procurement documents as part of the audit required by the funding terms and conditions.

Procurement documents may also be handed over to the National Archives of Finland to the extent that they have been designated for permanent storage.

In addition, information may be disclosed to the requesting party on a case-by-case basis in accordance with the Act on the Openness of Government Activities (621/1999). The information and documents of an authority are public, unless it has been expressly provided by law that they are non-disclosable.

The parties processing personal data

We store documents related to procurements in the Viva case management system provided by the Government ICT Centre Valtori.

Joint controllership

We place orders and receive invoices electronically using the Handi service provided by the Finnish Government Shared Services Centre for Finance and HR (Palkeet).

Finnish Customs is a joint controller of this service along with Palkeet. The responsibilities related to joint controllership are defined in the Act on the Government Shared Services Centre for Finance and HR. It provides that Palkeet is responsible for the technical operation and related matters of the information systems necessary for the performance of its tasks and services, including availability and the integrity, protection and storage of data. As for Finnish Customs, it is responsible for the other responsibilities of a controller, such as informing the customer. Finnish Customs also acts as a point of contact for customers who wish to exercise their rights as data subjects, such as rectifying data or finding out what information related to the customer is being processed.

Palkeet processes personal data as a joint controller while providing services to its customers. In that case, the grounds for processing the data is the performance of legal obligations (the Act on the Government Shared Services Centre for Finance and HR (179/2019)).

Transferring personal data to countries outside the EU

Data is not regularly transferred outside the EU/EEA. However, information may be disclosed to a requesting party outside the EU/EEA in certain cases in accordance with the Act on the Openness of Government Activities (621/1999). The information and documents of an authority are public, unless it has been expressly provided by law that they are non-disclosable.

Storage and deletion times of personal data

We store procurement documents (contract notices, invitations to tender, tenders, opening reports, tenderer evaluation reports, procurement decisions, explanatory memorandums, contracts, orders, order confirmations, complaints, etc.) for 10 years after the end of the contract. For projects that have received international funding, we store the data for 10 years after the end of the project. We store data related to invoices for 10 years.

The data storage time is based on legislation on archives and specific laws as well as the need to document and guarantee the protection under the law of the authority, the individual and the community. The storage times of documents related to procurement are specified in the data management plan of Finnish Customs.

Information on extracts from criminal records is not stored or retained; instead, it is returned or destroyed immediately after the extracts have been checked.

Contact details and further information of the controller

The controller of personal data relating to Finnish Customs’ procurement is Finnish Customs. The contact person of the controller is Director of Procurement Sirpa Reunanen-Alatalo; her e-mail address is sirpa.reunanen-alatalo@tulli.fi.