This is Etha Oy’s privacy policy that follows the EU’s General Data Protection Regulation (EU 2016/679) (GDPR) and Data Protection Act (1050/2018). In this privacy policy, we describe how and in which situations personal data is processed and what rights you have as a data subject.
Written March 13, 2023. Updated September 1, 2026.
1. Controller and contact information
Etha Oy (1790018-7)
Vaasanpuistikko 14 B 11
65100 Vaasa
E-mail: info@etha-consultancy.com
Phone: +358 (0)2900 20440
2. Categories of data subjects
Depending on the purpose of processing, Etha Oy may process personal data relating to website visitors, customers and their representatives, prospective customers and business contacts, investors, event participants, job applicants, and other individuals whose information is included in project documentation, contracts, correspondence, or assignments carried out by Etha Oy.
3. Purpose and reasons for processing personal data
To develop the products, services, and operations of Etha Oy, to carry out tasks and assignments appropriately, and to follow the law, Etha Oy processes personal data mainly for the following purposes and reasons:
- The development of products, services, and operations. It is in your and our interests that our products are suitable and modern. We want to be at the forefront of our industry’s development. The personal information you give us by, for example, using our website, helps us realize these goals. This type of personal data processing is based on a legitimate interest.
- Providing a smooth website experience. A smooth and user-friendly website makes it more functional and faster to browse. This kind of data processing is also based on a legitimate interest.
- The processing of job applications. Etha maintains a job applicant register, which is used for collecting personal information (person’s name, contact information, curriculum vitae) about jobseekers with their consent. Jobseekers’ personal information is collected from the open job applications and possible certifications submitted by them. In addition, we process your personal information to, for example, evaluate the suitability of your work experience, invite you to an interview, and use certain data as the basis for a possible contract of employment. Processing this data may be based on legitimate interests or consent given by submitting the application, depending on the situation.
- The processing of invitations and sign-ups. We consider different events to be great opportunities to meet new people and network. As you sign up for an event, we must process your registration. Additionally, Etha Oy maintains an event register where personal data is collected (person’s name, contact information and alternatively company/organization and job title) mainly for invitations. This kind of data processing is based on a legitimate interest and/or consent.
- The management of matters related to customer relationships. Personal information is processed for handling and managing matters related to customer relationships (offering products and services, sales, delivery and invoicing, managing supplier relationships, and possible processing of support requests and reclamations). In this context, the processing of personal data can be based on both a contract and a legitimate interest.
Regarding personal data processing based on a legitimate interest, Etha Oy has carried out an assessment to ensure that its interests do not override the rights of the data subject.
Regarding personal data processing based on your consent, you always have the right to withdraw your consent. For example, you have the right to change your settings on the website or your browser so that cookies are not collected.
4. Categories of personal data the processing affects
The personal data categories to be processed depend on the type of data subject. The different types of personal data categories are:
- Technical user data, such as cookies, IP addresses, language settings, location data, software and hardware versions, and which pages you have visited and reacted to.
- Basic contact and identification information, such as name, e-mail address, telephone number, address, address, postal code, web address, and date of birth where necessary.
- Professional information about your position, such as employer, job title, and industry.
- Event participation information.
- Marketing permits and prohibitions.
- Consents.
- Interests.
- Certificates, work experience, skills and other work-related information, such as transcript of study records, referees, suitability assessments, and salary requests.
- Pictures. For example, pictures of resumes.
- Social security number.
- Customer information, such as a legal or physical person and a corresponding office, and other information we need, or you deliver to us to process the matter.
- Payment and invoicing information, such as paid amounts, billing addresses, contact persons, and account numbers.
Etha Oy does not intentionally collect special categories of personal data. However, such information may occasionally be included in correspondence, communication, received material, appeals, recruitment materials or other documentation submitted to Etha Oy.
5. Data minimisation
The personal data processed by Etha Oy is limited to what is necessary for each specific purpose. This principle is ensured, for example, by keeping the digital tools used for customer relationship management, sales, and marketing separate from those used for processing job applications. As a result, access to job application data is restricted to personnel involved in recruitment, who ensure that such information is stored only in the appropriate systems. In practice, this means that personal data related to job applications is not automatically transferred to tools used for other purposes.
6. The sources used by Etha Oy
Your personal data is primarily collected through your own activity, for example when you use our website, contact us directly, or sign up for an event. In some cases, we may also obtain personal information from other sources, such as from public registers and publicly available sources, and your employer’s website or references you have named. Personal data may additionally be collected from project documentation and stakeholder engagement activities during customer and supplier relationships.
We also use cookies and similar technologies to automatically collect certain information when you visit our website or interact with our emails. Through these systems, personal data such as contact details, communication history, and customer interactions may be stored and processed as set out in this privacy policy. This helps us improve the usability of our online presence and measures the effectiveness of our communications and marketing activities, and support in management of matters related to customer relationships.
7. Recipient categories
Etha Oy processes personal data mainly within its own organization. In some cases, data may be shared with service providers such as IT and cloud, hosting and software providers, or consultants who meet privacy requirements. Personal data may also be disclosed in connection with a business reorganization or sale, to authorities where required by law, during audits or compliance reviews, or to insurers and related parties for purposes such as underwriting, claims, and administration. Where necessary, personal data may be disclosed to customers, project owners, investors, lenders and counterparties where required for the performance of an assignment.
8. Personal data retention period
Etha Oy stores personal data as long as it is necessary for the purpose for which it was originally collected, and to comply with our legal obligations, including accounting and tax legislation, and where necessary to establish, exercise or defend legal claims. Data collected for marketing purposes will be reviewed at least every two years to ensure that they are up to date, at which time unnecessary or outdated data will be deleted. The necessary retention period varies depending on the purpose the data was collected for.
9. Data transfer outside the EU or EEA
We primarily store and process your personal data on servers located within the EU and the EEA. We also strive to ensure that all our service providers are based within the EU/EEA.
However, certain products and services require that personal data may be transferred to, stored in, or otherwise processed in countries outside the EU/EEA. This may occur, for example, when we use third-party IT service providers.
Where such transfers occur, we or our IT service providers implement appropriate safeguards to protect your personal data in accordance with applicable data protection laws. These safeguards include the use of the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, reliance on adequacy decisions adopted by the European Commission in accordance with Article 45 of the GDPR.
10. Rights of the data subject
You have the following rights under the EU General Data Protection Regulation (GDPR):
- Right to access. You have the right to request confirmation as to whether we process your personal data and, where that is the case, to receive a copy of your personal data together with information regarding the processing.
- Right to rectification. You have the right to request that inaccurate or incomplete personal data concerning you be corrected or updated without undue delay.
- Right to object. Where we process your personal data on the basis of our legitimate interests, you have the right to object to such processing on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defense of legal claims.
- Right to erasure. In certain circumstances, you have the right to request that your personal data be erased. This right does not apply where the processing is necessary to comply with a legal obligation, for the establishment, exercise or defense of legal claims, or where another legal basis requires or permits continued processing.
- Right to restrict processing. You have the right to restrict data processing and right to object to direct marketing. Additionally, you have a right to withdraw consent at any time where processing is based on consent.
- Right to withdraw consent. Where processing is based on your consent, you have the right to withdraw your consent at any time.
- Right to data portability. You have the right to receive the personal data concerning you, and to have it provided for you in a structured, commonly used and machine-readable format and the right to transmit the data to another controller, where technically feasible.
- Right of appeal. You have the right to file a complaint with the competent supervisory authority if you consider that Etha Oy has violated the existing data protection legislation in the processing of personal data.
Request relating to the exercise of data protection rights should be submitted to the contact details provided in this notice.
11. Changes to this notice
Etha Oy may update this privacy policy from time to time to reflect changes in legislation, business operations or data processing practices. The most recent version will be made available on Etha Oy’s website.
Cookies
The website uses the following cookies:
| Cookie | Service | Function |
|---|---|---|
| __cf_bm | Cloudflare | Bot protection |
| __hssc | HubSpot | Session tracking |
| __hssrc | HubSpot | Session identification |
| __hstc | HubSpot | Marketing and analytics |
| _ga | Google Analytics | Visitor statistics and monitoring |
| _ga_3DF869MJD7* | Google Analytics | Visitor statistics and monitoring |
| _ga_CR08LF9WWJ | Google Analytics | Visitor statistics and monitoring |
| _gid | Google Analytics | Visitor statistics and monitoring |
| _lfa | Leadfeeder | Visitor statistics and monitoring |
| CLID | Microsoft Clarity | Visitor statistics and monitoring |
| hubspotutk | HubSpot | Visitor identification and analytics |
| moove_gdpr_popup | Website | Cookie consent management |
| MUID | Microsoft | Visitor identification and analytics |
| pll_language | Website | Language preference |
| wordpress_test_cookie | WordPress | Tests cookie support |
| wp_lang | WordPress | Language preference |