Privacy Policy / UKKO.fi Communications and Marketing

1. Data Controllers

The entities responsible for processing the personal data described in this Privacy Policy are:

SPL Company Oy
Business ID 2871479-3
Keilaniementie 1
02150 Espoo
Finland

and

UKKO Yrittäjyyspalvelut Oy
Business ID 2485076-3
Keilaniementie 1
02150 Espoo
Finland

Hereinafter collectively referred to as “UKKO.fi” or the “Controllers.”

SPL Company Oy and UKKO Yrittäjyyspalvelut Oy are joint controllers of the processing of personal data described in this Privacy Policy.

The joint controllers have agreed on their respective responsibilities for processing personal data. The joint controllership is described in more detail in the document “Notice of Joint Controllership within the UKKO.fi Group.”

2. Who Does This Privacy Policy Apply To?

This Privacy Policy applies to individuals whose personal data we process for the purposes of UKKO.fi’s communications or marketing.

Such individuals may include, for example:

• current and former UKKO.fi customers;
• individuals interested in UKKO.fi’s services and potential customers;
• individuals who have subscribed to a newsletter or other marketing communications;
• individuals who have participated in events, training sessions, campaigns, or other marketing activities organized by UKKO.fi;
• individuals who have provided their contact details to UKKO.fi, for example through a website or other contact channel; and
• contact persons at companies and other organizations who may receive communications or marketing related to their professional duties.

Providing contact details to UKKO.fi does not, in itself, constitute consent to electronic direct marketing.

3. What Personal Data Do We Process?

We may process the following personal data to the extent necessary in each case:

Contact and Basic Information

• name;
• email address;
• telephone number;
• company or other organization;
• position or role within the organization; and
• other contact details provided by the individual.

Customer and UKKO.fi Service-Related Information

• information about the customer relationship or the services in use; and
• general information related to the use of the services, to the extent such information is used to target communications or marketing.

Marketing and Communications Information

• direct marketing consents provided;
• direct marketing opt-outs and withdrawals of consent;
• information about messages and campaigns sent;
• the individual’s responses to surveys, feedback requests, or marketing campaigns; and
• information about participation in events, webinars, or other similar activities.

Website and Electronic Communications Usage Information

• IP address;
• technical information about the device and browser;
• information about website usage;
• information collected through cookies and similar technologies based on the user’s consent; and
• information about the opening of marketing messages and clicks on links.

As a general rule, we do not collect or process special categories of personal data for communications or marketing purposes.

4. For What Purposes Is Personal Data Processed?

We process personal data for the following purposes:

Marketing and Direct Marketing

We may use personal data to market UKKO.fi’s products and services and to target marketing communications.

Electronic direct marketing, such as email and text message marketing, is sent to individuals based on their prior consent, except as described below.

We may also market UKKO.fi’s own similar services to our existing customers without separate consent if their electronic contact details were obtained in connection with the sale of a service. In such cases, customers can opt out of marketing when their contact details are collected and through the link included in each message.

We may send marketing related to the professional duties of contact persons at companies and organizations without prior consent. Recipients can opt out of such marketing at any time.

Customer and Service Communications

We may also process contact details for communications relating to an existing customer relationship, a service in use, the use of a service, or the management of the customer relationship.

Such communications do not constitute marketing.

Developing Communications and Marketing

We may analyze the effectiveness and relevance of our marketing communications and the general interests of recipients in order to develop our communications.

For example, we may create customer segments based on customer relationships, industry, interests, or previous interaction so that the communications sent are as relevant as possible to the recipient. If the segmentation qualifies as profiling, the individual has the right to object to it; see Section 11.

In this context, we do not make decisions based solely on automated processing that would produce legal effects or similarly significant effects on the data subject.

Surveys, Research, and Events

We may process personal data to carry out customer satisfaction surveys, market research, events, webinars, and other similar activities.

5. On What Legal Basis Do We Process Personal Data?

We process personal data on the following legal bases under the EU General Data Protection Regulation (“GDPR”):

Consent

Consent is the legal basis for newsletters and other electronic direct marketing to individuals, except for the marketing to existing customers and to contact persons at companies and organizations described in Section 4, as well as for the use of non-essential cookies and similar technologies.

Consent may be withdrawn at any time.

Contract

Customer and service communications are based on the contract concluded with the customer.

Legitimate Interest

We may process personal data on the basis of our legitimate interest for:

• managing and developing existing or potential customer relationships;
• direct marketing of our own similar services to existing customers;
• marketing directed at contact persons at companies and organizations;
• developing, analyzing, and targeting communications and marketing, including profiling; and
• conducting surveys, research, and events.

Our legitimate interest is based on conducting our business, maintaining customer relationships, and marketing and developing our products and services. Before processing based on legitimate interest, we assess the necessity of the processing and its effects on the rights and freedoms of the data subject.

6. Where Do We Obtain Personal Data?

We primarily obtain personal data directly from the data subject, for example:

• when registering for or using UKKO.fi’s services;
• through forms completed on our website;
• when subscribing to a newsletter or other marketing communications;
• when registering for events or campaigns;
• in connection with surveys and feedback; and
• through other communications.

In addition, we obtain information related to customer relationships and the use of services from UKKO.fi’s customer and service systems.

Information concerning companies and their contact persons may also be obtained from public sources, such as company websites, public business registers, or other similar publicly available sources.

We may also obtain information about contact persons at companies from external information service providers.

7. To Whom Is Personal Data Disclosed?

We use service providers for services such as:

• marketing and communications systems;
• customer relationship management systems;
• email and communications services;
• analytics and website services;
• event and survey services; and
• IT and cloud services.

When a service provider processes personal data solely on our behalf and in accordance with our instructions, it acts as a data processor. We enter into data processing agreements with such service providers as required by the GDPR.

Personal data may also be processed by other companies belonging to the UKKO.fi Group when necessary to carry out the activities described in this Privacy Policy.

We do not sell personal data to third parties.

8. Is Personal Data Transferred Outside the EU or the EEA?

Some of the service providers we use, or their subcontractors, may process personal data outside the European Union or the European Economic Area.

If personal data is transferred outside the European Union or the European Economic Area, we ensure that the transfer is based on a transfer mechanism permitted under the GDPR.

Transfers may be based, for example, on:

• • a decision by the European Commission recognizing that the country or recipient provides an adequate level of data protection, such as the EU–U.S. Data Privacy Framework for certified recipients in the United States; or
  • standard contractual clauses approved by the European Commission and, where necessary, supplementary safeguards.

9. How Long Is Personal Data Retained?

We retain personal data only for as long as it is needed for the purposes described in this Privacy Policy or as required by law.

Information concerning newsletter subscribers and other consent-based marketing is retained until consent is withdrawn, but for no longer than 12 months after the last interaction.

Customer information is retained for the duration of the customer relationship or cooperation and for no longer than 5–10 years after it ends.

Information related to events and surveys is retained for no longer than 12 months after the event or survey has ended.

After an individual has objected to direct marketing, we may retain the information strictly necessary to ensure that the individual is not sent direct marketing contrary to their objection in the future.

Information may be retained for a longer period if this is necessary to establish, exercise, or defend legal claims, or if otherwise required by law.

10. How Is Personal Data Protected?

We protect personal data using appropriate technical and organizational measures.

Access to personal data is limited to individuals whose work duties require such access. Individuals who process personal data are subject to a duty of confidentiality.

To protect personal data, we use measures such as access rights management, access controls, technical security measures for systems, and staff instructions and training.

11. Right to Object to Processing and to Direct Marketing

You have the right to object at any time to direct marketing and to the processing of your personal data for direct marketing purposes.

When you object to the processing of your personal data for direct marketing, we will no longer process your personal data for this purpose.

You may also object, on grounds relating to your particular situation, to other processing based on our legitimate interest. In such cases, we will stop the processing unless we can demonstrate compelling legitimate grounds for continuing it or the data is needed for the establishment, exercise, or defense of legal claims.

You can unsubscribe from our newsletter, for example, by using the unsubscribe link included in a marketing message. You can object to direct marketing by contacting us as described in Section 14.

Objecting to direct marketing does not prevent us from sending service or customer communications that are necessary to provide the service you use, perform a contract, or otherwise manage the customer relationship.

If you request the deletion of your personal data, we will nevertheless retain information about your objection to direct marketing so that we can comply with it.

12. What Other Rights Do You Have?

Under the GDPR, you may, depending on the circumstances, have the right to:

• find out whether we process your personal data and what personal data we process;
• request the correction of inaccurate or incomplete personal data;
• request the deletion of your personal data;
• request the restriction of processing;
• object to processing; see Section 11;
• withdraw your consent; and
• lodge a complaint with a supervisory authority; see Section 15.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

You may exercise your rights by contacting us as described in Section 14. Where necessary, we may request additional information to verify your identity.

13. Cookies and Similar Technologies

UKKO.fi websites may use cookies and similar technologies to enable website functionality and, with the user’s consent, for purposes such as analytics, personalization, and marketing.

Further information about the cookies in use, their purposes, retention periods, and consent management is provided in UKKO.fi’s Cookie Policy and in the cookie settings on the website.

With your consent, we also use the Meta Pixel on our websites. Further information about this processing and our joint controllership with Meta Platforms Ireland Limited is provided in the notice “Joint Controllership with Meta” at ukko.fi/tietosuoja.

14. Contact Information

For matters concerning data protection and the exercise of data subject rights, you may contact us through the data protection request form on our website or by email at [email protected].

15. Right to Lodge a Complaint with a Supervisory Authority

If you believe that your personal data has been processed in violation of data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

16. Changes to This Privacy Policy

We may update this Privacy Policy, for example, when our activities, methods of processing personal data, or applicable legislation change.

The current Privacy Policy is available on the UKKO.fi website.

Updated: October 29, 2026