Data Protection at Fondia

In principle, our customers are companies. In order to be able to provide our services and communicate with the customer organization, we collect your personal data as the contact person of our customer. Such personal data includes your name, email address and phone number, as well as your position in the organization.

To carry out assignments, we sometimes have to process the data of persons who are not our customer's contact persons but are related to the assignment in some other way. Such parties may be, for example, employees, customers, contractual partners or shareholders of the customer who has given us the assignment. In dispute resolution matters, we may also process the personal data of counterparties or persons otherwise involved (such as a witness) in the matter. The data typically consists of names and contact information, as well as descriptions of events or circumstances relevant to the assignment. The data will only be processed to the extent necessary to carry out the assignment.

Fondia also has a legal obligation to know its customers. More information about the process for potential and existing customers can be found in the "Know Your Customer (KYC) Process " section.

Purpose and legal basis for processing

We process personal data related to the customer relationship

• to manage the customer relationship

• to carry out assignments

• to ensure quality and to develop our services and business

• for customer surveys and other customer communications

• for invoicing.

The processing is based on our legitimate interest in ensuring the continuity of our business, the execution of assignments and customer management. In addition, we process data for accounting purposes based on a legal obligation.

If you are our customer exceptionally as a private person, the processing is also based on the performance of the contract.

Data Sources

We collect your personal data as the contact person of our customer directly from you or from our other contact persons working in the same organization as you. In principle, the data of other persons involved in assignments is collected from our customer.

We may also collect data from public registers, such as the Trade Register, or from authorities such as courts, if required by the assignment.

Disclosures of Data

Carrying out an assignment may require disclosing data to authorities such as courts.

Retention periods

As a rule, personal data related to assignments is stored for ten years, which is the recommendation issued by the Finnish Bar Association. 

In principle, our customers are companies. In order to be able to provide our services and communicate with the customer organization, we collect your personal data as the contact person of our customer. Such personal data includes your name, email address and phone number, as well as your position in the organization.

To carry out assignments, we sometimes have to process the data of persons who are not our customer's contact persons but are related to the assignment in some other way. Such parties may be, for example, employees, customers, contractual partners or shareholders of the customer who has given us the assignment. In dispute resolution matters, we may also process the personal data of counterparties or persons otherwise involved (such as a witness) in the matter. The data typically consists of names and contact information, as well as descriptions of events or circumstances relevant to the assignment. The data will only be processed to the extent necessary to carry out the assignment.

Fondia also has a legal obligation to know its customers. More information about the process for potential and existing customers can be found in the "Know Your Customer (KYC) Process " section.

Purpose and legal basis for processing

We process personal data related to the customer relationship

• to manage the customer relationship

• to carry out assignments

• to ensure quality and to develop our services and business

• for customer surveys and other customer communications

• for invoicing.

The processing is based on our legitimate interest in ensuring the continuity of our business, the execution of assignments and customer management. In addition, we process data for accounting purposes based on a legal obligation.

If you are our customer exceptionally as a private person, the processing is also based on the performance of the contract.

Data Sources

We collect your personal data as the contact person of our customer directly from you or from our other contact persons working in the same organization as you. In principle, the data of other persons involved in assignments is collected from our customer.

We may also collect data from public registers, such as the Trade Register, or from authorities such as courts, if required by the assignment.

Disclosures of Data

Carrying out an assignment may require disclosing data to authorities such as courts.

Retention periods

As a rule, personal data related to assignments is stored for ten years, which is the recommendation issued by the Finnish Bar Association. 

KYC, or "Know Your Customer", is a customer identification process that we use to collect information about organizations before forming a customer relationship. The information is also updated and collected during the customer relationship as part of the continuous customer due diligence required by the Anti-Money Laundering Directive.

As a representative of your organization, we ask you to fill in a form and identify yourself in order to obtain information about the organization itself, but also personal data about the organization’s representatives, beneficial owners, responsible persons (if the company has no beneficial owners) and politically exposed persons. Some of the information is automatically added to the form from other sources, in which case the accuracy of the information must be confirmed.

In connection with the KYC process, we collect the following information:

Organizations

• Name

• Business ID

• Address

• Country

• When the organization was established

• Business form

• Industry

• Does the organization have business or customers outside the EU/EEA

• Does the organization do business or have customers in countries classified as high risk by the FATF (Financial Action Task Force) or the EU

• Does one or more persons have more than 25% ownership or voting rights in the entity and, if not, what is the role of the beneficiaries

• Has the representative/beneficiary or a member of the family or a partner of such a person held a public office of major importance during the past year

• Risk rating

• Possible other information such as origin of funds

Representatives of the Organization

• Name

• E-mail address

• Personal identification number

• Citizenship

Politically Exposed Persons ("PEPs")

• Name

• Date of birth

• Nationality

Ultimate Beneficial Owners

• Name

• Nationality

• Country of residence

• Date of birth

• Ownership / voting rights

Responsible persons (if the organization has no beneficial owners)

• Name

• Role

• Nationality

• Country of residence

• Date of birth

As part of the KYC process, we audit organizations and their representatives (such as the CEO, board members, and beneficial owners) using a variety of national and international sanctions lists, as well as government sources. These include freezing orders issued by the Finnish National Bureau of Investigation, EU financial sanctions and sectoral sanctions, sanctions imposed by the UN Security Council, the UK Sanctions List maintained by the UK OFSI (HM Treasury) and the Consolidated List maintained by the US International Trade Administration/Bureau of Industry and Security. These sources are used to ensure that the organization or its representatives are not subject to sanctions or otherwise on the authorities' watchlists before the customer relationship is started or continued.

In addition, we review the U.S. OFAC SDN and Non-SDN lists (except for Fondia Sweden). The Office of Foreign Assets Control ("OFAC") of the US Department of the Treasury, administers and enforces economic and trade sanctions based on US foreign policy and national security objectives. These sanctions target specific states and regimes, terrorists, international drug traffickers, individuals involved in proliferation-related activities, and other threats to US national security, foreign policy, or the economy.

Our customers are mainly businesses. If you are, however, our customer as an individual, we collect your name, social security number, address and whether you are a PEP. We may also check credit information. In addition, if we cannot identify you electronically, we may need to ask for a copy of identification. We will save the number of the identity document, issuer, date of birth, social security number and nationality.

Purpose of Processing

The purpose of processing personal data related to the KYC process is

• preventing, detecting and investigating money laundering and terrorist financing

• investigating money laundering and terrorist financing and the offence by which the property or the proceeds of the money laundering or terrorist financing were obtained

• implementation of sanctions-related obligations

• business risk assessment.

Legal Basis

Processing personal data is based on a legal obligation, based on the following provisions:

Finland

• Money Laundering Act (444/2017)

• EU sanction regulations

• Act on the fulfilment of certain obligations of Finland as a member of the United Nations and the European Union (659/1967)

• Other national administrative decisions related to sanctions

Sweden

• Act (2017:630) on measures against money laundering and financing of terrorism

• Act (1996:95) regarding certain International Sanctions

Estonia

• Money Laundering and Terrorist Financing Prevention Act

• International Sanctions Act

Lithuania

• Law on the Prevention of Money Laundering and Terrorist Financing

• Law on the Implementation of Economic and other International Sanctions

Processing is also based on Fondia's legitimate interest in comprehensively managing business risks.

Data Sources

In principle, we obtain the personal data processed in the KYC process from official sources, such as the Trade Register of the National Board of Patents and Registration and credit information systems. Where necessary, we also obtain background information from other public sources to verify the identity and background of our customers and persons related to their business, such as the CEO and members of the Board of Directors.

We obtain personal data about a company representative from the person himself/herself.

Retention periods

We store KYC related personal data in accordance with the Anti-Money Laundering Directive for at least five (5) years after the end of business relationship.

KYC, or "Know Your Customer", is a customer identification process that we use to collect information about organizations before forming a customer relationship. The information is also updated and collected during the customer relationship as part of the continuous customer due diligence required by the Anti-Money Laundering Directive.

As a representative of your organization, we ask you to fill in a form and identify yourself in order to obtain information about the organization itself, but also personal data about the organization’s representatives, beneficial owners, responsible persons (if the company has no beneficial owners) and politically exposed persons. Some of the information is automatically added to the form from other sources, in which case the accuracy of the information must be confirmed.

In connection with the KYC process, we collect the following information:

Organizations

• Name

• Business ID

• Address

• Country

• When the organization was established

• Business form

• Industry

• Does the organization have business or customers outside the EU/EEA

• Does the organization do business or have customers in countries classified as high risk by the FATF (Financial Action Task Force) or the EU

• Does one or more persons have more than 25% ownership or voting rights in the entity and, if not, what is the role of the beneficiaries

• Has the representative/beneficiary or a member of the family or a partner of such a person held a public office of major importance during the past year

• Risk rating

• Possible other information such as origin of funds

Representatives of the Organization

• Name

• E-mail address

• Personal identification number

• Citizenship

Politically Exposed Persons ("PEPs")

• Name

• Date of birth

• Nationality

Ultimate Beneficial Owners

• Name

• Nationality

• Country of residence

• Date of birth

• Ownership / voting rights

Responsible persons (if the organization has no beneficial owners)

• Name

• Role

• Nationality

• Country of residence

• Date of birth

As part of the KYC process, we audit organizations and their representatives (such as the CEO, board members, and beneficial owners) using a variety of national and international sanctions lists, as well as government sources. These include freezing orders issued by the Finnish National Bureau of Investigation, EU financial sanctions and sectoral sanctions, sanctions imposed by the UN Security Council, the UK Sanctions List maintained by the UK OFSI (HM Treasury) and the Consolidated List maintained by the US International Trade Administration/Bureau of Industry and Security. These sources are used to ensure that the organization or its representatives are not subject to sanctions or otherwise on the authorities' watchlists before the customer relationship is started or continued.

In addition, we review the U.S. OFAC SDN and Non-SDN lists (except for Fondia Sweden). The Office of Foreign Assets Control ("OFAC") of the US Department of the Treasury, administers and enforces economic and trade sanctions based on US foreign policy and national security objectives. These sanctions target specific states and regimes, terrorists, international drug traffickers, individuals involved in proliferation-related activities, and other threats to US national security, foreign policy, or the economy.

Our customers are mainly businesses. If you are, however, our customer as an individual, we collect your name, social security number, address and whether you are a PEP. We may also check credit information. In addition, if we cannot identify you electronically, we may need to ask for a copy of identification. We will save the number of the identity document, issuer, date of birth, social security number and nationality.

Purpose of Processing

The purpose of processing personal data related to the KYC process is

• preventing, detecting and investigating money laundering and terrorist financing

• investigating money laundering and terrorist financing and the offence by which the property or the proceeds of the money laundering or terrorist financing were obtained

• implementation of sanctions-related obligations

• business risk assessment.

Legal Basis

Processing personal data is based on a legal obligation, based on the following provisions:

Finland

• Money Laundering Act (444/2017)

• EU sanction regulations

• Act on the fulfilment of certain obligations of Finland as a member of the United Nations and the European Union (659/1967)

• Other national administrative decisions related to sanctions

Sweden

• Act (2017:630) on measures against money laundering and financing of terrorism

• Act (1996:95) regarding certain International Sanctions

Estonia

• Money Laundering and Terrorist Financing Prevention Act

• International Sanctions Act

Lithuania

• Law on the Prevention of Money Laundering and Terrorist Financing

• Law on the Implementation of Economic and other International Sanctions

Processing is also based on Fondia's legitimate interest in comprehensively managing business risks.

Data Sources

In principle, we obtain the personal data processed in the KYC process from official sources, such as the Trade Register of the National Board of Patents and Registration and credit information systems. Where necessary, we also obtain background information from other public sources to verify the identity and background of our customers and persons related to their business, such as the CEO and members of the Board of Directors.

We obtain personal data about a company representative from the person himself/herself.

Retention periods

We store KYC related personal data in accordance with the Anti-Money Laundering Directive for at least five (5) years after the end of business relationship.

You can contact us through our website using the chatbot provided by Leadoo, using the contact form or by booking an appointment in our calendar through Calendly. In addition to your name and contact information, we collect information about your legal needs that you would like to discuss with us. Please note that unnecessary information about your private life should not be revealed through these forms. We use the personal data mentioned above to contact you and to assess how we can best be of assistance.

Through the form available on the investor pages, you can also subscribe to releases on Fondia's company releases, press releases, managers' transactions, flagging notifications and share repurchases. For this purpose, we collect your email address, information about which of the above-mentioned bulletins you want to subscribe to and in which language you want to receive the bulletins.

Legal Basis for Processing

The processing of your personal data collected through our website is based on your consent.

Data Sources

We receive the information from you when you contact us via our website.

Retention Periods

If we start an assignment with you, your data will be processed based on customer relationship. For more information on such processing, please see the section "Assignments " below. If no assignment is started, we will store the personal data you provide us with for direct marketing purposes. For more information on the processing of personal data for direct marketing purposes, please see "Direct Marketing, Newsletters and Other Communication" below.

We will store the information provided in the order form on our investor pages for as long as you wish to receive such bulletins from us. You can unsubscribe at any time free of charge. If you unsubscribe from newsletters, we will retain your email address so that we can honor your wish not to receive newsletters.

Cookies

We use cookies on our website. Our Cookie Policy describes for what purposes and how we use cookies. You can give or withdraw your consent to the use of cookies at any time. You can see the general cookie settings at the bottom of the page under "Cookie settings ". More details on individual cookies can be found by clicking "Storage preferences " on the cookie popup window.

We use cookies to carry out profiling to the extent that you have given your consent to the use of analytics cookies. 

You can contact us through our website using the chatbot provided by Leadoo, using the contact form or by booking an appointment in our calendar through Calendly. In addition to your name and contact information, we collect information about your legal needs that you would like to discuss with us. Please note that unnecessary information about your private life should not be revealed through these forms. We use the personal data mentioned above to contact you and to assess how we can best be of assistance.

Through the form available on the investor pages, you can also subscribe to releases on Fondia's company releases, press releases, managers' transactions, flagging notifications and share repurchases. For this purpose, we collect your email address, information about which of the above-mentioned bulletins you want to subscribe to and in which language you want to receive the bulletins.

Legal Basis for Processing

The processing of your personal data collected through our website is based on your consent.

Data Sources

We receive the information from you when you contact us via our website.

Retention Periods

If we start an assignment with you, your data will be processed based on customer relationship. For more information on such processing, please see the section "Assignments " below. If no assignment is started, we will store the personal data you provide us with for direct marketing purposes. For more information on the processing of personal data for direct marketing purposes, please see "Direct Marketing, Newsletters and Other Communication" below.

We will store the information provided in the order form on our investor pages for as long as you wish to receive such bulletins from us. You can unsubscribe at any time free of charge. If you unsubscribe from newsletters, we will retain your email address so that we can honor your wish not to receive newsletters.

Cookies

We use cookies on our website. Our Cookie Policy describes for what purposes and how we use cookies. You can give or withdraw your consent to the use of cookies at any time. You can see the general cookie settings at the bottom of the page under "Cookie settings ". More details on individual cookies can be found by clicking "Storage preferences " on the cookie popup window.

We use cookies to carry out profiling to the extent that you have given your consent to the use of analytics cookies. 

Direct marketing

If you work for an organization that is a potential customer of ours and you work in a position to which our services are intrinsically related, we may target you with direct marketing by email or phone. In addition, we may contact you for direct marketing purposes if you have participated in our event.

For direct marketing, we collect your name, organization name, work email address, work phone number and title. The purpose of processing this data of yours is to market our events and services for customer acquisition and the processing is based on our legitimate interest in ensuring the continuity of our business and customer acquisition and to market our services.

If you have opted out of direct marketing, we will store your name and contact information, as well as information about the objection, so that we can respect your right to object to the processing of your personal data for direct marketing purposes.

Newsletters

We regularly send newsletters in which we inform you about current issues. If you wish, you can subscribe to our newsletter, e.g. through our website or when registering in MyFondia. In addition, we may send the newsletter to you if you follow Fondia on LinkedIn. For this purpose, we collect your name and email address as well as the name of your organization in order to deliver our newsletter.

Regarding the newsletters you have subscribed to, the processing is based on your consent. You can withdraw your consent or refuse to receive direct marketing free of charge at any time. If you receive our newsletter due to following us on LinkedIn, the processing is based on our legitimate interest in ensuring the continuity of our business and customer acquisition and to market our services.

Customer communication

We regularly send LDaaS customer letters in which we inform of current issues that may affect your organization's business.

If your organization is a Fondia LDaaS customer and you have been granted access to your organization’s MyFondia environment, we may send you messages by email that are part of the service. Such messages include, for example, notifications from the Legal Monitoring service included in the LDaaS service, in which we inform you about current topics, such as changes in legislation, that may affect your operations and thus require action.

The purpose of customer communication is to inform our customers of the changing legislation and requirements and the processing is based on our legitimate interest in maintaining the customer relationship. You can read more about the processing of customer data by us in the section "assignments" of this policy.

Data Sources

We receive the data from you when you subscribe to our newsletter, register for our event, register for MyFondia or contact us, for example, by email or through the forms on our website.

We may also receive your data from another representative of your organization if they grant you access to MyFondia (LDaaS customers).

In addition, we receive information from contact service providers.

Retention Periods

We store personal data processed for direct marketing for as long as it is relevant to send direct marketing to the organization you represent. We delete the data when we no longer need it or when you request the deletion of your personal data processed for marketing purposes.

The personal data processed for the purpose of sending the newsletter will be stored for as long as you wish to receive the newsletters from us. You can unsubscribe from the newsletter at any time free of charge.

You can read more about the storage periods of personal data related to customer relationships in the section "assignments".

Direct marketing

If you work for an organization that is a potential customer of ours and you work in a position to which our services are intrinsically related, we may target you with direct marketing by email or phone. In addition, we may contact you for direct marketing purposes if you have participated in our event.

For direct marketing, we collect your name, organization name, work email address, work phone number and title. The purpose of processing this data of yours is to market our events and services for customer acquisition and the processing is based on our legitimate interest in ensuring the continuity of our business and customer acquisition and to market our services.

If you have opted out of direct marketing, we will store your name and contact information, as well as information about the objection, so that we can respect your right to object to the processing of your personal data for direct marketing purposes.

Newsletters

We regularly send newsletters in which we inform you about current issues. If you wish, you can subscribe to our newsletter, e.g. through our website or when registering in MyFondia. In addition, we may send the newsletter to you if you follow Fondia on LinkedIn. For this purpose, we collect your name and email address as well as the name of your organization in order to deliver our newsletter.

Regarding the newsletters you have subscribed to, the processing is based on your consent. You can withdraw your consent or refuse to receive direct marketing free of charge at any time. If you receive our newsletter due to following us on LinkedIn, the processing is based on our legitimate interest in ensuring the continuity of our business and customer acquisition and to market our services.

Customer communication

We regularly send LDaaS customer letters in which we inform of current issues that may affect your organization's business.

If your organization is a Fondia LDaaS customer and you have been granted access to your organization’s MyFondia environment, we may send you messages by email that are part of the service. Such messages include, for example, notifications from the Legal Monitoring service included in the LDaaS service, in which we inform you about current topics, such as changes in legislation, that may affect your operations and thus require action.

The purpose of customer communication is to inform our customers of the changing legislation and requirements and the processing is based on our legitimate interest in maintaining the customer relationship. You can read more about the processing of customer data by us in the section "assignments" of this policy.

Data Sources

We receive the data from you when you subscribe to our newsletter, register for our event, register for MyFondia or contact us, for example, by email or through the forms on our website.

We may also receive your data from another representative of your organization if they grant you access to MyFondia (LDaaS customers).

In addition, we receive information from contact service providers.

Retention Periods

We store personal data processed for direct marketing for as long as it is relevant to send direct marketing to the organization you represent. We delete the data when we no longer need it or when you request the deletion of your personal data processed for marketing purposes.

The personal data processed for the purpose of sending the newsletter will be stored for as long as you wish to receive the newsletters from us. You can unsubscribe from the newsletter at any time free of charge.

You can read more about the storage periods of personal data related to customer relationships in the section "assignments".

When you sign up for the events we organize, we collect the following information from you:

• First name

• Last name

• Email address

• Mobile phone number (optional)

• Company/organization

• Business ID

• Title.

In addition, we ask whether the organization you represent is a Fondia LDaaS customer and how you heard about our event.

We may also photograph our events and post photos on our social media channels. It is possible that some of the photos show recognizable people participating in our events. We will inform you of photographing at the event with signs. You can prohibit us from photographing and publishing photos where you are identifiable at any time.

Purpose and Legal Basis for Processing

We collect the information we ask for on the notification form to organize and carry out events. The processing of data is based on our legitimate interest in organizing events.

We may also use your contact information to market our upcoming events and services to you. The use of your contact information for marketing purposes is based on our legitimate interest in marketing our events and ensuring the continuity of our business.

Taking photos at the event and publishing them on our social media channels is also based on our legitimate interest in marketing our services.

Data Sources

The information will be collected from you on the registration form.

Disclosures of Data

We may organize events together with our partners, in which case these partners act as independent data controllers and not as processors of personal data on our behalf. In this case, we may disclose to them the personal data necessary for the organization of the event.

Retention Periods

We store contact information for the marketing of future events for as long as it is relevant for direct marketing.

We will delete the personal data processed for marketing purposes when we no longer need it or when you request deletion. Other data will be deleted after the event has ended.

We store photos from our events until further notice. You may ask for the deletion of photos in which you appear recognizably at any time.

When you sign up for the events we organize, we collect the following information from you:

• First name

• Last name

• Email address

• Mobile phone number (optional)

• Company/organization

• Business ID

• Title.

In addition, we ask whether the organization you represent is a Fondia LDaaS customer and how you heard about our event.

We may also photograph our events and post photos on our social media channels. It is possible that some of the photos show recognizable people participating in our events. We will inform you of photographing at the event with signs. You can prohibit us from photographing and publishing photos where you are identifiable at any time.

Purpose and Legal Basis for Processing

We collect the information we ask for on the notification form to organize and carry out events. The processing of data is based on our legitimate interest in organizing events.

We may also use your contact information to market our upcoming events and services to you. The use of your contact information for marketing purposes is based on our legitimate interest in marketing our events and ensuring the continuity of our business.

Taking photos at the event and publishing them on our social media channels is also based on our legitimate interest in marketing our services.

Data Sources

The information will be collected from you on the registration form.

Disclosures of Data

We may organize events together with our partners, in which case these partners act as independent data controllers and not as processors of personal data on our behalf. In this case, we may disclose to them the personal data necessary for the organization of the event.

Retention Periods

We store contact information for the marketing of future events for as long as it is relevant for direct marketing.

We will delete the personal data processed for marketing purposes when we no longer need it or when you request deletion. Other data will be deleted after the event has ended.

We store photos from our events until further notice. You may ask for the deletion of photos in which you appear recognizably at any time.

As a representative of our partners (e.g. service providers), we process your personal data to manage the cooperation, and implement the agreement, as well as for invoicing. Such personal data includes, for example, name, title, email address and phone number, as well as any billing-related information.

Legal Basis for Processing

Processing is based on our legitimate interest in ensuring business continuity. If you are our co-operation partner as a legal person, processing is based on performance of the contract. In addition, we process data for accounting purposes based on a legal obligation.

Data Sources

The information is collected from you, as a representative of our partner, and from our partner.

Retention periods

We store personal data for as long as necessary for cooperation. We store the personal data necessary for accounting purposes for as long as we are obligated by law.

As a representative of our partners (e.g. service providers), we process your personal data to manage the cooperation, and implement the agreement, as well as for invoicing. Such personal data includes, for example, name, title, email address and phone number, as well as any billing-related information.

Legal Basis for Processing

Processing is based on our legitimate interest in ensuring business continuity. If you are our co-operation partner as a legal person, processing is based on performance of the contract. In addition, we process data for accounting purposes based on a legal obligation.

Data Sources

The information is collected from you, as a representative of our partner, and from our partner.

Retention periods

We store personal data for as long as necessary for cooperation. We store the personal data necessary for accounting purposes for as long as we are obligated by law.

We process the following information about you as a job applicant in connection with the recruitment process:

• Basic information such as name, date of birth, language.

• Contact details such as email address, phone number.

• Information related to the position you are applying for, such as information on the form and type of employment, salary request and information related to starting.

• Information relevant for suitability and other information about your background, such as a photograph, information related to your studies and training, employment history (such as employers, start and duration of employment, type of work), language skills, other special skills, description of personal qualities, certificates and assessments, references to portfolios, profiles or other sources found on the Internet, references, and the results of a personal or aptitude assessment carried out with your consent and other information.

• Information about the recruitment process, such as information about a follow-up interview or interruption of the recruitment process.

• Other information that you have voluntarily provided in connection with the job application process or otherwise explicitly published for professional purposes (such as your LinkedIn profile).

• Providing this information is a prerequisite for the recruitment process.

Purpose and Legal Basis for Processing

The purpose of the data processing is to receive and process job applications and to manage our recruitment processes. The information allows us to communicate with applicants and make decisions when filling open positions.

For the person selected for the position, the processing is based on precontractual measures taken at the request of the data subject. For other job applicants, the processing is based on our legitimate interest in carrying out the recruitment process.

Regarding personal or suitability assessments and information received from references, the processing is based on your consent. You can withdraw your consent, but in this case, we will not be able to continue recruiting on your behalf.

Profiling

In connection with recruitment, we carry out profiling when we assess your suitability and qualifications for the position you are applying for. The purpose of profiling is therefore to help us find a suitable employee for the available position. However, profiling does not include fully automated decision-making, but our HR experts always assess suitability and make decisions based on personal and aptitude assessments.

Data Sources

As a rule, we only process data that you provide to us in connection with the recruitment process. We may also collect information from your referrals and social media profiles.

We also use external recruitment consultants who search for potential employees on our behalf.

Retention Periods

We store the data for two (2) years after the end of the recruitment process. The retention period is based on the period of action under the Non-Discrimination Act.

We process the following information about you as a job applicant in connection with the recruitment process:

• Basic information such as name, date of birth, language.

• Contact details such as email address, phone number.

• Information related to the position you are applying for, such as information on the form and type of employment, salary request and information related to starting.

• Information relevant for suitability and other information about your background, such as a photograph, information related to your studies and training, employment history (such as employers, start and duration of employment, type of work), language skills, other special skills, description of personal qualities, certificates and assessments, references to portfolios, profiles or other sources found on the Internet, references, and the results of a personal or aptitude assessment carried out with your consent and other information.

• Information about the recruitment process, such as information about a follow-up interview or interruption of the recruitment process.

• Other information that you have voluntarily provided in connection with the job application process or otherwise explicitly published for professional purposes (such as your LinkedIn profile).

• Providing this information is a prerequisite for the recruitment process.

Purpose and Legal Basis for Processing

The purpose of the data processing is to receive and process job applications and to manage our recruitment processes. The information allows us to communicate with applicants and make decisions when filling open positions.

For the person selected for the position, the processing is based on precontractual measures taken at the request of the data subject. For other job applicants, the processing is based on our legitimate interest in carrying out the recruitment process.

Regarding personal or suitability assessments and information received from references, the processing is based on your consent. You can withdraw your consent, but in this case, we will not be able to continue recruiting on your behalf.

Profiling

In connection with recruitment, we carry out profiling when we assess your suitability and qualifications for the position you are applying for. The purpose of profiling is therefore to help us find a suitable employee for the available position. However, profiling does not include fully automated decision-making, but our HR experts always assess suitability and make decisions based on personal and aptitude assessments.

Data Sources

As a rule, we only process data that you provide to us in connection with the recruitment process. We may also collect information from your referrals and social media profiles.

We also use external recruitment consultants who search for potential employees on our behalf.

Retention Periods

We store the data for two (2) years after the end of the recruitment process. The retention period is based on the period of action under the Non-Discrimination Act.

MyFondia is a platform maintained by us, which offers tools for e.g. mapping the legal needs of the organization. Some of MyFondia's functions require registration.

Without registering, you can read the contents of the Legal Insights legal database in MyFondia. In this case, no personal data will be collected about you except for the cookies you allow. The use of cookies on our website (incl. MyFondia) is described in our Cookie Policy.

As a registered self-service user, you will also have access to the Legal Health Check tool to map the legal needs of the organization you represent, as well as AI Lawyer (in Finland), which is an AI-based tool.

As an LDaaS customer, you can also view documentation related to your organization's assignments in MyFondia if your organization has taken the platform into use and you have permissions to view the contents. You can find out more about the processing of personal data related to the customer relationship under "Assignments ".

Data Processed, Purpose and Legal Basis of Processing

To be able to use the tools that require registration as a self-service user in MyFondia, we collect your first name, last name, email address and the name of the organization you represent. The purpose of processing this data is to enable the use of our services, taking care of the customer relationship and for the self-service users, direct marketing.

The legal basis for processing is our legitimate interest in ensuring the continuity of our business and maintaining and managing our customer relationship.

In addition, we process your personal data as a self-service user for direct marketing based on your consent, which we request at the time of registration. More information about our direct marketing can be found in the section "Direct Marketing and Newsletters ".

Data Sources

We receive information primarily from you when you register for the service.

We may also receive your data from another representative of your organization if they grant you access to MyFondia (LDaaS customers).

Retention Periods

The data provided during registration will be stored for as long as the registration is valid. You can stop using the service at any time, in which case your data will be deleted.

MyFondia is a platform maintained by us, which offers tools for e.g. mapping the legal needs of the organization. Some of MyFondia's functions require registration.

Without registering, you can read the contents of the Legal Insights legal database in MyFondia. In this case, no personal data will be collected about you except for the cookies you allow. The use of cookies on our website (incl. MyFondia) is described in our Cookie Policy.

As a registered self-service user, you will also have access to the Legal Health Check tool to map the legal needs of the organization you represent, as well as AI Lawyer (in Finland), which is an AI-based tool.

As an LDaaS customer, you can also view documentation related to your organization's assignments in MyFondia if your organization has taken the platform into use and you have permissions to view the contents. You can find out more about the processing of personal data related to the customer relationship under "Assignments ".

Data Processed, Purpose and Legal Basis of Processing

To be able to use the tools that require registration as a self-service user in MyFondia, we collect your first name, last name, email address and the name of the organization you represent. The purpose of processing this data is to enable the use of our services, taking care of the customer relationship and for the self-service users, direct marketing.

The legal basis for processing is our legitimate interest in ensuring the continuity of our business and maintaining and managing our customer relationship.

In addition, we process your personal data as a self-service user for direct marketing based on your consent, which we request at the time of registration. More information about our direct marketing can be found in the section "Direct Marketing and Newsletters ".

Data Sources

We receive information primarily from you when you register for the service.

We may also receive your data from another representative of your organization if they grant you access to MyFondia (LDaaS customers).

Retention Periods

The data provided during registration will be stored for as long as the registration is valid. You can stop using the service at any time, in which case your data will be deleted.

The premises of Fondia's Helsinki office have recording camera surveillance at the entrances. Therefore, images are recorded of people moving in the area of camera surveillance. In addition to the image, date and time of the events are recorded.

There are signs at the entrances that inform of the camera surveillance.

Purpose and Legal Basis for Processing

The purpose of camera surveillance is to protect property, ensure the safety of the premises and persons moving in the area, prevent vandalism and crime, and help investigate crimes that have already taken place and situations that endanger property and safety.

The processing of personal data is based on our legitimate interest in ensuring security.

Disclosures of Data

In principle, data is only disclosed to the police or other authorities for the purpose of a criminal investigation.

Retention Periods

As a rule, recordings can be processed retroactively for a period of 7 days, after which they are destroyed.

The premises of Fondia's Helsinki office have recording camera surveillance at the entrances. Therefore, images are recorded of people moving in the area of camera surveillance. In addition to the image, date and time of the events are recorded.

There are signs at the entrances that inform of the camera surveillance.

Purpose and Legal Basis for Processing

The purpose of camera surveillance is to protect property, ensure the safety of the premises and persons moving in the area, prevent vandalism and crime, and help investigate crimes that have already taken place and situations that endanger property and safety.

The processing of personal data is based on our legitimate interest in ensuring security.

Disclosures of Data

In principle, data is only disclosed to the police or other authorities for the purpose of a criminal investigation.

Retention Periods

As a rule, recordings can be processed retroactively for a period of 7 days, after which they are destroyed.

We occasionally organize alumni evenings to which we invite our former employees. If you are a former employee of Fondia, we will store your name, email address and phone number so that we can invite you to our alumni events.

Legal Basis for Processing

Processing is based on your consent.

Retention Periods

We store the data for as long as you want to be invited to the alumni evenings. We'll delete your data as soon as you no longer wish to receive invitations.

We occasionally organize alumni evenings to which we invite our former employees. If you are a former employee of Fondia, we will store your name, email address and phone number so that we can invite you to our alumni events.

Legal Basis for Processing

Processing is based on your consent.

Retention Periods

We store the data for as long as you want to be invited to the alumni evenings. We'll delete your data as soon as you no longer wish to receive invitations.