Privacy policy
Spinnova Oy (“Spinnova”, “we”, “us”) is the data controller in relation to the processing of personal data that takes place in connection with visiting and using the website spinnovagroup.com (“website”) as well as in connection with investor or business relationship management and related communication. Personal data means any information which allows or facilitates the identification of an individual.
It is important to us that you feel safe with how we handle your personal data. We take measures to ensure that your personal data is protected and that the processing of your personal data is carried out in accordance with data protection legislation and our internal policies and procedures.
1. Where do we collect personal data?
We may collect personal data in the following ways:
- Personal data that you give to us when filling and submitting forms on the website, providing information in connection with events or when you correspond with us in another way.
- Personal data that we collect or generate automatically. When you visit the website, we will automatically collect online identification data, including IP-address, that connects your device to the internet. We may also collect cookie data about you when we place cookies to your device during your visit on the website.
- Personal data we collect from other sources, for example, when we update information on the website regarding our shareholders from the book-entry system maintained by Euroclear Finland Oy. We may also collect your data from the entity that you represent when we communicate with your organization.
2. When and why we process personal data?
The processing of personal data, in connection with using the website and communicating business or investor related information, takes place for the following purposes:
| Purpose | Context of the processing | Categories of personal data | Legal basis |
|---|---|---|---|
| Manage the website and enable the transmission of messages in communication networks. | Processing personal data for the purposes of managing the website and enabling transmission of messages in communication networks. Such processing takes place, for example, when collecting online identifiers in order to deliver the website to requesting visitor and ensure the proper functioning of the website. | Online identifiers (including IP-address and cookie data) | Legitimate interests. The processing is necessary to achieve Spinnova’s interests in receiving, imparting and publishing relevant information and communication about Spinnova through the website. |
| Evaluate and follow up on the use of the website. | Processing personal data for the purposes of evaluating and following up on the use of the website, for example, when placing statistical and analytical cookies on your device. | Online identifiers (including IP-address and cookie data) | Consent. The processing is based on the consent provided during visit on the website. |
| Manage investor and business relationships. | Processing personal data for the purposes of investor and business relationship management. Such processing may take place, for example, when maintaining relevant investor or business information and communicating in relation to Spinnova’s activities. | Identity dataContact dataOrganisational data | Legitimate interests. The processing is necessary to achieve Spinnova’s interests in maintaining investor and business relationships. |
| Communicate business related information. | Processing personal data for the purposes of communicating business related information, for example, if you subscribe to our newsletters, press releases, annual reports or similar information regarding Spinnova and its business. | Identity dataContact dataOrganisational data | Legitimate interests. The processing is necessary to achieve Spinnova’s interests in imparting and publishing business related information. |
| Carry out events. | Processing personal data for the purposes of carrying out events, for example, when sending invitations and registering participant information. | Identity dataContact dataEvent participation data Organisational data | Legitimate interests. The processing is necessary to achieve Spinnova’s interest in carrying out events. |
3. Whom do we share personal data with?
Where necessary, we share personal data with third parties. We categorize the third parties receiving personal data as service providers and other recipients. Service providers process personal data on behalf of us as data processors, whereas other recipients are data controllers for personal data and process personal data for their own purposes.
Service providers:
In order to fulfill the purposes of processing personal data, we share personal data with service providers that we have engaged. Such service providers include, for example, Seravo Oy (website hosting service provider) and Cision Finland Oy (news distribution service provider).
Other recipients:
In certain cases, we share personal data with other recipients. In this regard, we may share personal data, for example, with Google LLC in connection with our use of Google Analytics which we use for the purposes of evaluating and following up on the use of the website (you may read more about how Google LLC uses personal data here). We need to categorize Google as other recipient since Google may use the data collected through Google Analytics also for its own purposes (i.e. not only for Spinnova’s purposes).
In addition, we share, if necessary, personal data with our external advisors (e.g. auditors, law firms), competent authorities, courts, and potential buyers or sellers in the context of possible mergers and acquisitions.
4. Where are personal data processed?
Personal data are primarily processed within the EU/EEA and we always strive to ensure that personal data are not transferred to third countries outside the EU/EEA. However, in cases where personal data are processed by a recipient so that the personal data are transferred or becomes accessible from outside the EU/EEA, we always put adequate safeguards in place to protect the personal data. Examples of these safeguards are data transfer agreements (including standard contractual clauses adopted by the European Commission) and adequacy decisions of the European Commission. If you have questions on the countries to which personal data are transferred and which safeguards we take to protect personal data, please contact us at comms@spinnova.com.
5. How long we keep personal data?
We retain personal data only for a period that is necessary to achieve the purposes for which personal data are processed. In general, we observe the following principles with respect to retaining and deleting personal data:
- Online identifiers are stored for a maximum period of 2 years following their collection. Please note that the expiration times of cookies are provided separately in the cookie declaration.
- Personal data collected through forms on the website are stored for a maximum period of 2 years after having received the data.
- Personal data processed in relation to communicating business related information that you have subscribed to (e.g. newsletters, catalogues, press releases or similar) are stored until you unsubscribe from the information requested.
- Personal data required for accounting material will be retained for a minimum period of 6 years following the end of relevant financial year.
6. Your rights as data subject
Under data protection legislation, you as a data subject have the following rights with regards to the processing of your personal data:
- Right to withdraw consent: you have the right to withdraw the consent given by you, after which we will cease from processing your personal data on the basis of your consent.
- Right of access: you have the right to request confirmation of whether your personal data are processed, and access to that personal data.
- Right of rectification: you have to the right to request rectification of any inaccurate or incomplete personal data concerning you held by or processed by us.
- Right of erasure: you have the right to request that personal data concerning you is erased where it is no longer necessary for the purpose for which it was collected or processed, where you object to the processing and there are no overriding legitimate grounds for processing, where your personal data is being unlawfully processed, or where personal data must be erased in order to comply with relevant legislation.
- Right of restriction: you have the right to request restriction of processing of your personal data where the accuracy of the personal data is contested, where processing is unlawful or where the personal data is no longer needed by us, but you legitimately oppose the erasure of the personal data, or where you object to the processing and it has not yet been verified whether legitimate grounds exist for the processing.
- Right to object: you have the right to object to the processing of any of your personal data when such processing relies on our legitimate interest as a legal basis. In case you use the right to object, we need to demonstrate compelling legitimate grounds for the processing in order to continue the processing of such personal data.
- Right of data portability: you have the right to receive the personal data concerning you and to transmit the personal data to another controller for personal data that are processed under the legal basis of consent or contract.
7. Spinnova’s contact information
Spinnova is committed to ensuring that the personal data it processes is accurate, complete, and kept up-to-date to the extent necessary for each relevant purpose. If you wish to rectify inaccuracies or delete personal data relating to you, or otherwise wish to exercise your rights as data subject, or if you have any questions, comments or concerns about this privacy policy, or if you wish to make a complaint about Spinnova’s handling of personal data or a possible breach of data protection legislation, then please contact us at: comms@spinnova.com.
When exercising your rights you may be asked to provide proof of identification and other relevant details in order to ensure integrity and confidentiality of personal data.
Furthermore, you always have the right to contact, or complain to the relevant data protection authority with regards to the processing of personal data. In Finland, the relevant authority is the Data Protection Ombudsman: https://tietosuoja.fi/etusivu.
8. Changes to this privacy policy
This privacy policy may change from time to time by posting an updated version on the website, thereby superseding earlier versions. If there are changes that materially alter our privacy practices, we may also notify you by other means, such as by email or by posting a notice on the website and/or social media pages in reasonable time prior to the date that the changes take effect.