Information on the processing of personal data at Luoto & Company Oy

Updated: 1st of September, 2026

Our company stores and processes personal data as required by the EU’s General Data Protection Regulation (GDPR).

1. Data Controller

Luoto & Company Oy
Business ID 2754976-5
Runeberginkatu 5, 00100 Helsinki
www.luotocompany.fi

Contact person for data protection matters:
Lauri Nousiainen
lauri.nousiainen@luotocompany.fi
+358 40 718 4066

2. Whose Personal Data Do We Process?

We process personal data relating to customers and prospective customers’ contact persons, cooperation partners, users of our website, and other individuals connected with our business activities.

Employees and job applicants are informed separately about the processing of their personal data where appropriate.

3. What Personal Data Do We Process?

We may process, for example:

• name, employer, job title and contact details;
• information related to customer and cooperation relationships;
• contact, meeting, quotation and contract information;
• marketing consents and objections;
• professional information relating to prospective business customers;
• technical and analytics data relating to the use of our website; and
• cookie and consent preferences.

We process only personal data that is necessary for the relevant purpose.

4. Purposes and Legal Bases for Processing

Customer and Cooperation Relationships

We process personal data for managing customer relationships, providing services, contracts, invoicing, communications and customer service.

Legal basis: performance of a contract or Luoto & Company’s legitimate interest in managing customer and cooperation relationships.

B2B Sales and Marketing

We may process contact details of company decision-makers and other professionally relevant individuals for sales, customer acquisition, marketing of our services and business development.

Legal basis: Luoto & Company’s legitimate interest in conducting and developing its business.

When relying on legitimate interests, we assess the necessity of the processing, the individual’s role and reasonable expectations, and the potential impact of the processing on the individual.

Direct marketing may be objected to at any time.

Electronic Direct Marketing

Where consent is required by law, electronic direct marketing is based on consent.

Consent may be withdrawn at any time.

Website and Cookies

Necessary technologies are used for the operation and security of the website.

Non-essential analytics, personalisation and marketing cookies are used only with the user’s consent where required by law.

Cookie preferences may be changed at any time through the website’s cookie settings.

Legal Obligations

Personal data may also be processed for accounting, regulatory obligations, information security and the establishment, exercise or defence of legal claims.

Legal basis: compliance with a legal obligation or legitimate interest.

5. Sources of Personal Data

Personal data is primarily obtained directly from the individual and in connection with customer and cooperation relationships.

For B2B sales purposes, data may also be collected from lawful public sources, such as:

• company websites;
• public business and contact information services;
• professional social media services;
• news and other public sources; and
• Other commercial B2B data sources used

If personal data has not been obtained directly from the individual, we provide the information required under Article 14 of the GDPR, in principle no later than at the time of the first communication and in any event within one month of obtaining the data, unless a lawful exception applies.

6. Recipients and Service Providers

We do not sell personal data.

We may use service providers in the processing of personal data, including:

• CRM and cloud service providers;
• email and communications services;
• website and hosting providers;
• analytics and marketing services;
• accounting and IT service providers; and
• other business support service providers.

Service providers process personal data on behalf of Luoto & Company in accordance with applicable agreements.

Personal data may also be disclosed to public authorities where required by law and, where justified, in connection with corporate transactions or restructurings.

7. Transfers of Personal Data Outside the EU and EEA

Some service providers or their subcontractors may process personal data outside the European Union or the European Economic Area.

In such cases, we use an appropriate transfer mechanism under the GDPR, such as:

• an adequacy decision by the European Commission;
• the EU–US Data Privacy Framework where the recipient participates in the framework;
• the European Commission’s Standard Contractual Clauses (SCCs); or
• another transfer mechanism permitted under the GDPR.

Where necessary, we also use supplementary technical, organisational or contractual safeguards.

Further information about the applicable transfer mechanisms may be requested from our contact person for data protection matters.

8. Retention Periods

We retain personal data only for as long as necessary for the relevant purpose or as required by law.

The main retention periods are:

• customer and cooperation relationship data: for the duration of the relationship and for a maximum of 2 years after it ends;
• prospective customer data: for a maximum of 2 years after the last meaningful contact or verification of the data;
• contact requests: for a maximum of 2 years after the matter has been concluded;
• marketing consents: for as long as the consent remains valid;
• marketing objections: for as long as necessary to comply with the objection;
• accounting and contractual records: for the period required by applicable law; and
• cookie and analytics data: in accordance with the retention periods stated in the website’s cookie settings.

When there is no longer a lawful basis for retaining personal data, the data is deleted or anonymised.

9. Protection of Personal Data

We protect personal data using appropriate technical and organisational measures.

Access to personal data is restricted to individuals whose duties require such access. Depending on the circumstances, we use measures such as access controls, personal user accounts, strong authentication, protection of data communications, backups and information security monitoring.

10. Rights of the Data Subject

Subject to applicable data protection legislation, you have the right to:

• access your personal data;
• request correction of inaccurate personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• in certain circumstances, receive your data in a portable format and have it transferred to another controller;
• withdraw your consent at any time; and
• lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).

Requests relating to data protection rights may be sent to lauri.nousiainen@luotocompany.fi.

We respond to requests without undue delay and, as a rule, within one month. Where necessary, we may request additional information to verify your identity.

11. Automated Decision-Making

Luoto & Company does not make decisions based solely on automated processing of personal data that produce legal effects concerning an individual or similarly significantly affect them.

12. Cookies

Up-to-date information about the cookies used on our website, their purposes, service providers and retention periods is available through the website’s cookie settings.

Non-essential cookies are used only with the user’s consent where required by law.

Consent may be withdrawn and cookie preferences changed at any time.

13. Changes to This Privacy Notice

We may update this Privacy Notice if our operations, systems or applicable legislation change.

The current version will be published on our website. Where necessary, we will separately inform data subjects of material changes concerning the processing of their personal data.rs at Luoto & Company Oy (email above).