Privacy policy

GENERAL INFORMATION

Privacy and security of personal information is important to Alder & Sound Oy (Business ID: 2293331-1) (“Alder & Sound”, “we” or “us”). Alder & Sound is committed to protecting the personal data it receives and to processing personal data in accordance with the applicable data protection legislation, as described in detail below.

The following Alder & Sound privacy policy (the “Privacy Policy“) applies to and describes the processing of personal data collected by Alder & Sound through and in connection with:

• the Alder & Sound website (www.aldersound.fi) and other online services in use from time to time;
• Alder & Sound’s marketing activities and communications, contacts, seminars and other events; and
• professional services provided by Alder & Sound.

(All such services hereinafter referred to together as the “Services”).

By visiting the Alder & Sound website and other online services, attending our marketing activities, seminars or other events, using our Services and/or submitting any personal data Alder & Sound, you are expressly consenting to the processing of personal data concerning you in accordance with this Privacy Policy. If you do not understand or agree with any of the terms of this Privacy Policy set out below, please do not use, access or otherwise provide Alder & Sound with personal data about you.

Our website may include links to third-party web pages/websites and services operated by other organisations. As they are not controlled by us, this privacy statement is not applicable to their use. Therefore, we encourage you to consult their privacy policies separately. We cannot be responsible for the privacy policies and practices of other sites (even if one accesses them using links from our website). We offer these links only as additional information to provide better client service. Please also note that this Privacy Policy does not apply to any links to third party websites or services which one may come across in connection with the use of the Services. Alder & Sound assumes no responsibility for the privacy practices of any third parties. All collection, use, processing and storing of any personal data by a third party shall be subject to the applicable privacy policies of such third party.

For the purposes of this Privacy Policy, “controller”, “processor”, “personal data”, “data subject” and “processing” shall have the meanings given to them in them in the applicable data protection legislation. For the purposes of this Privacy Policy, the “applicable data protection legislation” shall mean the applicable laws and regulations in respect of the processing of personal data and data protection, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, “GDPR”) as well as supplementary Finnish legislation, case-law and guidance from supervisory authorities.

WHAT ARE THE PURPOSES OF PROCESSING PERSONAL DATA

Alder & Sound only collects personal data that is relevant and necessary for the intended purpose.

Alder & Sound may collect and process personal data to the extent necessary for the purposes of:

• setting up and maintaining our client relationships;
• conducting and performing our Services;
• identifying our clients as per applicable laws and conducting research for conflicts of interest;
• fulfilling the rights and obligations of the clients and the data controller;
• processing of personal data regarding our stakeholders (such as suppliers, job applicants, employees or other business partners);
• processing of personal data of website visitors for the purpose of ensuring and developing the technical functionality and security of our website;
• processing of personal data for the purposes related to our Services including developing, providing, fulfilling, and marketing of our Services;
• communicating and collaborating with Alder & Sound’s stakeholders, such as direct electronic marketing, newsletters and organizing of seminars or other events in accordance with applicable law;
• designing and developing our business operations, performing market research, maintenance and development of our Services or quality assurance;
• protecting the rights and property of Alder & Sound as well as preventing and investigating fraud and other misuses; and
• complying with the legal obligations of Alder & Sound and otherwise in connection with law enforcement or other civil or criminal legal proceedings.

WHAT IS OUR LEGAL BASIS OF PROCESSING PERSONAL DATA

The legal basis for processing personal data is, depending on the purpose of processing as listed above, either performance of a contract, legitimate interests of the data controller, consent, or compliance with a legal obligation of the data controller. Processing personal data is necessary for us based on the following reasons:

• Performing our obligations in accordance with any contract that we may have with our clients or other stakeholders.
• It is in our legitimate interest or a third party’s legitimate interest to use personal data to ensure that we provide our Services in the most efficient and appropriate manner.
• Compliance with any legal obligations which are imposed on us.

CATEGORIES OF PERSONAL DATA PROCESSED

In order to provide the Services, Alder & Sound needs to collect certain information, by which a person is individually identifiable (i.e. “personal data”).

Alder & Sound may collect personal data of the following persons, relevant for the above-mentioned purposes of processing:

• clients and their representatives and contact persons;
• representatives and contact persons of subcontractors and suppliers;
• potential clients and their representatives and contact persons;
• other stakeholders and their representatives (job applicants, co-operation partners); and
• persons related to client assignments.

The following personal data of the data subjects, relevant for the above-mentioned purposes of processing, may be processed:

• name;
• e-mail address;
• phone number;
• company and title;
• name and business ID of the company and contact person;
• additional information provided by the data subject himself/herself;
• personal data processed on a case-by-case basis in connection with client assignments (such as emails, documents, other communication);
• information gathered on the basis of visiting our website, such as IP address and browser information;
• information based on client relationship, such as contact history, feedback and follow-up information;
• invoicing and billing information;
• information needed to carry out certain client assignments, such as date of birth, personal identification number, home address, citizenship, and passport copy; and
• information needed for identifying a person as provided for in the Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017, as amended) (such as name, date of birth, personal identification number, citizenship, passport copy and information to determine financial situation and political influence of a person).

The data Alder & Sound collects may also include information it receives from the email interaction or other contact with its stakeholders in connection with the Services.

SOURCES OF PERSONAL DATA

Personal data is primarily collected from the data subject himself/herself during the course of our business activities.

Personal data may also be obtained from authorities, courts or other institutions, or public sources. Some of the personal data may also be obtained from the employer of the data subject, or from a representative or a business partner of a client.

Some of the personal data may also be generated by us based on the data we have. We may, for example, compile and analyse data we possess in order to create new data. Some of the data used for such activities can be collected from public sources, such as trade registers or corporate websites.

RECIPIENTS OF PERSONAL DATA

Unless otherwise stated below, Alder & Sound does not sell, lease, rent or otherwise disclose personal data to unauthorised third parties without your consent.

Notwithstanding the above, Alder & Sound may provide personal data to third parties working with Alder & Sound for the purposes mentioned above, including third party service providers that provide Alder & Sound with support with our IT systems. However, such parties are obliged to process the data on our behalf, and they are not permitted to use such personal data for any other purposes than those listed above. They are also required to act consistently with this Privacy Policy and to use appropriate security measures to protect the personal data.

Alder & Sound may be obligated by mandatory legislation to disclose personal data to certain authorities, such as law enforcement agencies. Alder & Sound may also process personal data in connection with defending the legitimate interests of Alder & Sound in civil or criminal legal proceedings or to prevent and investigate fraud and other misuses.

Alder & Sound may transfer, assign and disclose personal data to its affiliates or a subsequent owner or co-owner in connection with a corporate merger, consolidation, restructuring, or the sale of substantially all of the stock or assets or in connection with bankruptcy proceedings or other corporate reorganization, in accordance with this Privacy Policy.

TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION OR THE EUROPEAN ECONOMIC AREA

As a main rule, personal data is not transferred outside of European Union or the European Economic Area.

However, transfers of personal data outside the European Union or the European Economic Area may occur especially when using some of the features provided by our technical service providers (such as Google Analytics or Active Campaign). Any possible transfers of the personal data will always be carried out in accordance with applicable data protection legislation and subject to appropriate safeguards as required.

RETAINING PERSONAL DATA

Alder & Sound retains personal data only for as long as it is necessary for the purposes of processing which have been determined in advance.

The personal data is systematically and regularly updated and data type specific retention periods are re-evaluated in regular intervals. On the basis of such evaluations, any personal data which is outdated or has become redundant, i.e. personal data which Alder & Sound no longer has a legal basis to retain or process, will be deleted on a regular basis. Personal data has become redundant, for example, when the client, business, co-operation or contract relationship with the controller has ceased, notwithstanding cases where legislation requires retaining personal data or where Alder & Sound needs the data for the establishment, exercise or defence of legal claims or to handle a similar disagreement.

When the storage of personal data is no longer necessary for the purpose for which it was initially collected, we may however continue storing the personal data only as long as such processing is required by law or is reasonably necessary for our legal obligations or legitimate interests such as claims handling, bookkeeping, internal reporting, reconciliation purposes and direct marketing.

The data retention period and retention criteria may vary depending on the categories of personal data and on the purpose of each special category of personal data. Alder & Sound may also have a statutory obligation to retain certain personal data for a specific time period. Due to this, the exact time periods and procedures for data destruction vary by data category.

RIGHTS OF THE DATA SUBJECT

The data subjects have the following legal rights relating to their personal data which they may, as appropriate on a case by case basis and in accordance with the applicable data protection legislation, exercise:

(a)     the right to know if Alder & Sound processes any personal data concerning him or her, which personal data Alder & Sound holds and to request access to such information;

(b)     the right to request the rectification of personal data if the personal data is inaccurate or incomplete;

(c)     the right to request Alder & Sound to erase his/her personal data about the data subject if it is no longer needed for the purposes for which it was collected;

(d)     the right to request Alder & Sound to restrict the processing of his/her personal data if the personal data is not accurate, the processing is illegal and the data subject objects to the deletion of the personal data and instead request for its use to be restricted, if the personal data is no longer needed for the purposes for it was collected but it is needed to establish, bring or defend themselves against legal claims, or if the data subject objects to the processing by Alder & Sound where Alder & Sound has collected personal data based on its legitimate interest and Alder & Sound is investigating whether the data subject’s privacy interest overrides the legitimate interest of Alder & Sound;

(e)     the right to object, on grounds relating to the data subject’s particular situation, to the processing of personal data by Alder & Sound based on its legitimate interest, including profiling;

(f)      the right to request Alder & Sound to provide the personal data provided to Alder & Sound in a structured, commonly-used and machine-readable format and the right to transfer such personal data to another controller if the processing is based on a contract with the data subject and the processing takes place automatically; and

(g)     the right to file a complaint with a relevant supervisory authority regarding the processing of personal data by Alder & Sound.

The data subjects may exercise the above stated rights by contacting Alder & Sound as per the contact information set out below in Section 13. We aim to provide the data subject with a reply as soon as possible and, where needed, provide the data subject with additional instructions or ask additional questions based on the request. Please note that prior to fulfilling a request we have a right as well as an obligation to verify the requestor’s identity, due to which we must be able to recognize the requestor in an adequate manner. If the request is manifestly unfounded or excessive, we may charge a reasonable fee for administrative costs to carry out the request or refuse to act on such request.

FURTHER PROCESSING OF PERSONAL DATA

Alder & Sound does not process personal data for other purposes besides those described in this Privacy Policy.

Should Alder & Sound further process personal data for other purposes, Alder & Sound has a duty, in accordance with data protection legislation, to notify the data subject about this intent prior to further processing. In such case Alder & Sound will also give all additional information concerning the matter.

INFORMATION SECURITY

Alder & Sound takes appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data and against accidental loss or destruction of, or damage to, the personal data in accordance with our internal security procedures covering the storage and destruction of personal data as well as access to personal data.

Alder & Sound regularly checks its security policies and procedures to ensure our systems are secure and protected. Information security measures include for example, where appropriate, encryption, firewalls, secure facilities and access right systems. Our security controls are designed to maintain an appropriate level of data confidentiality, integrity, availability, resilience and ability restore the data.

Alder & Sound will revise its processing operations and equipment on a regular basis and, inter alia, assess risks related to the processing of personal data for example when introducing a new technology.

COOKIES AND OTHER SIMILAR TRACKING TECHNOLOGIES

We use various technologies to collect and store analytics data and other information when you visit Alder & Sound website (aldersound.fi), including cookies.

Cookies are small text files sent and saved on your device that allow us to identify visitors of our website and facilitate its use and to create aggregate information of our visitors. This helps us to improve our website. The cookies will not harm the visitor’s device or files. We use cookies to tailor our website and the information we provide in accordance with the visitor’s individual interests.

GOOGLE ANALYTICS

• Our website uses Google Analytics (Google Inc.). When visiting our site, the visitor’s browser automatically sends certain information to Google. Google Analytics generates anonymous reports from data obtained through cookies, such as the number of visitors, the website from which the visitor arrives to our website, the keyword used in the Google search engine with the help of which the user has been redirected to the website, the duration of the website visit, whether or not the user has visited the website before, and which pages of the website the visitor visits. Google Inc. is incorporated in the US due to which the personal data may be transferred outside the European Economic Area. However, Google Inc. is a certified corporation listed under the Privacy Shield Framework between the EU and the US. For further information on this, please consult the Google website.

ACTIVE CAMPAIGN

• We use Active Campaign as an email marketing platform. Active Campaign uses cookies and similar technologies to gather information from the users, such as the devices and the browsers of the users, numbers of visitors on sites, time used on the sites and the preferences of the users. The gathered information may be used for, i.a. the following purposes: functionality of the services, delivery and targeting of advertisements, improving the users’ experience and keeping the services secure. Active Campaign is incorporated in the US due to which the personal data may be transferred outside the European Economic Area. However, Active Campaign is a certified corporation listed under the Privacy Shield Framework between the EU and the US. For further information on this, please consult the Active Campaign website.

LEADFEEDER

• We use Leadfeeder for tracking our website visitors. Leadfeeder gathers information from the website visitors, such as the companies who visit our site, the path how the website was found, their behavior while visiting the website as well as the company details and contact information when such data is available. For further information on how Leadfeeder gathers data, please consult Leadfeeder website.

With the help of website traffic monitoring, we develop our website in order to make it better than before and to deliver a better user experience. If you wish, you can prevent the cookies from gathering information about you.

Furthermore, we use other third-party services and cookies on our website, too, to enable the content of our website to be shared on social media. These service providers include LinkedIn, Facebook, Twitter and Instagram.

At all times, you are able to disable, manage, and delete cookies, or to set an alert when cookies are being sent, through your browser or mobile device settings.

THE CONTROLLER OF PERSONAL DATA

The data controller is:

Alder & Sound Oy
Eteläesplanadi 8
00130 Helsinki

If you have any questions concerning the way Alder & Sound processes your personal data or want to contact Alder & Sound for any other reason relating to your personal data, you may contact Alder & Sound by email at info@aldersound.fi, or phone +358 10 219 3890.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy has been last updated on 8 May 2020.

Alder & Sound recommends that you revisit this page periodically to stay aware of any changes to this Privacy Policy, which Alder & Sound may update from time to time. If the Privacy Policy is modified, it will be made available through the Alder & Sound website. Your continued use of the Alder & Sound Service after the revised Privacy Policy has become effective indicates that you have read, understood and agreed to the current version of the Privacy Policy.