Privacy Notice for the Prospect and Customer Register

Name of the register: Prospect and Customer Register

Controller:

Leadventure Oy (Profinder)

Address:
Porkkalankatu 22 A
00180 Helsinki

Data Protection Officer Tero Järvinen: tuki@profinder.fi

Contact details for matters relating to data subject rights

Data subjects may contact Profinder regarding matters relating to their rights via the following page:

https://gdpr.profinder.fi/.

Data subjects

Contact persons of Profinder’s customers and potential customers (hereinafter “prospects”).

Purpose of this notice

This notice applies to the processing of personal data of representatives and employees of Profinder’s prospects and customers when Profinder processes their personal data for the purposes specified in this notice.

Providing personal data to Profinder is voluntary. If Profinder does not have the personal data it requests, it may not be able to cooperate with the customer or prospect as intended.

To ensure compliance with legislation, Profinder and the customer may have entered into a data processing agreement or a data processing addendum regarding the processing of the customer’s personal data by Profinder as a data processor. Where Profinder acts as a processor, the individual should contact their employer or other organisation regarding their personal data.

Purposes of processing personal data and legal bases

Electronic and other marketing communications

Delivery of newsletters and bulletins
Targeting of sales activities (contacts, meetings, etc.)

Where consent is required by law for the above activities, the individual’s consent is the legal basis for the processing of personal data. If consent is not required under applicable legislation, the legal basis for processing is the legitimate interest of Profinder. Profinder has carried out a balancing test concerning its legitimate interest. It is customary for companies and communities to market their services and products to other companies and communities. The interests and fundamental rights and freedoms of individuals are respected, no special categories of personal data are processed, and individuals can reasonably expect such processing. The data relates to the data subject’s duties, position or activities in business or in a role, and is used for sending information related to their work duties and for direct marketing. An individual has the right at any time to object to the processing of their personal data for direct marketing purposes. Where the legal basis for processing is consent and the individual withdraws their consent, the withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Surveys and opinion research

Analysis and statistics
Implementation and development of operations

The legal basis for processing personal data for the above purposes is the legitimate interest of Profinder. Profinder has also carried out a balancing test in this respect. The interests and fundamental rights and freedoms of individuals are respected, no special categories of personal data are processed, and individuals can reasonably expect such processing. If personal data is anonymised prior to these activities, it no longer constitutes personal data.

Information security and fraud prevention

Compliance with a legal obligation is the legal basis for processing personal data for the above purpose.

Management of the customer relationship

Implementation of measures prior to entering into a contract. Exercise of Profinder’s contractual rights.

Personal data processed

The register contains both data relating to companies and other organisations and personal data relating to their contacts. Data relating solely to companies and other organisations does not in itself constitute personal data.

COMPANY DATA (including data of other organisations)

basic information

business ID
industry information

contact details

visiting, postal and possibly billing address
telephone number
email address
social media URLs
language of communication

PERSONAL DATA

contacts of the company or other organisation

name
title

information on the person’s role in the organisation

service language
feedback and responses to surveys and opinion research
data related to the use of Profinder’s website (usage data, data collected through cookies, web navigation data, browser data)

contact details of contacts

address details
telephone number
email address

OTHER DATA

personal data related to product and order information
feedback from prospects, customers and contacts

Data subject rights

Data protection legislation provides for several rights through which a natural person, i.e. a data subject, can influence the processing of their personal data. These rights, such as the right of access, the right to rectification, the right to object to processing and the right to be forgotten, are described in more detail below. The rights available to a data subject depend on the legal basis for processing and other details of the processing.

You may address your requests regarding the exercise of rights to us using the contact details provided above under “Contact details for matters relating to data subject rights”.

RIGHT OF ACCESS

You have the right to obtain confirmation as to whether we process your personal data and the right to access the personal data concerning you that we process, as well as, if you wish, to obtain a copy of such data.

RIGHT TO RECTIFICATION

You have the right to have inaccurate or incorrect personal data concerning you rectified and to have incomplete personal data completed.

RIGHT TO OBJECT

In certain situations, you may have the right to object to the processing of your personal data unless Profinder, as controller, demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms. Profinder may also, despite your objection, process your personal data if it is necessary for the establishment, exercise or defence of legal claims.

You always have the right to object to the processing of your personal data for direct marketing purposes, including profiling insofar as it relates to direct marketing.

RIGHT TO ERASURE

In certain situations, you have the right to have personal data concerning you erased, for example if the legal basis for processing no longer exists. We will process your request, after which we will either delete your personal data or inform you of a justified reason why the personal data cannot be deleted. If you disagree with our decision, you have the right to lodge a complaint with the Data Protection Ombudsman. The website of the Data Protection Ombudsman can be found here. You also have the right to request that we restrict the processing of disputed personal data until the matter is resolved.

RIGHT TO RESTRICTION OF PROCESSING

In certain situations specified in data protection legislation, you may have the right to have Profinder, as controller, restrict the processing of personal data concerning you.

RIGHT TO DATA PORTABILITY

If the processing of your personal data is based on your consent or on a contract concluded with you and the processing is carried out by automated means, you have the right, upon request:

(a) to receive the personal data concerning you that you have provided to Profinder in a structured, commonly used and machine-readable format; and

(b) to transmit such data to another controller, where technically feasible.

RIGHT TO LODGE A COMPLAINT

If you consider that we have processed your personal data in breach of this privacy notice or applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority, in Finland the Data Protection Ombudsman. The website of the Data Protection Ombudsman can be found here.

Regular sources of data

Personal data is regularly obtained:

As part of sales activities and the collection of contact details, as well as from public sources or paid services
Directly from the individual into the system or via email, telephone, forms, or other similar means

Regular disclosures of data

We do not sell or rent personal data contained in the register to third parties. We disclose data to third parties only in the following cases:

We may disclose data to third parties if the individual has given their consent.

We may disclose data for statistical, scientific or historical research purposes, provided that the data has been anonymised.

To processors of personal data, as described below.

Processors of personal data

We may outsource the processing of personal data in part to third parties that process personal data on our behalf in order to provide services to us.

Current processors are:

Hetzner Online GmbH, Germany, which provides hosting services, and ICT support service provider(s) of Profinder located within the EU
PipeDrive OÜ: CRM system

PipeDrive provides Profinder with a customer relationship management tool.

PipeDrive’s current subprocessors and the processing purposes listed by PipeDrive are available at:

https://www.pipedrive.com/subprocessors

PipeDrive’s data processing addendum is available at:

https://www-cms.pipedriveassets.com/documents/Data-Processing-Addendum-Mar_2024.pdf

PipeDrive’s privacy notice is also available at: https://www.pipedrive.com/en/privacy.

Zapier, Inc.: automation tool, including for integrating the PipeDrive CRM system

Zapier’s data processing addendum is available at:

https://www.zapier.com/dpa

Information about Zapier’s subprocessors is available at:

https://zapier.com/legal/subprocessors

Mailchimp: marketing automation and email marketing service

Mailchimp’s data processing addendum is available at:

https://mailchimp.com/legal/data-processing-addendum

Information about Mailchimp’s subprocessors is available at:

https://mailchimp.com/legal/subprocessors

Transfer of personal data outside the EU

The third parties referred to in the previous section items b)–d) may transfer personal data outside the European Economic Area (EEA) and the European Union (EU) (“Third Countries”). Personal data may be transferred to Third Countries for which the European Commission has determined that an adequate level of data protection exists, or by using other safeguards in accordance with the General Data Protection Regulation. Such safeguards include, for example, the Standard Contractual Clauses adopted by the European Commission or binding corporate rules approved by a supervisory authority. In special situations, such as based on the data subject’s consent, transfers may also take place outside these conditions. Further information is available in the previous section, items b)–d).

EU Standard Contractual Clauses

New standard clauses are available here:
Standard contractual clauses for international transfers

Old standard clauses are available here:

Transfer of personal data between two controllers (2001/497/EC) (Link to another website)

Transfer of personal data between two controllers (2004/915/EC) (Link to another website)

Transfer of personal data between controller and processor (2010/87/EU)

Duration of processing

The retention period for personal data depends on the type of personal data and the basis for processing. Profinder has defined appropriate review and retention periods for different categories of personal data. Log data and data relating to data subject requests and the exercise of data subject rights may be retained thereafter for a longer period in accordance with applicable legislation for the purpose of enabling and verifying the exercise of data subject rights.

We carry out checks and delete personal data from the register regularly, including by comparing it with source registers.

Cookies and browsing tracking

We may collect information about the user’s terminal device by means of cookies and other similar technologies, such as the browser’s local storage. A cookie is a small text file that the browser stores on the user’s terminal device. Cookies often contain an anonymous, unique identifier that allows us to recognise and count browsers visiting our site.

Third parties may set cookies on the user’s terminal device when the user visits our site.

The user may refuse the use of non-essential cookies when visiting our site.

Visitors to our site are provided with the necessary information about cookies, such as the cookies in use, their duration, and whether third parties collect data stored via cookies.

Our services and website may also contain links to other sites and services, but we are not responsible for the privacy practices or content of such external sites. We recommend familiarising yourself with the privacy terms of those services.

Automated decision-making and profiling

We do not use personal data for automated decision-making within the meaning of data protection legislation, including related profiling.

Principles of register protection

The secure processing of your personal data is important to us. We use the following safeguards to ensure the security of your personal data:

Access to the system containing personal data requires the entry of a username and password. The system is also protected by firewalls and other technical measures.

Only certain pre-defined employees have access to and are authorised to use the data stored in the system containing personal data.

Use of the register is protected by user-specific credentials, passwords and access rights.

The register is located on a server in a data centre where unauthorised access is prevented.

Data contained in the register is located in locked and monitored premises.

Regular backups of the register are taken.

Changes

We continuously develop our services, and as a result of these changes we may from time to time make amendments to this privacy notice.