{"id":1831,"date":"2021-11-25T09:56:33","date_gmt":"2021-11-25T07:56:33","guid":{"rendered":"https:\/\/luotocompany.fi\/?page_id=1831"},"modified":"2026-09-01T10:04:04","modified_gmt":"2026-09-01T07:04:04","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/luotocompany.fi\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"\n<h4 class=\"wp-block-heading\">Information on the processing of personal data at Luoto &amp; Company Oy<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Updated: 1st of September, 2026<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our company stores and processes personal data as required by the EU\u2019s General Data Protection Regulation (GDPR).<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">1. Data Controller<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Luoto &amp; Company Oy<br>Business ID 2754976-5<br>Runeberginkatu 5, 00100 Helsinki<br><a href=\"http:\/\/luotocompany.fi\/en\/\">www.luotocompany.fi<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Contact person for data protection matters:<br>Lauri Nousiainen<br><a href=\"mailto:lauri.nousiainen@luotocompany.fi\">lauri.nousiainen@luotocompany.fi<\/a><br>+358 40 718 4066<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">2. Whose Personal Data Do We Process?<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We process personal data relating to customers and prospective customers\u2019 contact persons, cooperation partners, users of our website, and other individuals connected with our business activities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Employees and job applicants are informed separately about the processing of their personal data where appropriate.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">3. What Personal Data Do We Process?<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We may process, for example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>name, employer, job title and contact details;<\/li>\n\n\n\n<li>information related to customer and cooperation relationships;<\/li>\n\n\n\n<li>contact, meeting, quotation and contract information;<\/li>\n\n\n\n<li>marketing consents and objections;<\/li>\n\n\n\n<li>professional information relating to prospective business customers;<\/li>\n\n\n\n<li>technical and analytics data relating to the use of our website; and<\/li>\n\n\n\n<li>cookie and consent preferences.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We process only personal data that is necessary for the relevant purpose.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">4. Purposes and Legal Bases for Processing<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Customer and Cooperation Relationships<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We process personal data for managing customer relationships, providing services, contracts, invoicing, communications and customer service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Legal basis: performance of a contract or Luoto &amp; Company\u2019s legitimate interest in managing customer and cooperation relationships.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>B2B Sales and Marketing<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We may process contact details of company decision-makers and other professionally relevant individuals for sales, customer acquisition, marketing of our services and business development.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Legal basis: Luoto &amp; Company\u2019s legitimate interest in conducting and developing its business.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When relying on legitimate interests, we assess the necessity of the processing, the individual\u2019s role and reasonable expectations, and the potential impact of the processing on the individual.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Direct marketing may be objected to at any time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Electronic Direct Marketing<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where consent is required by law, electronic direct marketing is based on consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consent may be withdrawn at any time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Website and Cookies<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Necessary technologies are used for the operation and security of the website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Non-essential analytics, personalisation and marketing cookies are used only with the user\u2019s consent where required by law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cookie preferences may be changed at any time through the website\u2019s cookie settings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Legal Obligations<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Personal data may also be processed for accounting, regulatory obligations, information security and the establishment, exercise or defence of legal claims.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Legal basis: compliance with a legal obligation or legitimate interest.<\/em><\/p>\n\n\n\n<h6 class=\"wp-block-heading\">5. Sources of Personal Data<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Personal data is primarily obtained directly from the individual and in connection with customer and cooperation relationships.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For B2B sales purposes, data may also be collected from lawful public sources, such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>company websites;<\/li>\n\n\n\n<li>public business and contact information services;<\/li>\n\n\n\n<li>professional social media services;<\/li>\n\n\n\n<li>news and other public sources; and<\/li>\n\n\n\n<li>Other commercial B2B data sources used<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If personal data has not been obtained directly from the individual, we provide the information required under Article 14 of the GDPR, in principle no later than at the time of the first communication and in any event within one month of obtaining the data, unless a lawful exception applies.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">6. Recipients and Service Providers<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We do not sell personal data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We may use service providers in the processing of personal data, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CRM and cloud service providers;<\/li>\n\n\n\n<li>email and communications services;<\/li>\n\n\n\n<li>website and hosting providers;<\/li>\n\n\n\n<li>analytics and marketing services;<\/li>\n\n\n\n<li>accounting and IT service providers; and<\/li>\n\n\n\n<li>other business support service providers.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Service providers process personal data on behalf of Luoto &amp; Company in accordance with applicable agreements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Personal data may also be disclosed to public authorities where required by law and, where justified, in connection with corporate transactions or restructurings.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">7. Transfers of Personal Data Outside the EU and EEA<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Some service providers or their subcontractors may process personal data outside the European Union or the European Economic Area.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In such cases, we use an appropriate transfer mechanism under the GDPR, such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>an adequacy decision by the European Commission;<\/li>\n\n\n\n<li>the EU\u2013US Data Privacy Framework where the recipient participates in the framework;<\/li>\n\n\n\n<li>the European Commission\u2019s Standard Contractual Clauses (SCCs); or<\/li>\n\n\n\n<li>another transfer mechanism permitted under the GDPR.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Where necessary, we also use supplementary technical, organisational or contractual safeguards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Further information about the applicable transfer mechanisms may be requested from our contact person for data protection matters.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">8. Retention Periods<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We retain personal data only for as long as necessary for the relevant purpose or as required by law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The main retention periods are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>customer and cooperation relationship data: for the duration of the relationship and for a maximum of 2 years after it ends;<\/li>\n\n\n\n<li>prospective customer data: for a maximum of 2 years after the last meaningful contact or verification of the data;<\/li>\n\n\n\n<li>contact requests: for a maximum of 2 years after the matter has been concluded;<\/li>\n\n\n\n<li>marketing consents: for as long as the consent remains valid;<\/li>\n\n\n\n<li>marketing objections: for as long as necessary to comply with the objection;<\/li>\n\n\n\n<li>accounting and contractual records: for the period required by applicable law; and<\/li>\n\n\n\n<li>cookie and analytics data: in accordance with the retention periods stated in the website\u2019s cookie settings.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">When there is no longer a lawful basis for retaining personal data, the data is deleted or anonymised.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">9. Protection of Personal Data<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We protect personal data using appropriate technical and organisational measures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Access to personal data is restricted to individuals whose duties require such access. Depending on the circumstances, we use measures such as access controls, personal user accounts, strong authentication, protection of data communications, backups and information security monitoring.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">10. Rights of the Data Subject<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Subject to applicable data protection legislation, you have the right to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>access your personal data;<\/li>\n\n\n\n<li>request correction of inaccurate personal data;<\/li>\n\n\n\n<li>request deletion of your personal data;<\/li>\n\n\n\n<li>request restriction of processing;<\/li>\n\n\n\n<li>object to processing based on legitimate interests;<\/li>\n\n\n\n<li>object to direct marketing at any time;<\/li>\n\n\n\n<li>in certain circumstances, receive your data in a portable format and have it transferred to another controller;<\/li>\n\n\n\n<li>withdraw your consent at any time; and<\/li>\n\n\n\n<li>lodge a complaint with the competent supervisory authority.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In Finland, the supervisory authority is the <strong>Office of the Data Protection Ombudsman<\/strong> (<a href=\"http:\/\/www.tietosuoja.fi\">www.tietosuoja.fi<\/a>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Requests relating to data protection rights may be sent to <a href=\"mailto:lauri.nousiainen@luotocompany.fi\"><strong>lauri.nousiainen@luotocompany.fi<\/strong><\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We respond to requests without undue delay and, as a rule, within one month. Where necessary, we may request additional information to verify your identity.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">11. Automated Decision-Making<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Luoto &amp; Company does not make decisions based solely on automated processing of personal data that produce legal effects concerning an individual or similarly significantly affect them.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">12. Cookies<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Up-to-date information about the cookies used on our website, their purposes, service providers and retention periods is available through the website\u2019s cookie settings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Non-essential cookies are used only with the user\u2019s consent where required by law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consent may be withdrawn and cookie preferences changed at any time.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">13. Changes to This Privacy Notice<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We may update this Privacy Notice if our operations, systems or applicable legislation change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The current version will be published on our website. Where necessary, we will separately inform data subjects of material changes concerning the processing of their personal data.rs at Luoto &amp; Company Oy (email above).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Information on the processing of personal data at Luoto &amp; Company Oy Updated: 1st of September, 2026 Our company stores and processes personal data as required by the EU\u2019s General Data Protection Regulation (GDPR). 1.&hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-1831","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/pages\/1831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/comments?post=1831"}],"version-history":[{"count":5,"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/pages\/1831\/revisions"}],"predecessor-version":[{"id":2971,"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/pages\/1831\/revisions\/2971"}],"wp:attachment":[{"href":"https:\/\/luotocompany.fi\/en\/wp-json\/wp\/v2\/media?parent=1831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}