Privacy Policy

1Controller

Questions and requests concerning data protection can be sent in writing to the address above, marked “Tietosuoja”.

2Personal data processed and data sources

We process the personal data necessary for the purpose of processing, such as:

• —Name, job role and the company represented.
• —Email address, phone number and other contact details provided.
• —The content of enquiries, requests for quotation and other communication.
• —Data relating to the client relationship, agreements, orders and invoicing.
• —Marketing consents and objections.
• —Technical data generated by use of the website, such as IP address, time of visit and server logs, to the extent our systems record them.

Data is primarily received from the person themselves and from the company they represent in the course of the client relationship or co-operation.

3Purposes and legal bases of processing

Enquiries and requests for quotation: We use the data to answer messages, establish needs and prepare quotations. The processing is based on steps taken prior to entering into a contract when the person is a party to the contract themselves. Processing the data of company contact persons is based on our legitimate interest in managing communication and business between companies.

Client relationships and agreements: We use the data to manage orders, deliveries, customer service and co-operation. The basis is the performance of a contract or our legitimate interest in maintaining client and partner relationships through company contact persons.

Invoicing and statutory obligations: We process the necessary data to meet accounting, taxation and other statutory obligations.

Service development and information security: We process necessary client feedback and technical data to ensure that services work, to investigate errors and to prevent misuse. The basis is our legitimate interest in developing and protecting our operations. We assess the effects of the processing on individuals’ rights and limit the processing to what is necessary.

Marketing: We may process contact details to inform about our services and for direct marketing within the limits permitted by law. The processing is based on consent or on legitimate interest where marketing is permitted by law without prior consent. We ask for consent in situations where it is required. Direct marketing can be objected to at any time.

4Cookies and website tracking

The website may use cookies or similar technologies that are strictly necessary for the operation and security of the service.

If we introduce analytics, ad targeting or other similar technologies that require consent, we will ask for consent before using them. The services in use, their purposes and retention periods will then be described in the cookie settings. Consent can be withdrawn through the same settings.

Merely visiting the website or reading this policy does not constitute consent to marketing or tracking.

5Recipients of data and service providers

Personal data is processed, to the extent their duties require, by the company’s personnel and by the service providers that support our operations. These may include providers of website maintenance, IT, email, customer relationship management and financial administration.

When a service provider processes personal data on our behalf, we agree on the processing appropriately and require that the data is protected and our instructions are followed.

Data may be disclosed to authorities on the basis of a statutory obligation and, to the extent necessary, for establishing, exercising or defending legal claims. In connection with a corporate transaction, necessary data may be transferred to the party continuing the business in accordance with applicable law.

6Transfers outside the EU and EEA

Transfers of personal data outside the EU and the EEA require a transfer basis under data protection legislation and appropriate safeguards. If such transfers are introduced, we will update this policy before the transfers, stating the recipients or categories of recipients, the transfer basis and how to obtain further information about or a copy of the safeguards.

7Retention of data

We retain personal data only for as long as it is needed for the purposes described in this policy:

• —Data on enquiries and requests for quotation is retained for the duration of handling the matter and any necessary follow-up contact.
• —Client and contract data is retained for the duration of the client relationship and thereafter to the extent required by contractual responsibilities, statutory obligations or the handling of legal claims.
• —Accounting material is retained for the periods laid down in legislation.
• —Marketing data is retained for as long as there is a valid basis for the processing. The information necessary to honour an objection may be retained.
• —Technical log data is deleted once it is no longer needed for the operation of the service, information security or investigating detected incidents.

We assess the necessity of the data regularly and delete or anonymise data that is no longer needed.

8Protection of data

We protect personal data with appropriate technical and organisational measures. Access to data is limited to those who need it in their duties. Protection covers, among other things, access rights management, system maintenance and the confidentiality of data.

9Your rights

Subject to the conditions of applicable law, you have the right to:

• —Know whether we process your personal data, and access your own data.
• —Request the correction of inaccurate or incomplete data.
• —Request the erasure of your data or the restriction of processing.
• —Object to processing based on legitimate interest on grounds relating to your particular situation.
• —Object to the use of your personal data for direct marketing at any time.
• —Withdraw a consent you have given. Withdrawal does not affect the lawfulness of processing carried out before it.
• —Receive the data you have provided in a transferable format when the processing is based on consent or a contract and is carried out automatically.

Requests can be submitted to the address given in section 1. Where necessary, we may ask for the information needed to verify your identity. As a rule we respond within one month of receiving the request.

If you consider the processing of your personal data to be contrary to data protection legislation, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland. More information: tietosuoja.fi

10Providing data and automated decision-making

Contacting us through the website is voluntary. Handling a matter or performing a contract may, however, require that the necessary contact and other details are provided. Without them we may not be able to answer a request or deliver a service.

We do not make decisions based solely on automated processing of the data described in this policy that would have legal effects concerning a person or similarly significant effects.

11Updating this policy

We update this policy when the processing of personal data changes. Where necessary, we will communicate material changes separately. Amending the policy does not replace asking for consent when new processing requires it.