Privacy policy

How Höyrymedia Oy processes personal data and what rights you have.

In this privacy policy, we explain how Höyrymedia Oy processes the personal data of our clients, people who contact us, job applicants and visitors to our website. We comply with the EU General Data Protection Regulation (2016/679) and the Finnish Data Protection Act (1050/2018).

1. Data controller

Höyrymedia Oy (Business ID 3269335-8)

Lönnrotinkatu 45, 00180 Helsinki

Data protection enquiries: elias.makinen@hoyrymedia.fi

2. Purposes and legal bases for processing personal data

We need personal data to respond to enquiries, provide our services, manage client relationships and develop our business. The table below sets out, by group, what data we process, what we use it for and the legal basis for the processing.

Examples of data processed

Purpose of processing

Legal basis

Clients and people who contact us

Name and contact details, organisation and job title, and the content of the enquiry.

Responding to enquiries and requests for quotes, and arranging meetings.

Pre-contractual steps and legitimate interest.

Contract, order and billing details, and communications and materials related to production.

Managing the client relationship, providing the service and invoicing.

Contract and obligations under the Finnish Accounting Act.

Client feedback and information on previous enquiries and quotes.

Monitoring service quality and developing the client relationship.

Legitimate interest.

Prospects and marketing

Name, work email and work phone number, organisation and job title.

Informing business decision-makers about our services and inviting them to events.

Legitimate interest. You can object to direct marketing at any time.

Name, contact details and organisation of people who register for an event.

Organising the event and related communications.

Legitimate interest based on the registration.

Job applicants

Name, contact details, application, CV and work samples.

Processing applications and making recruitment decisions.

Steps taken at the applicant's request, and legitimate interest.

Website visitors

IP address, device and browser information, website usage and cookie identifiers.

Measuring visitor numbers, developing the website, and targeting and measuring advertising.

Consent. For necessary cookies, legitimate interest.

The organisation that can be inferred from the visitor's network address.

Identifying companies interested in our services for sales purposes.

Consent.

3. Regular sources of data

We mainly obtain data directly from you: through forms, email, phone calls and meetings. We supplement company contact details from public sources, such as the Finnish Business Information System (YTJ), company websites and LinkedIn.

Data on the use of the website is collected through cookies and similar technologies if you have given your consent to them.

4. Regular disclosures of data

We use partners in our business to whom personal data may be transferred, depending on the purpose of the processing. Partners process data either on our behalf or as independent controllers. Data may be disclosed to the following categories of recipients:

Marketing and advertising platforms. We run advertising and measure its results on platforms to which cookie identifiers and data on the use of the website are transferred, if you have given your consent to this.

IT providers. We use systems supplied by partners for purposes including publishing our website, client relationship management, communications and file storage. These providers process data on our behalf.

Finance and billing partners. For invoicing and statutory bookkeeping.

Production subcontractors. We use freelancers and subcontractors in our productions, who only receive the data their work requires.

We do not sell personal data. We only disclose data to authorities where required by law.

5. Transfers of data outside the EU or EEA

Most processing takes place in Finland or elsewhere in the EU and the EEA. Some of the services we use operate outside this area, in which case data may be transferred there.

Example situation

Country

Safeguards

Analytics, advertising and cloud services whose provider, or its parent company, operates in the United States.

United States

The service provider's certification under the EU-U.S. Data Privacy Framework, or the European Commission's standard contractual clauses.

6. Data retention

We keep data only for as long as necessary for the purpose for which it was collected. Enquiries are deleted once the matter has been dealt with, unless it leads to a client relationship. Client data is kept for the duration of the client relationship, and billing records for the period required by the Finnish Accounting Act. Job applications are deleted once the recruitment process has ended, unless the applicant asks us to keep them for longer.

Cookie retention periods are shown in the cookie list at the end of this page.

7. Data security principles

Data is processed in systems accessed with personal login credentials. Only people who need the data for their work have access to it, and everyone who processes the data is bound by a duty of confidentiality. System providers are responsible for the technical security of servers and data communications. As a rule, no paper records are created.

8. Rights of the data subject

Data protection legislation gives you rights regarding the processing of your personal data. The rights do not apply as such in every situation, for example where the law requires us to retain the data. If you wish to exercise your rights, please contact us at the address given in section 1. We will respond within one month.

Right of access. You can ask us to confirm whether we process your data and obtain a copy of it.

Right to rectification. At your request, we will correct inaccurate data and complete incomplete data.

Right to erasure. We will erase your data if it is no longer needed, or if you withdraw your consent or object to the processing and there is no other ground for the processing.

Right to restriction of processing. You can ask us to restrict processing, for example while the accuracy of the data is being verified.

Right to object. You can object to processing based on legitimate interest. You can always object to direct marketing without giving a reason.

Right to data portability. You can receive the data you have provided to us in a machine-readable format when the processing is based on consent or a contract.

Right to withdraw consent. Where processing is based on consent, you can withdraw your consent at any time. You can change your cookie consent via the Cookies link at the bottom of the page.

Right to lodge a complaint. If you believe your data is being processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman, tietosuoja.fi.

9. Cookies

Our website uses cookies. When you first visit the site, we ask for your consent to them. Until you respond, the site does not set analytics or advertising cookies, and if you decline cookies, only a record of your choice is stored in your browser.

There are four categories of cookies: necessary, preferences, statistics and marketing. Necessary cookies keep the website working. You decide on the other categories yourself, and you can change your choice at any time via the Cookies link at the bottom of the page.

The list below shows the website's cookies, the services that set them and their retention periods. It is updated automatically.

This policy was last updated on 19 September 2026.