Privacy Policy / UKKO.fi Sales

Data Controllers

The joint controllers responsible for processing the personal data described in this Privacy Policy are:

SPL Company Oy
Business ID 2871479-3
Keilaniementie 1
02150 Espoo
Finland

And

UKKO Yrittäjyyspalvelut Oy
Business ID 2485076-3
Keilaniementie 1
02150 Espoo
Finland

Hereinafter collectively referred to as “UKKO.fi” or the “Data Controllers”.

SPL Company Oy and UKKO Yrittäjyyspalvelut Oy jointly determine the purposes and essential means of the processing of personal data described in this Privacy Policy. The Data Controllers have agreed on the division of responsibilities between them regarding the processing of personal data. Their status as joint controllers is described in more detail in the document “Notice of Joint Controllership within the UKKO.fi Group.”

1. Who Does This Privacy Policy Apply To?

This Privacy Policy applies to individuals whose personal data is processed in connection with UKKO.fi’s business-to-business sales, sales outreach, or partnerships.

Such individuals may include, for example:

entrepreneurs and individuals responsible for companies whom UKKO.fi contacts to offer business services;
contact persons of current customers and partners; and
individuals who have contacted UKKO.fi themselves regarding business sales or a partnership.

“Partners” refers to companies and other organizations that cooperate with UKKO.fi. A partner may, for example, offer services or benefits to UKKO.fi and its customers. A partner may also have entered into a partnership agreement with UKKO.fi that makes it easier to engage companies and entrepreneurs for assignments and to pay their fees.

UKKO.fi’s communications and marketing, such as newsletters, are described in the Privacy Policy for Communications and Marketing. If sales outreach results in a customer relationship, the processing of personal data during the customer relationship is described in the Privacy Policy for Users of UKKO.fi Services.

2. What Personal Data Do We Process?

We may process the following personal data to the extent necessary for business sales or partnerships:

Contact and Basic Information

name;
business telephone number or another telephone number used for contacting the individual;
business email address or another email address related to the individual’s professional duties;
the company represented by the individual or the individual’s Private Trader business;and
the individual’s position, job title, or area of responsibility within the organization.

Information Related to Business Sales and Partnerships

information about the industry, size, or other characteristics relevant to business sales of the company represented by the individual;
information about the possible interest of the individual or the company they represent in UKKO.fi’s products or services;
information about contacts and the dates on which they took place;
information provided and notes made during sales discussions and other contacts;
offers and other information relating to a potential customer or partnership relationship;
information about the source of the personal data; and
direct marketing or sales outreach opt-outs and other information relating to the exercise of the data subject’s rights under the GDPR.

Information Related to Sales Calls and Video Meetings

the date and time of calls and meetings, the telephone number or email address used, and the outcome of the contact;
other information discussed during calls and meetings; and
recordings and any transcripts, notes, and summaries prepared from them, if the call or meeting is recorded.

Recording Calls and Meetings

Our sales representatives’ Microsoft Teams sales meetings may be recorded using an artificial intelligence tool that prepares notes and a summary of the meeting. We will inform you about the recording at the beginning of the meeting, at which point you may object to the recording.

The scheduling service that arranges sales meetings on our behalf records the calls it makes for quality control and staff training purposes. You will be informed about the recording at the beginning of the call. The recordings are stored in the service provider’s system.

Meetings or calls with partners are not recorded.

As a general rule, we do not collect or process special categories of personal data for business sales or partnership purposes.

4. For What Purposes Is Personal Data Processed?

We process personal data for the following purposes:

identifying potential business customers;
selling and offering UKKO.fi’s services;
identifying and contacting potential partners;
planning, establishing, and managing partnerships;
responding to contacts and requests for quotes;
documenting and following up on sales negotiations and contacts;
recording sales calls and meetings, quality assurance, and training sales representatives;
managing, developing, and reporting on the business sales process; and
implementing direct marketing opt-outs and other data subject rights.

We direct sales outreach to individuals whose position, duties, or other professional role reasonably indicates that the service being offered is related to their professional duties or the activities of the company they represent.

5. On What Legal Basis Do We Process Personal Data?

Legitimate Interest

The processing of personal data relating to sales outreach, responding to contacts and requests for quotes, and establishing and managing partnerships is primarily based on the legitimate interests of the Data Controllers. These legitimate interests include conducting business, acquiring new business customers, offering services to companies, and establishing partnerships.

The recording of sales calls and meetings for documentation, quality assurance, and training purposes is also based on legitimate interest, as is recording direct marketing opt-outs so that we can comply with them.

Contract and Pre-Contractual Measures

Processing may also be based on a contract or on steps taken at the request of the data subject prior to entering into a contract. This applies when the data subject is themselves a party to the contract, for example, as a private trader, and requests an offer or another measure aimed at entering into a contract.

6. Where Do We Obtain Personal Data?

Personal data may be obtained from:

the data subject themselves;
the company or other organization represented by the individual;
public company and organization registers;
public websites of companies and other organizations;
other publicly available professional information sources; and
service providers that provide company and contact information.

7. To Whom Is Personal Data Disclosed?

We may use service providers to process personal data. These service providers may provide us with, for example:

telemarketing and appointment-scheduling services;
customer relationship management and sales systems;
other telephone and communications services;
company and contact information services;
IT, cloud, AI and data storage services; and
other services necessary to carry out business sales.

When a service provider processes personal data on behalf of UKKO.fi and in accordance with its instructions, the service provider acts as a data processor. In such cases, we ensure that the contractual arrangements concerning the processing of personal data comply with the requirements of the GDPR.

Personal data may also be processed by other companies belonging to the UKKO.fi Group when they provide services related to the processing described in this Privacy Policy to the Data Controllers.

We do not sell personal data to third parties.

8. Is Personal Data Transferred Outside the EU or the EEA?

Some of the service providers we use, or their subcontractors, may process personal data outside the European Union or the European Economic Area.

If personal data is transferred outside the EU or the EEA, we ensure that the transfer is based on a legal mechanism under the GDPR and that the personal data is appropriately protected. The transfer may be based, for example, on an adequacy decision adopted by the European Commission, such as the EU–U.S. Data Privacy Framework for U.S. recipients certified under that framework. The transfer may also be based on standard contractual clauses approved by the European Commission and, where necessary, supplementary safeguards.

9. How Long Is Personal Data Retained?

We retain personal data only for as long as it is needed for the purposes described in this Privacy Policy.

Data concerning potential business customers is generally deleted or anonymized 24 months after the most recent contact or other sales-related activity, unless there is another basis for retaining the data after that time.

Data concerning the contact persons of partners is retained for the duration of the partnership and thereafter for 24 months to the extent that the data is needed to manage matters related to the end of the partnership or to evaluate a possible new partnership.

After you opt out of direct marketing, we retain only the information necessary to comply with the opt-out, such as your name and telephone number, for as long as the opt-out remains valid.

Please note that if your contact information is available from public company or contact information sources, we may collect your information again later for B2B sales purposes, even if we previously deleted the relevant information from our systems. If you have opted out of sales outreach, we will not contact you even if your information becomes available again.

In exceptional circumstances, data may be retained for longer than described above if necessary to establish, exercise or defend legal claims or to comply with a statutory obligation.

10. How Is Personal Data Protected?

We protect personal data using appropriate technical and organizational measures.

Access to personal data is limited to individuals who need it to perform their work duties. We use, for example, access rights management, access controls, technical security measures for systems, and staff instructions and training to protect personal data.

Personnel who process personal data are subject to confidentiality obligations and obligations to process personal data appropriately.

11. Right to Object to Processing and Opt Out of Sales Outreach

You have the right to opt out of sales outreach and to object to the processing of your personal data for direct marketing at any time.

When you object to processing for direct marketing purposes, we will no longer process your personal data for that purpose.

You may also object, on grounds relating to your particular situation, to other processing based on our legitimate interest. In such cases, we will stop the processing unless we can demonstrate compelling legitimate grounds for continuing the processing or the data is needed for the establishment, exercise, or defense of a legal claim.

You may communicate your opt-out during a sales call or meeting, by replying to a sales message, or through the contact details specified in Section 13.

If you request the deletion of your data, we will nevertheless retain information about your sales outreach opt-out so that we can comply with it.

12. What Other Rights Do You Have?

Depending on the circumstances, you may have the right to:

find out whether we process your personal data and what personal data we process;
request the correction of inaccurate or incomplete personal data;
request the deletion of your personal data;
request the restriction of processing;
object to processing; see Section 11; and
lodge a complaint with a supervisory authority; see Section 14.

You may exercise your rights through the contact details specified in Section 13. Where necessary, we may request additional information to verify your identity.

13. Contact Information

For matters relating to data protection and the exercise of data subject rights, you may contact us through the data request form on our website or by email at:

[email protected]

14. Right to Lodge a Complaint with a Supervisory Authority

If you believe that your personal data has been processed in violation of data protection legislation, you have the right to lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

15. Changes to This Privacy Policy

We may update this Privacy Policy, for example, when our operations, personal data processing practices, or applicable legislation change.

The current version of this Privacy Policy is available on the UKKO.fi website.

Updated: October 27, 2026