Notice of Joint Controllership within the UKKO.fi Group

The companies within the UKKO.fi Group process certain personal data as joint controllers because they use shared systems and provide services to one another. This notice describes the main aspects of the arrangement between the companies.

Who are the joint controllers?

The following companies are joint controllers within the meaning of Article 26 of the General Data Protection Regulation (EU) 2016/679:

SPL Company Oy

Business ID: 2871479-3

UKKO Yrittäjyyspalvelut Oy

Business ID: 2485076-3

SLP Wallet Oy

Business ID: 3184032-8

The companies share the following address: Keilaniementie 1, 02150 Espoo, Finland.

Below, the companies are collectively referred to as the “UKKO.fi Group”, and each company individually as a “Company.”

What processing does the joint controllership cover?

All three Companies jointly determine the purposes and means of the following processing activities:

• customer relationship management and customer service in a shared customer register;
• recruitment and the Group’s shared human resources functions;
• maintenance of shared information systems, information security and the prevention of misuse;
• the Group’s financial and management reporting; and
• the development of services.

SPL Company Oy and UKKO Yrittäjyyspalvelut Oy jointly determine the purposes and means of the following processing activities:

• communications and marketin, as well as the targeting and measurement of advertising; and
• business-to-business sales and partnerships.

This notice does not apply to data that a Company processes on behalf of its customer in the capacity of a data processor. It also does not apply to processing for which a Company is solely responsible due to its own statutory obligations, such as customer due diligence or accounting.

The intra-group transfer of data for administrative purposes is based on legitimate interest. Information about the data processed, the purposes of processing, the legal bases and the retention periods is provided in the Privacy policies applicable to each processing activity at ukko.fi/tietosuoja.

How are responsibilities allocated?

SPL Company Oy prepares and publishes the joint Privacy Policies and ensures that data subjects are informed about the processing.

Data subject requests are handled centrally by the Data Protection Coordinator. Each Company implements the necessary measures, such as correcting or deleting data, in its own systems.

SPL Company Oy is responsible for the information security of the shared information systems. Each Company is responsible for the security of its own systems and for the data processing agreements with the service providers it uses. The Companies inform each other of personal data breaches without undue delay. The Company whose processing is affected by the breach notifies the supervisory authority and the data subjects where required. If the breach concerns the shared information systems, SPL Company makes the notifications on behalf of all the Companies.

Regardless of the allocation of responsibilities, you may exercise your rights under the GDPR in respect of and against each Company (Article 26(3) of the GDPR). Further information about your rights is provided in the Privacy Policies.

Who can I contact?

The UKKO.fi Group’s Data Protection Coordinator acts as the contact point for data subjects. You can contact us through the data request form on our website or by email at:

[email protected]

If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman.

This notice was last updated on October 29, 2026.