Privacy policy
BUILDIE
PRIVACY POLICY
1. INTRODUCTION
The purpose of this policy is to inform our customers and partners about how we process their personal data when they interact with us or use our Buildie service. We are committed to complying with the EU General Data Protection Regulation and other applicable legislation on the processing of personal data. We also ensure that our processing is carried out securely and that our data protection practices allow data subjects to exercise their rights in full.
Date prepared: [01.02.2025]
1. Controller
Buildie Oy (Business ID: 2679827-6)
Finlaysoninkatu 2, 33210 Tampere, Finland
Phone: +358 50 303 4365
Email: tietosuoja@buildie.fi
(hereinafter “we”)
Data Protection Officer contact details
Tommy Krook
Phone: +358 40 4877 559
Email: tommy.krook@buildie.fi
All contacts and requests concerning this policy must be made in writing or in person using the contact details specified in this section.
2. Personal data processed, purposes of processing and legal basis
| Henkilötiedot | Käsittelyn tarkoitus | Oikeusperuste |
Basic information such as name, username and/or other identifier, password, and preferred communication language; contact details such as email address, phone number and postal address; company information and details of the company’s contact persons such as Business ID and the names, titles and contact details of contact persons | Providing and developing our products and services | Performance of a contract; our legitimate interest in developing our business |
| Customer Surveys | ||
| Fulfilling our contractual and other commitments and obligations | Performance of a contract | |
| Invoicing | ||
| Marketing our services to businesses | Our legitimate interest in ensuring the continuity of our business | |
| Acocunting | Legal obligation | |
| Data obtained from the use of our service, such as user-specific log data on the use of the service and information the user voluntarily provides in the service | Monitoring and analysing usage data in order to ensure the technical functioning of the service, improve the user experience, develop the service, identify errors, and carry out customer-specific usage analysis, as well as manage and develop the customer relationship | Our legitimate interest in developing and safeguarding our services and ensuring their reliable operation |
| Direct-marketing prohibitions and consents | Compliance with the customer’s wish not to receive direct marketing | Our statutory obligation to comply with direct-marketing prohibitions |
| Information relating to events in which the customer participates, such as registration details, special dietary requirements and invoicing details; consent regarding health information (e.g. allergies) | Organising events | Our legitimate interest in hosting events and, where necessary, invoicing them |
| Consent regarding health information (e.g. allergies) | ||
| Customer and contract information, and information concerning contracts concluded with our partners, such as details of past and current contracts and orders, communications and correspondence with the customer and other contacts, product and order details, invoicing and payment details, and information voluntarily provided by the customer to our systems or obtained with the customer’s consent | Fulfilling our contractual and other commitments and obligations | Performance of a contract |
| Invoicing | ||
| Managing the customer relationship | Our legitimate interest in managing and developing the customer relationship | |
| Accounting | Legal obligation | |
Images uploaded to the Buildie service and any personal data appearing in them (e.g. faces or other identifying information), analysed by artificial intelligence for the service’s internal functionalities
| Tekoälypohjainen kuvien analysointi (BuildieAI). Tunnistuksia hyödynnetään dokumentoinnin laadun, löydettävyyden ja käytettävyyden parantamiseksi sekä palvelun kehittämiseksi. Tietoja ei käytetä mallien kouluttamiseen eikä siirretä Buildien ulkopuolelle. | Our legitimate interest in developing and improving the functionalities of our service and in ensuring its high-quality and efficient use |
3. Sources of information
Personal data is obtained primarily from the customer or user of our service themselves in connection with the introduction or use of the service, and additionally from public authorities, credit information companies, providers of contact information services and other similar reliable parties.
Personal data may also be collected and updated for the purposes described in this policy from publicly available sources and on the basis of information received from public authorities or other third parties, within the limits of the applicable legislation.
4. Transfers, disclosures and recipients of personal data
We use subcontractors acting on our behalf to process personal data. We have outsourced IT management to an external service provider, on whose managed and secured server personal data is stored. In addition, we may disclose data to public authorities where required by legislation.Personal data contained in our Buildie SaaS service is not transferred outside the EU/EEA. Personal data collected about visitors to our website, however, may be transferred outside the EU/EEA. Where personal data is processed outside the EU/EEA, we ensure that the subcontractor has committed to the European Commission’s standard contractual clauses on the processing of personal data.
5. General description of technical and organisational security measures
Only those of our employees who are entitled to process customer data as part of their work are authorised to access the system containing personal data. Each user has their own username and password for the system. With system suppliers and other partners processing personal data, we have signed data processing agreements in which our partners have committed to complying with the data protection and information security requirements set out in the GDPR.
Databases containing personal data are protected by passwords and access-rights levels. The data resides in an environment protected by appropriate information security software and technical measures. Documents containing manually processed personal data of customers are stored in locked storage.
6. Retention period for personal data
Data category | Retention period |
Information concerning customer orders and information concerning the customer relationship | In accordance with the Finnish Accounting Act, for the duration of the customer relationship and for 6 years thereafter. |
Information concerning newsletters and direct marketing (prohibitions and consents) | Information on the recipients of our newsletters and other direct marketing is retained for as long as consent to receive them is valid. A prohibition concerning our newsletters and other direct marketing is retained until further notice, so that the prohibition can be complied with. |
Customer service contacts | For contacts other than complaints, the retention period for personal data is at most 1 year. |
Information concerning complaints | For the period required by legislation (10 years), so that we can fulfil the purposes described in this policy. Retention of the material is based on the laws concerning accounting, damages and the limitation of debts. |
Information concerning use of the service | For the duration of use of the service, and for 1 year thereafter. |
Cookies used on the website | See the cookie-specific retention periods [Cookies] |
We regularly assess the necessity of retaining data, taking the applicable legislation into account. In addition, we take reasonable measures to ensure that no personal data on data subjects is retained that is incompatible with the purposes of processing, out of date or inaccurate. We rectify or delete such data without delay.
Personal data may be retained beyond the retention periods referred to above where necessary for a specific reason, such as suspicion of a criminal offence and the related investigation by authorities. After the customer relationship has ended, personal data relating to the customer’s payment transactions may also be retained beyond the retention periods referred to above in accordance with the retention periods required by the Finnish Accounting Act.
7. Rights of the customer
Right | In which situations |
To access data concerning oneself | Always |
To request the rectification of inaccurate or out-of-date data | Always |
To request the erasure of data | Where the customer has withdrawn their consent or another of the conditions set out in Article 17 GDPR is met |
To withdraw consent | Where processing is based on consent |
To object to the processing of data | Where the processing is based on legitimate interest and a specific personal situation applies, or where the data is processed for direct marketing |
To request restriction of the processing (e.g. for the period during which requests concerning the data are being clarified and resolved) | Where the accuracy of the data has been contested or another of the conditions set out in Article 18 GDPR is met |
To lodge a complaint concerning the processing of personal data with the Data Protection Ombudsman | Always |
The above requests, objections and withdrawals may be made in writing to the email address teemu.lepisto@buildie.fi or by post to Buildie Oy, Finlaysoninkatu 2, 33210 Tampere, Finland. The request must include the name and contact details of the data subject. To ensure data protection, we may ask the customer to verify their identity.
We respond to requests and enquiries from customers concerning the exercise of data subject rights within one month.