Eilakaisla Oy (“Eilakaisla”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, contact us, use our services, or otherwise interact with us.

This Privacy Policy is intended for visitors, prospective customers, customers, job applicants, and other individuals who interact with us through our website or services.

This Privacy Policy is maintained on a group-level basis by Eilakaisla Oy and applies to the Norwegian website and related interactions of Eilakaisla Group, including Eilakaisla Norge AS where relevant.

1. Controller

Eilakaisla Oy is the parent company of the Eilakaisla Group and acts as the controller for the personal data processing described in this Privacy Policy.

Eilakaisla Oy
Business ID: 0105926-6
Keilasatama 5, FI-02150 Espoo, Finland
Email: privacy@eilakaisla.fi

Eilakaisla Norge AS operates locally in Norway as part of the Eilakaisla Group. Eilakaisla Oy is responsible for group-level privacy governance, including common privacy, information security and access control principles.

Authorised employees and representatives of Eilakaisla Group companies may process personal data only where necessary for the purposes described in this Privacy Policy and in accordance with group-wide instructions.

If you have questions about this Privacy Policy or about how we process your personal data, please contact us using the details above.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

• visits to our website;
• contact requests and other enquiries;
• marketing and business communications;
• customer and prospect relationship management;
• recruitment-related interactions, where relevant; and
• the use of our services and digital tools.

Where a separate privacy notice is provided for a specific service, process, or campaign, that separate notice will apply in addition to or instead of this Privacy Policy.

3. Personal data we may collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

Contact and identification data

• name;
• email address;
• phone number;
• company name;
• job title or role;
• postal address, where relevant.

Communication and enquiry data

• information you provide when contacting us;
• form submission details;
• correspondence, messages, and customer service communications;
• meeting, enquiry, and request history.

Customer and business relationship data

• information related to assignments, services, or cooperation;
• billing and payment information, where relevant;
• preferences related to communication, services, or marketing;
• records needed to manage customer relationships and service delivery.

Recruitment-related data

If you apply for a role or otherwise engage with us in a recruitment context, we may process information such as:

• CV and application materials;
• work history, education, qualifications, and skills;
• assessment-related information;
• other information relevant to a recruitment process.

Technical and website usage data

• IP address and device information;
• browser type and operating system;
• website usage data, such as visited pages and timestamps;
• referral and navigation information;
• cookie and similar technology data, where applicable.

4. How we collect personal data

We may collect personal data:

• directly from you, when you contact us, submit a form, apply for a role, or use our services;
• automatically through website technologies, including cookies and analytics tools, where permitted;
• from publicly available sources;
• from service providers, partners, or other third parties involved in delivering our services or supporting our business; and
• from customer organisations, where relevant to service delivery or recruitment processes.

Where we receive personal data from sources other than you, we provide privacy information as required by applicable data protection law, for example when we first contact you, when the data is first disclosed to another recipient, or otherwise within the applicable time limits.

5. Why we process personal data

We process personal data for the following purposes:

• to respond to enquiries and requests;
• to communicate with prospects, customers, candidates, and other stakeholders;
• to provide, manage, and develop our services;
• to manage customer and business relationships;
• to carry out recruitment and related evaluation processes;
• to send marketing communications where permitted by law;
• to maintain, secure, and improve our website and digital services;
• to understand website usage and improve user experience;
• to comply with legal and regulatory obligations; and
• to establish, exercise, or defend legal claims where necessary.

The applicable legal basis depends on the purpose of processing and your relationship with us, as described in section 6 below.

6. Legal bases for processing

Depending on the situation, we process personal data on one or more of the following legal bases:

• Consent – for example, where you have given consent to certain marketing or cookie-related processing;
• Performance of a contract or steps prior to entering into a contract – for example, where processing is necessary to provide services or respond to a request related to potential cooperation;
• Legal obligation – where processing is necessary for compliance with applicable laws and regulatory requirements;
• Legitimate interests – where processing is necessary for our legitimate business interests, such as managing relationships, improving services, ensuring security, and operating our business, provided these interests do not override your rights and freedoms.

Providing personal data is generally voluntary, but some information may be necessary in order for us to respond to your request, manage a customer or business relationship, process a recruitment-related interaction, provide a service, or comply with legal obligations. If you do not provide the necessary information, we may not be able to respond to your request, continue the relevant process, or provide the requested service.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

7. Cookies and similar technologies

We use cookies and similar technologies on our website to ensure website functionality, remember user preferences, understand website usage, and support analytics and, where applicable, marketing activities.

Non-essential cookies and similar technologies are used only where the applicable consent requirements have been met.

For more information about the cookies and similar technologies we use, and how you can manage your choices, please see our Cookie Policy.

8. Sharing of personal data

We may share personal data with:

• other Eilakaisla Group companies, including Eilakaisla Norge AS, where necessary for the purposes described in this Privacy Policy;
• trusted service providers and processors who support our business operations;
• technology and software providers, including hosting, analytics, communication, and customer management providers;
• recruitment and assessment partners, where relevant;
• professional advisers such as legal, accounting, audit, or insurance partners; and
• authorities or other third parties where disclosure is required by law or necessary to protect rights, safety, or legal interests.

Access within the Eilakaisla Group is limited to authorised persons with a justified business need and is subject to role-based access rights, confidentiality obligations and group-wide privacy and information security instructions.

Where we use processors or service providers, we require them to process personal data only for agreed purposes, in accordance with our documented instructions, and with appropriate confidentiality, security and data protection measures.

9. International transfers

As a rule, we aim to process and store personal data within the European Economic Area (EEA).

Some service providers, tools or group-related support arrangements may involve access to or processing of personal data outside the EEA. If personal data is transferred outside the EEA, we will ensure that appropriate safeguards are in place as required by applicable data protection law, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

The actual transfer arrangements depend on the service providers and tools used on the website and in our operations.

10. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on the type of data and the purpose of processing. For example, we may retain data:

• for the duration of a customer or business relationship;
• for the duration of a recruitment process and any lawful follow-up period;
• for as long as necessary to comply with tax, accounting, employment, or other legal obligations;
• for as long as needed to establish, exercise, or defend legal claims; or
• until valid consent is withdrawn, where processing is based on consent and no other lawful basis applies.

When personal data is no longer needed, we will delete, anonymise, or otherwise securely dispose of it.

11. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction.

These measures may include access controls, user authentication, encryption, secure systems, logging, and other security practices appropriate to the nature of the data and processing.

12. Your rights

Subject to applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests or direct marketing;
• request portability of personal data, where applicable;
• withdraw consent at any time, where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

If you would like to exercise your rights, please contact us at privacy@eilakaisla.fi.

We may ask for additional information to verify your identity before processing your request.

13. Marketing communications

Where permitted by law, we may send you information about our services, insights, events, or other business-related communications.

You can opt out of marketing communications at any time by using the unsubscribe link in the message or by contacting us directly.

14. Third-party websites and services

Our website or communications may contain links to third-party websites or services. We are not responsible for the privacy practices of third-party sites or services, and we encourage you to review their privacy notices separately.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, operations, or legal obligations.

The latest version will always be available on this page. If changes are material, we may take additional steps to inform users where appropriate.

16. Contact us

If you have questions about this Privacy Policy, our processing of personal data, or if you want to exercise your rights, please contact:

Eilakaisla Oy
Keilasatama 5, FI-02150 Espoo, Finland
privacy@eilakaisla.fi