Privacy Policy
Last updated: 22 September 2026
1. Data controller
The controller responsible for the processing of personal data described in this Privacy Policy is:
CFE Finland Oy
Siilotie 1 C 1
90520 Oulu, Finland
Business ID: 3403851-7
Data protection contact:
gdpr@cfe.fi
General contact information is available on our Contact page.
2. Who does this Privacy Policy apply to?
We may process personal data relating to:
customers and their representatives
potential customers and prospective business contacts
partners, suppliers and other stakeholders
visitors to our website
people who contact us through our website, email or other communication channels
job applicants and persons interested in employment opportunities at CFE Finland.
This Privacy Policy describes the processing of personal data in connection with our business relationships, communications, website, marketing and recruitment-related activities.
3. What personal data do we process?
Depending on the context, we may process the following categories of personal data:
name
email address, telephone number and other contact details
employer, organisation and job title or professional role
information relating to customer, partner or stakeholder relationships
messages, enquiries, feedback and other communications
information provided in connection with recruitment, such as a CV, LinkedIn profile, employment history, education and other information voluntarily provided by an applicant
information about professional interests and interest in our services
marketing preferences and consent information
website usage information, such as pages visited, interaction with the website, approximate location, device and browser information and cookie identifiers
other information that is necessary for the relevant business relationship, communication, recruitment process or legal obligation.
We aim to process only personal data that is relevant and necessary for the purpose for which it is collected.
4. Where do we obtain personal data?
We primarily obtain personal data:
directly from you
from the organisation you represent
when you contact us, use our services, visit our website or participate in a recruitment process
from publicly available professional and business sources
from the Finnish Business Information System, Trade Register and other official registers where relevant
from professional networking services such as LinkedIn
from service providers used in connection with our business operations, where permitted by applicable law.
We do not use personal data obtained from third-party sources for purposes that are incompatible with the purposes described in this Privacy Policy.
5. Purposes and legal bases for processing
We may process personal data for the following purposes:
managing and developing customer, partner and stakeholder relationships
providing and developing our services
communicating with customers, partners and other contacts
preparing offers, agreements and projects
handling enquiries and feedback
recruitment and communication with job applicants
business development, reporting and statistical analysis
maintaining the security and functionality of our website, systems and services
measuring and developing our website and communications
business-to-business marketing and communications
measuring the effectiveness of our advertising and recruitment campaigns
complying with legal and regulatory obligations.
Depending on the processing activity, the legal basis for processing may be:
performance of a contract or steps taken before entering into a contract
compliance with a legal obligation
CFE Finland's legitimate interests, such as maintaining business relationships, developing our operations, securing our systems and conducting appropriate business-to-business communications
your consent, particularly for non-essential analytics and marketing cookies where consent is required.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Retention of personal data
We retain personal data only for as long as necessary for the purpose for which it was collected or as required by applicable law.
Retention periods may vary depending on the type of information and the purpose of processing.
For example:
customer and contractual information may be retained for the duration of the business relationship and thereafter for the period required by accounting, contractual, liability or other legal obligations
business contact information may be retained while the relationship or a reasonable business interest remains relevant
recruitment information is retained only for the period necessary for the relevant recruitment process and any applicable legal requirements or limitation periods
consent and marketing preference information may be retained as necessary to demonstrate and respect the choices made by the individual
website analytics and advertising data are retained according to the settings and retention practices applicable to the relevant service.
Personal data is deleted or anonymised when there is no longer a lawful purpose for retaining it.
7. Your data protection rights
Subject to the conditions provided by applicable data protection legislation, you may have the right to:
access personal data concerning you
request correction of inaccurate or incomplete personal data
request deletion of your personal data
request restriction of processing
object to processing based on legitimate interests
object at any time to the use of your personal data for direct marketing
request data portability where the legal requirements for portability are met
withdraw consent where processing is based on consent
lodge a complaint with a competent supervisory authority.
Requests concerning your personal data can be sent to:
We may request additional information where reasonably necessary to verify your identity before responding to a request.
You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland if you believe that your personal data has been processed in violation of applicable data protection legislation.
8. Disclosure of personal data and service providers
We do not sell personal data.
Personal data may be disclosed or made available to service providers where this is necessary for providing our services, operating our business, maintaining our website and systems, communicating with customers and applicants, or carrying out analytics and marketing.
Service providers used by us may include, for example:
Squarespace – website hosting and website functionality
Google – website analytics, where Google Analytics is enabled
LinkedIn – advertising measurement, website audience analysis and campaign analytics through the LinkedIn Insight Tag
Microsoft – email, communications and other Microsoft 365 services
other IT, communications and professional service providers necessary for our business operations.
Where a service provider processes personal data on our behalf, we require appropriate contractual and data protection arrangements.
Some service providers may also process personal data as independent controllers for their own purposes in accordance with their own privacy policies and applicable terms.
9. International transfers of personal data
Some of our service providers operate globally. As a result, personal data may be processed outside Finland or outside the European Economic Area.
Where personal data is transferred outside the EEA, appropriate transfer mechanisms and safeguards are used in accordance with applicable data protection legislation.
Depending on the service provider and the circumstances, these safeguards may include:
an adequacy decision adopted by the European Commission
the EU–US Data Privacy Framework
European Commission Standard Contractual Clauses
other transfer mechanisms permitted under applicable data protection legislation.
Squarespace states that data may be processed globally, including in the United States, and that it uses the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses as transfer mechanisms. Squarespace
We assess the data protection arrangements of the service providers we use and apply appropriate safeguards where required.
10. Security of personal data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful loss, disclosure, alteration and other inappropriate processing.
Depending on the system and processing activity, these measures may include:
access control based on work responsibilities
authentication and user access management
encryption and secure communications
managed devices and technical security controls
backups and business continuity measures
security monitoring and incident management
contractual and security requirements for service providers
personnel instructions, training and awareness measures.
Access to personal data is limited to persons who need the information for their work.
11. Website, cookies and analytics
Cookies
Our website uses cookies and similar technologies.
Some cookies are necessary for the website to function properly. Other cookies, such as analytics and marketing cookies, are used only in accordance with the choices you make through our cookie banner where consent is required.
You can accept or decline non-essential cookies through the cookie banner. Where cookie preference controls are available, you can also use them to change your choices later.
Blocking certain cookies may affect some optional website functionality.
Google Analytics
Where enabled and consented to, we use Google Analytics to understand how our website is used and to improve its content, functionality and user experience.
Google Analytics may process information such as:
pages and sessions
approximate geographical information
browser and device information
website interaction information
pseudonymous identifiers stored in cookies.
For Google Analytics 4, Google states that IP addresses are used during collection to determine approximate location information and are discarded before the data is logged in Analytics. For users in the EU, Switzerland and the United Kingdom, Google states that IP addresses are not logged or stored by Google Analytics. Google Help
Google Analytics is activated only where the applicable consent requirements have been met.
Further information is available in Google's Privacy Policy.
LinkedIn Insight Tag
With your consent to marketing cookies, we use the LinkedIn Insight Tag to measure the effectiveness of our LinkedIn advertising and recruitment campaigns, understand how visitors interact with our website and, where applicable, create website audiences for LinkedIn advertising.
The LinkedIn Insight Tag is not activated before consent to marketing cookies has been given through our website's cookie settings.
When active, the LinkedIn Insight Tag may collect information including:
the page URL
referring website
IP address
browser and device characteristics
timestamp.
LinkedIn's Website Actions functionality may also process limited information about website interactions, such as page visits, button clicks and form submissions. LinkedIn states that this may include information such as button text, page name, the type of action performed and a session-specific identifier. LinkedIn
LinkedIn provides CFE Finland with aggregated reporting and advertising performance information and does not provide us with personal data identifying individual LinkedIn members through these reports. LinkedIn
LinkedIn states that direct identifiers associated with Insight Tag data are removed within seven days and that the remaining pseudonymised data is deleted within 180 days. LinkedIn
The LinkedIn Insight Tag may also be used for website retargeting, meaning that users who have visited our website may be included in audiences used for LinkedIn advertising, subject to the user's consent and LinkedIn account settings. LinkedIn
Further information is available in LinkedIn's Privacy Policy and Cookie Policy.
12. Recruitment and job applications
If you apply for a position at CFE Finland or otherwise contact us regarding employment opportunities, we process the personal data you provide for recruitment purposes.
This may include:
name and contact information
CV or LinkedIn profile
education and employment history
professional skills and qualifications
information about your interests and preferred roles
information provided in interviews and other recruitment communications
other information voluntarily provided in connection with the application.
Recruitment information is used to assess suitability for the relevant role, communicate with applicants and manage the recruitment process.
Please do not provide unnecessary sensitive personal data in your application.
Applications and recruitment enquiries may be sent to:
13. Direct marketing
We may send business-to-business communications and marketing to existing or prospective business contacts where permitted by applicable law and where we have an appropriate legal basis for doing so.
You may object to direct marketing at any time.
Where marketing or advertising activities require consent, such as the use of marketing cookies on our website, the activity is carried out only after the required consent has been obtained.
We do not sell personal data to third parties for their own marketing purposes.
14. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, services, systems, service providers or applicable legal requirements change.
The current version is always available on our website.
The date of the latest update is shown at the beginning of this Privacy Policy.