Privacy Policy

General

Our work requires that we collect, control, and process some personal data about you. We want to respect your privacy, and we are committed to protecting your privacy. This privacy policy includes information about:

  1. what personal data we collect;
  2. how we use the data;
  3. how we collect the data;
  4. what is the legal basis for processing the data;
  5. who controls and processes the data;
  6. how do we protect the data;
  7. data transfers outside the EU; and
  8. what rights you have regarding your data.

Koskinen Family Business Oy (“Koskinen & Co”) collects, controls, and processes your data according to this privacy policy and applicable legislation. Headings and bullets are included only to increase readability of the Privacy Policy, and shall have no relevance for the interpretation of the relevant clause.

How do we use the personal data we collect?

We may collect your data:

  1. to create or maintain customer relationships;
  2. to offer services, products or other legitimate interests to you;
  3. to provide services, products or other legitimate interests to you;
  4. to develop services, products or other legitimate interests;
  5. to fulfil requirements of a contract to which you are a party,
  6. to take steps to create such a contract;
  7. to fulfil requirements of any legal obligations that we are a subject for; or
  8. to pursue any other legitimate interests that do not override your interests or fundamental rights and freedoms that require protection of your data.

What personal data do we collect?

We may collect:

  1. your contact details (such as name, email and phone number);
  2. your company details (such as company name and job title);
  3. your communication details (such as chat transcripts, email correspondence, text messaging and meeting memos);
  4. your usage details (such as how you use our website and our other services and products);
  5. your relationship details (such as details you have shared with us while using our services and products, and details you have given us access to fulfil requirements of a contract); or
  6. your any other legitimate personal data.

How do we collect personal data?

We may collect personal data about you:

  1. from publicly available sources (such as web or social media);
  2. from yourself as you communicate with us or use our products and services;
  3. from the sources you have given us access to fulfil requirements of a contract;
  4. from shared partners, service providers and other third parties; or
  5. from your representative.

What is the legal basis for collecting personal data?

There is always a legal basis for collecting and processing your data. The legal basis for processing your data may be:

  1. a freely given consent from you;
  2. performance of a contract; or
  3. fulfilment of our a third party's legitimate interest. These interests may be, for example, offering our services or products. However, these interests cannot override your interests or fundamental rights and freedoms that require the protection of your data.

Who can access, control and process personal data?

The data is accessible, controlled and processed by the board of Koskinen & Co.

Some parts of the data processing have been outsourced to third parties. We do our best to ensure that the chosen data processors have appropriate security measures to protect your privacy and to comply with any applicable legislation.

It is possible that we or our service providers may transfer your data outside the EU/EEA-area. This may happen if for instance we or our service providers duplicate some data outside the EU / EEA area in the United States. Data is duplicated to keep your data safe even in situations where major servers fail.

Such a transfer is always conducted safely and according to applicable laws. We do our best to ensure that all necessary measures are taken to make sure that your data is not transferred to an entity outside the EU/EEA-area that does not fulfill the criteria regarding the processing of personal data set forth in applicable laws.

In addition, we adhere to the EU’s, US’ and Switzerland’s and United State’s Privacy Shield Framework principles. We do not use these principles as the legal justification for the transfer of personal data, taking into account the EU's Court of Justice’s decision in the case C-311/18. You can find more information from the US department of commerce's Privacy Shield website.

The European Commission has approved the use of model contract clauses as a means of ensuring adequate protection when transferring data outside of the EEA. By incorporating model contract clauses into a contract established between the parties transferring data, personal data is considered protected when transferred outside the EEA or the UK to countries which are not covered by an adequacy decision. We rely on these model contract clauses for data transfers.

Your data may be processed by any number of the following third parties:

  1. Hubspot;
  2. Squarespace;
  3. Google;
  4. Apple;
  5. Dropbox;
  6. Notion;
  7. RealtimeBoard;
  8. LinkedIn;
  9. Readdle;
  10. Webflow;
  11. Typeform;
  12. any other sub-processor we have informed you about; or
  13. any other software or platform we use to communicate between each other.

Your data is not transferred elsewhere unless the performance of a contract that you are a party, other legal obligations that we are a subject, or a public authority demands otherwise.

How is your personal data protected?

Your data is protected with appropriate security measures. The computers that are used to access your data have been encrypted. The access to the data processing services has been protected with two-factor authentication measures, where applicable, and with very secure passwords. Also, a VPN connection is used wherever possible to connect to these services.

Is personal data transferred internationally?

Your data may be transferred outside of the EU or ETA by the third parties described above. It is likely that some parts of their data processing processes do transfer the data internationally. However, we have done our best to ensure that these third parties have their data servers within EU or ETA, or have appropriate security measures to transfer your data internationally.

Does the website use cookies and what are they?

We use cookies to improve your experience and make sure that you’ll see more relevant content on this website and elsewhere on the internet. Cookies are small data files that are stored to your device. Cookies enable us to receive anonymous information about how our website is used. You may opt out using irrelevant cookies when accessing our website for the first time.

What are your rights to access and control your data?

  1. You have a right of access — You have a right to know whether we collect, control, and process your data or to know what personal data we collect, control, and process about you.
  2. You have a right to rectification — You have a right, without undue delay, to rectify inaccurate, expired, or incomplete data about you.
  3. You have a right to restrict processing — You have a right to restrict what personal data we process about you, how long we are consent to process it, and in what ways we are consent to process it.
  4. You have a right to data portability — You have a right to receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.
  5. You have a right of erasure — You have a right, without undue delay, to ask for erasure of your personal data unless the processing is necessary for any legal obligations that we are a subject for, or for the performance of a contract to which you are a party.
  6. You have a right to object — You have a right to object to the processing of your data unless we have a compelling legitimate ground for processing data which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
  7. You have a right to appeal — You have a right to appeal to the Office of the Data Protection Ombudsman.

You may exercise any of these rights by contacting us.

Who may and how one may update this privacy policy?

We may have to update the privacy policy if our work or the legislation changes. The changes come into effect when the updated privacy policy is published.

If the changes result in the expiration of the legal basis for collecting, controlling and processing your data, we make sure that the legal basis for collecting, controlling and processing your data is restored. Otherwise, your data will be deleted according to all applicable privacy laws and regulations.

How may you contact us about your privacy?

You may contact us for any enquiries about Privacy Policy and Cookie Declaration.

‍

Updated 12th of September, 2021