Privacy Policy

1. What personal data we collect and why

Personal data is mostly collected directly from you, or when you use our services. We may occasionally need additional information to ensure our records are accurate and up to date.

The personal data we collect falls into two categories:

• Identification data — to ensure work hours are attributed correctly: date of birth and name.
• Contact information — to manage personnel and customer relationships: address, business identification number, phone number, and email address.

We may also collect:

• Name, address, and email address from new customers, so we can provide our services.
• Content of messages you send us digitally.

2. Legal grounds for collecting and using your data

We use your personal data to provide our services. The legal grounds for doing so are:

• Making, managing, and fulfilling our contracts with customers.
• Legitimate interest for marketing and business development purposes.
• Consent — for marketing communications such as newsletters. You may withdraw consent at any time.

3. Who we share your data with

Providing services and fulfilling contracts may require us to share your personal data with other parties. We always ensure appropriate confidentiality obligations are in place before doing so.

Business partners and service providers

• We share information necessary to fulfil contracts with our partner companies (e.g. the customer company or your employer).
• We may share your data with contracted processors who act on our behalf (e.g. suppliers of software development, hosting, or IT support).

Transfers outside the EU/EEA

As a rule, we do not transfer your personal data outside the EU/EEA. Where transfer is necessary, we only do so if one of the following applies:

• The EU Commission has determined that the destination country provides an adequate level of data protection.
• Appropriate safeguards are in place, such as EU Commission-approved standard contractual clauses.
• A specific exception applies (e.g. the transfer is required to fulfil a contract, or you have given explicit consent).

4. How we protect your data

We use appropriate technical, organisational, and administrative security measures to protect your data against loss, unauthorised access, disclosure, alteration, and destruction.

• Electronically stored data is protected by industry-standard security measures (e.g. firewalls and password controls).
• Access to personal data is restricted to those who need it to perform their duties, based on individually granted access rights.
• Any physical (paper) records are kept in locked storage.
• All personnel are bound by a contractual duty of confidentiality.

5. Your rights

As a data subject, you have the following rights. Requests will be assessed on a case-by-case basis, and some rights may be limited by applicable law.

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request correction of inaccurate or incomplete data.
• Right to erasure — you may request deletion of your data, for example when it is no longer needed for its original purpose, you withdraw consent, you object to processing, or the processing is unlawful. Note that we may be required to retain certain data to comply with legal obligations or defend legal claims.
• Right to restriction — you may request that we limit processing of your data to storage only, pending resolution of a dispute about its accuracy or lawfulness.
• Right to object — you may always object to processing for direct marketing purposes.
• Right to data portability — where processing is based on consent or contract and carried out by automated means, you may request your data in a machine-readable format.
• Right to lodge a complaint — you may file a complaint with the Finnish Data Protection Ombudsman if you believe your data has been processed unlawfully.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

6. Cookies

We collect and analyse information about how our website is used, including through cookies, to deliver our services, maintain a secure environment, and carry out marketing activities.

7. How long we keep your data

• We retain your data for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
• Contract-related data is kept for the duration of the contract and as required by applicable retention rules.
• Data held for other purposes is retained only as long as necessary, or as prescribed by law.

8. Changes to this policy

We may update this privacy policy from time to time. Where required by law, we will notify you of significant changes.

9. Contact

If you have any questions about how we handle personal data, please contact us: