Privacy Policy
This is a translation provided for convenience. The Finnish version is binding.
Updated 14 August 2026
1. Controller
Windis Oy (2470382-7)
Address: Jyväskyläntie 232, 69700 Veteli
Phone: +358 40 456 0290
(hereinafter ”Windis Oy” or ”we”)
2. Contact person for register matters
Name: Mikko Toivonen
Address: Jyväskyläntie 232, 69700 Veteli
Email: mikko.toivonen@windis.fi
3. What personal data do we process, and what are the purpose and legal basis of the processing of personal data?
| Types of personal data | Purpose of processing | Legal basis |
|---|---|---|
| Delivering, arranging and developing our services | Legitimate interest |
| The aforementioned basic information, contact details and information concerning the company and its contact persons | Fulfilling our contractual and other promises and obligations | Performance of a contract |
| The aforementioned basic information, contact details and information concerning the company and its contact persons | Electronic direct marketing (incl. electronic surveys) | Consent (private individuals) or legitimate interest (companies) |
| The aforementioned basic information, contact details and information concerning the company and its contact persons | Managing our customer relationship or a potential customer relationship, incl. organizing events, sending customer satisfaction surveys | Legitimate interest |
| Consents and prohibitions concerning direct marketing | Electronic direct marketing (incl. electronic surveys) | Consent (private individuals) or legitimate interest (companies) |
| Personal data collected in connection with events and trainings such as registration for an event, special dietary requirements, billing information | Organizing events and trainings and sending invitations | Legitimate interest, consent |
| Information relating to a customer relationship or potential customer relationship, partners and contracts such as information on past and current contracts and assignments, offers made, information relating to communication, billing information | Fulfilling our contractual and other promises | Performance of a contract |
| The aforementioned information relating to the customer relationship, partners and contracts | Managing, developing and maintaining the customer relationship; responding to a potential customer's enquiry and providing an offer | Legitimate interest |
4. Where do we receive data from?
We receive data primarily from the following sources: from you yourself, from authorities, from credit information companies, from providers of contact information services and from other similar reliable parties.
In addition, data on users is obtained from information collected in connection with the creation of access rights and entered into the controller's systems, as well as from data collected from users' devices during use.
Furthermore, personal data may also be collected and updated for the purposes described in this privacy policy from publicly available sources and on the basis of information received from authorities or other third parties, within the limits of applicable legislation. Such updating of data is carried out manually or by automated means.
5. To whom does Windis disclose and transfer data, and is data transferred outside the EU or the EEA?
Windis may disclose personal data within the limits permitted and required by applicable legislation, for example to group companies and to legal and financial advisors, which act as independent controllers with regard to the data. Personal data may also be disclosed to authorities that have a statutory right to obtain data from the register.
We use subcontractors in the processing of personal data in the following areas:
- Marketing
- IT services
- Financial administration
- Business processes (incl. the services and trainings we offer)
We have ensured your data protection by concluding the necessary data processing agreements with our subcontractors. We may not name all subcontractors, for example due to projects under development, so we have listed only the types of subcontractors.
As a rule, we do not transfer personal data outside the EU/EEA. However, the marketing and IT service systems we use may allow the service provider to access the data from outside the EU/EEA. In such cases, we ensure that the subcontractor complies with the European Commission's standard contractual clauses concerning the processing of personal data.
6. How does Windis protect the data and how long is it stored?
Only those Windis employees who, due to their work duties, are entitled to process customer data have access to the personal data. Each user has a personal username and password for the system. The data is protected by technical means, and the data and its backup copies are stored in secure premises.
We regularly assess the need to store the data, taking into account applicable legislation. We also make sure that we do not store outdated or inaccurate personal data. We correct or delete such data without delay.
7. What are your rights as a data subject of Windis?
You have the right to access, rectify or erase the data concerning you stored in Windis's register. You may also object to the processing of your data or request that it be restricted, and lodge a complaint about the processing of personal data with a supervisory authority.
You have the right to withdraw or change your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
8. Who can you contact at Windis?
All contacts and requests concerning this policy must be presented in writing or in person to the contact person mentioned in section two (2).