Introduction:

Protecting your privacy and the transparency of the processing of your personal data is important to Supercell. The purpose of this privacy policy is to provide you with the information on

• how our CCTV camera systems work in and outside our building and how your personal data is processed in the system; and

• how your personal data is processed when you register as our guest at our reception. 

We process your personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 and national data protection legislation. 

Controller:

Supercell Oy

Business ID: 2336509-6

Address: Jätkäsaarenlaituri 1, 00180 Helsinki, Finland

Group Data Protection Officer contact: dpo@supercell.com 

CCTV Camera system

To ensure the security of our beloved building and everyone’s safety in it, we have CCTV cameras both in and outside our building. All CCTV cameras are set to pick up movements - this means that the recording activates only when the camera detects movement. 

Categories of data subjects and personal data we process

Categories of data subject comprise of Supercell employees, visitors and contractors, Withsecure and Hekka tenants who use Supercell’s car park, By the Sea employees who run child care in our building, as well as bypassers and drives. 

However, you are identified only in special situations, for example, if we need to investigate accidents or security breaches. 

Personal data we process

The camera footage may show the following identifying information, such as:

• Data subject face and body features

• Vehicle register plate number

Purpose and legal basis for processing

Based on Supercell’s legitimate interest, the purpose of our CCTV camera system is to ensure the security of our beloved building and everyone’s safety in it. This means that we may use the footage to investigate accidents or security breaches. 

Disclosure of data and data recipients

Our processors have access to the security footage when necessary for the maintenance of our CCTV system. 

The processors may only process your personal data in accordance with Supercell’s instructions. 

Your data may also be disclosed to the authorities to the extent permitted and required by law. 

Transfer of personal data outside EU or EEA countries

Your personal data is transferred to the UK to our subprocessor, who looks after and maintains our CCTV system. 

Data Storage

Your personal data will be processed only to the extent necessary for the purposes listed above.

As a rule, camera footage is stored for thirty (30) days, after which it is automatically deleted. 

In the event of e.g. incident investigations, it may be necessary to save and store part of the footage for a longer period.

Protection of personal data

Supercell uses appropriate technical and organisational personal data protection measures. With these measures we ensure that your personal data is not accidentally or unlawfully destroyed, lost or altered. We also ensure that the information is not disclosed without authorisation and cannot be accessed by anyone who does not have the right to process the information. 

Registering as our guests when visiting our Helsinki HQ

To ensure the security of our beloved building and everyone’s safety in it, we keep track of everyone who is visiting us. When you enter our building, our reception will ask you to register as our guest. After you’ve registered, a sticker name sign will be printed out for you to keep it attached to your chest for the duration of your visit with us. The sign will also mention the name of your host. 

Categories of data subjects and personal data we process

When you register as our guest, you can choose the category that best suits the purpose of your visit. The categories are:

• business visitor 

• contractor and externals; or

• personal guest

For business visitors, contractors and externals we require the following information:

• Full name

• Email address

• Company information

For personal guests we require the following information:

• Full name

Purpose and legal basis for processing

Based on Supercell’s legitimate interest, the purpose of our visitor log is to ensure the security of our beloved building and everyone’s safety in it. For security reasons, we need to know if we have external people in our building and who these visitors are. This information also ensures your safety in case we need to e.g. evacuate the building.

Disclosure of data and data recipients

The service provider, Envoy Inc., has limited access when necessary in the event of a technical support issue.

The processors may only process your personal data in accordance with Supercell’s instructions. 

Your data may also be disclosed to the authorities to the extent permitted and required by law. 

Transfer of personal data outside EU or EEA countries

The service provider, Envoy Inc., is located in the US. This means that your personal data is processed outside the EU/EEA area.

To ensure that your personal data is adequately protected, we carry out the transfer of your data as required by law by using standard contractual clauses adopted by the EU Commission. 

We ensure that your personal data is processed in accordance with this privacy policy no matter where your data is processed.

Data Storage

We will retain your data for 90 days for the purposes of possible incident investigations. After this period your data will be automatically deleted unless longer retention is necessary for our legitimate business interests, such as emergency evacuation and incident investigations.

Protection of personal data

Supercell uses appropriate technical and organisational personal data protection measures. With these measures we ensure that your personal data is not accidentally or unlawfully destroyed, lost or altered. We also ensure that the information is not disclosed without authorisation and cannot be accessed by anyone who does not have the right to process the information. 

Whether your case concerns our CCTV system or the visitor registration, you have certain rights as a data subject

You have the right to:

• Receive information on the processing of your personal data

• Request for the access to your personal data

• Request correction of your personal data

• Request the erasure or restricting of the processing of your personal data to the extent there is no overriding legitimate ground to keep the data, and

• Object to the processing of your personal data.

If you wish to exercise any of your data subject rights described above, please contact by email at legal-requests@supercell.com.

We will respond to all requests in accordance with applicable laws. To protect your privacy, we may also take additional steps to verify your identity before fulfilling your request. Once you have verified your identity, you may also designate an authorized agent to exercise your rights on your behalf by providing the agent’s contact information to our customer support staff, as required by applicable law.

Referral to the Data Protection Ombudsman

If you feel that your personal data has been processed in a manner that does not comply with data protection legislation, you have the right to lodge a complaint with the supervisory authority, The Office of the Data Protection Ombudsman acts as the competent supervisory authority in Finland: 

Street address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki
Switchboard: +358 29 566 6700
Registry: +358 29 566 6768
Email address (registry): tietosuoja(at)om.fi 

However, we’d appreciate it if you'd first inform us of the issue so that we can do our best to resolve any possible issues!