Privacy Policy

1. Data Controller

Company: Brancoy Oy
Business ID: 3201552-2
Address: Kaivokatu 12, 00100 Helsinki, Finland

2. Contact Person for Data Protection Matters

Data Protection Contact: Samuli Ala-Kasari
Telephone: +358 40 9610 067
Email: samuli@brancoy.fi

3. Scope of This Privacy Notice

This Privacy Notice describes how Brancoy Oy processes personal data in the course of its business operations. It applies to the following categories of data subjects:

• representatives and contact persons of Brancoy’s current or former corporate or institutional customers, as well as persons contacting Brancoy on behalf of such customers;

• natural persons who have ordered or order products or services from Brancoy;

• prospective customers and representatives of prospective corporate or institutional customers;

• representatives and contact persons of Brancoy’s partners and collaborators.

All the above persons are hereinafter referred to as the “Data Subject”. This Privacy Notice is supplemented by Brancoy’s Cookie Policy, which provides further information on the use of cookies and similar technologies.

4. Purposes and Legal Bases for Processing Personal Data

Brancoy processes personal data on the following legal bases:

• Consent, where required by applicable law (e.g. electronic direct marketing or the use of certain cookies);

• Legitimate interests pursued by Brancoy, particularly in connection with customer relationship management, marketing, and the development of its business and services;

• Compliance with a legal obligation, such as accounting, record-keeping, and information security obligations.

Where processing is based on legitimate interest, Brancoy has carried out a balancing test and determined that such processing does not override the Data Subject’s fundamental rights and freedoms. Brancoy does not process special categories of personal data.

Personal data may be processed for the following purposes:

• providing, producing, delivering, and developing Brancoy’s products and services;

• managing customer relationships, communications, invoicing, and reporting;

• handling maintenance, warranty, and repair requests;

• marketing and communications;

• complying with statutory obligations;

• analysing and developing Brancoy’s websites and business operations;

• ensuring security in connection with physical premises and in-person meetings.

5. Categories of Personal Data

The following categories of personal data may be processed:

• basic identification and contact details (such as name, email address, telephone number, address, and role within an organisation);

• customer, contract, and order-related information;

• communications and customer service records;

• event registration details;

• technical and usage data collected through websites and online services (such as IP address, browser type, cookies, visited pages, referrer URL, and timestamps);

• technical metadata related to data processing (such as data source and date of storage).

For the avoidance of doubt, not all of the above data necessarily constitute personal data, as some information may relate solely to organisations.

6. Retention of Personal Data

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and in accordance with applicable legislation. Retention periods are determined based on, among other things, the duration of the customer or contractual relationship, statutory retention requirements, and the need to establish, exercise, or defend legal claims.

Where a Data Subject objects to the processing of personal data for direct marketing purposes, Brancoy will retain a record of such objection. Records relating to the exercise of Data Subject rights may also be retained for the duration of applicable limitation periods.

7. Sources of Personal Data

Personal data may be collected from:

• the Data Subject;

• the organisation represented by the Data Subject;

• Brancoy’s websites and online services;

• publicly available sources (such as company websites or LinkedIn profiles);

• third-party service providers, such as marketing or data service providers;

• public authorities and registers.

8. Disclosure of Data and Transfers Outside the EU/EEA

Brancoy may use service providers that process personal data on its behalf and that may be located outside the European Union or the European Economic Area. In such cases, Brancoy ensures that appropriate safeguards are in place, including the use of the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms.

9. Data Security

Brancoy implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. Access to personal data is restricted to employees and authorised representatives who require such access for the performance of their duties and who are subject to confidentiality obligations.

10. Right to Object and Direct Marketing

The Data Subject has the right to object at any time to the processing of personal data for direct marketing purposes. The Data Subject also has the right, on grounds relating to their particular situation, to object to processing based on Brancoy’s legitimate interests, unless Brancoy demonstrates compelling legitimate grounds that override the interests, rights, and freedoms of the Data Subject or the processing is necessary for the establishment, exercise, or defence of legal claims.

11. Other Rights of the Data Subject

Under the General Data Protection Regulation, the Data Subject has the right to:

• access their personal data;

• request rectification or erasure of personal data;

• request restriction of processing;

• lodge a complaint with a supervisory authority.

In Finland, the competent supervisory authority is:

Office of the Data Protection Ombudsman
P.O. Box 800, FI-00521 Helsinki, Finland
Visiting address: Ratapihantie 9, FI-00520 Helsinki, Finland
Telephone: +358 29 566 6700
Email: tietosuoja@om.fi
Website: www.tietosuoja.fi

12. Contact

All requests and inquiries relating to this Privacy Notice and the exercise of Data Subject rights should be addressed to the contact person listed in Section 2.

Brancoy Oy does not carry out automated decision-making or profiling.