1 Controller
The controller of the register is Faros & Com Oy (business ID 0863068-0)
Contact person for register matters: Jani Sipola, Digital Learning Solutions Specialist
FAROS & COM OY
Address: Linnoitustie 6, Espoo
Tel.: 044 777 0991
E-mail: jani.sipola@faroscom.com
2 Name of the register
The name of the register is Faros & Com Oy:n asiakasrekisteri (‘Faros & Com Oy’s customer register’).
3 Purpose of processing personal data
Personal data is processed for purposes related to the management, administration and development of the customer relationship, the provision and delivery of services, and the development and invoicing of services. Personal data will also be processed for the purposes required for resolving any complaints and other claims.
In addition, personal data is processed in communications directed at customers, such as for information and news reporting purposes, as well as in marketing. Personal data is also processed for purposes relating to direct marketing and digital direct marketing.
In connection with newsletters, information may be collected on the opening of messages, clicks on links and other data relating to the use of newsletters. This information is used to measure the effectiveness of our communications, develop content and improve customer communications.
Customers have the right to opt out of direct marketing targeted at them or to withdraw their previously given consent to digital marketing.
Personal data is also processed for the planning, organisation, participant communication and follow-up of events, webinars, training courses and other similar occasions. Data provided when registering for events is used to organise the event and for communication relating to the event.
The controller processes the data and uses subcontractors acting on behalf and for the account of the controller in the processing of personal data.
4 Legal basis for processing
The legal basis for the processing of personal data is the following grounds in accordance with the EU General Data Protection Regulation (hereinafter also referred to as “GDPR”):
- the data subject has given their consent to the processing of his or her personal data for one or more specific purposes (Article 6(1.a) of the GDPR);
- processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures at the request of the data subject (Article 6 (1.b) of the GDPR);
- processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party (Article 6 (1.f) of the GDPR).
The aforementioned legitimate interest of the controller is based on a meaningful and appropriate relationship between the data subject and the controller, which results from the fact that the data subject is a customer of the controller, and where the processing takes place for purposes which the data subject could reasonably have expected at the time of the collection of the personal data and in the context of the appropriate relationship.
5 Data content of the register (categories of personal data processed)
In principle, the register contains the following personal data on all data subjects:
- basic information and contact details of the person: [first name, last name, telephone number, e-mail address];
- information related to the person’s company or other organization and the position or title of the person in the company or organization;
- a person’s direct marketing authorizations and prohibitions.
- information relating to the subscription to, receipt and use of newsletters, such as subscription details, message opens, link clicks and other information relating to the measurement of communication effectiveness;
- information relating to registration for events, training courses and webinars, such as the participant’s name, contact details, organisation, job title, attendance details and any additional information provided by the participant.
6 Regular sources of data
Personal data is collected from the data subject himself/herself.
Personal data is also collected and updated, within the limits of applicable legislation, from publicly available sources related to the implementation of the customer relationship between the controller and the data subject, and through which the controller carries out its obligations related to the maintenance of customer relationships.
7 Storage period of personal data
Data collected in the register shall be retained only for as long as and to the extent that is necessary in relation to the original or compatible purposes for which the personal data was collected.
The need for storage of personal data is assessed every five years, and in any case the data concerning the data subject is deleted from the register two years after the end of the data subject’s customer relationship with the controller and the obligations and measures related to the customer relationship have been completed. For example, accounting documents are kept for five years after the end of the accounting period.
The controller shall regularly assess the need for storage of data in accordance with its internal policies. In addition, the controller shall take all reasonable steps to ensure that personal data which is inaccurate, erroneous or outdated in relation to the purposes of the processing is erased or rectified without delay.
8 Recipients of personal data (categories of recipients) and regular disclosure of data
The data controller may use reliable service providers and subcontractors to process personal data; these parties process the data on behalf of and for the account of the data controller. Such services may include, for example, services relating to website maintenance, customer relationship management, communications, analytics and marketing.
The website uses analytics and marketing services such as Google Analytics, Google Ads, LinkedIn and Meta’s (Facebook and Instagram) services.
When using these services, data relating to website visitors may be processed in accordance with the privacy policies of the relevant service providers.
Personal data is not sold to third parties.
9 Transfer of data outside the EU or the EEA
Service providers used by the data controller may also process personal data outside the European Union or the European Economic Area. In such cases, transfers of personal data are carried out in accordance with the data protection legislation in force at the time and using appropriate safeguards.
The data controller endeavours to ensure that the processing of personal data complies with the requirements of European Union data protection legislation, regardless of where the data is processed.
10 Principles of protection of the register
Materials containing personal data are stored in locked premises, which are accessible only to designated persons authorized to access them for their tasks.
The database containing personal data is stored on a server, which is stored in a locked space, which is accessible only to designated persons authorized to access it for their tasks. The server is protected by an appropriate firewall and technical protection.
Databases and systems can only be accessed with individually granted personal user IDs and passwords. The controller has limited any access rights and permissions to information systems and other storage platforms in such a way that only persons necessary for their lawful processing can access and process the data. In addition, database and system access events are registered in the controller’s IT system log data.
The data controller’s employees and other persons are committed to complying with the confidentiality obligation and to keep the information they receive in connection with the processing of personal data confidential.
11 Rights of the data subject
The data subject has the following rights under the EU General Data Protection Regulation:
- the right to obtain confirmation from the controller that personal data concerning him or her are being processed or are not being processed, and, where such personal data are being processed, the right to have access to personal data and the following data: (i) the purposes of the processing; (ii) the categories of personal data concerned; (iii) the recipients or categories of recipients to whom the personal data have been or are to be disclosed; (iv) the planned storage period of personal data, where possible, or, if this is not possible, the criteria for determining this period; (v) the right of the data subject to request the controller to rectify or erase personal data concerning him or her or to restrict or object to the processing of personal data concerning him or her; (vi) the right to lodge a complaint with the supervisory authority; (vii) where personal data are not collected from the data subject, all available information on the origin of the data (Article 15 of the GDPR).
- the right to withdraw consent at any time without prejudice to the lawfulness of the processing carried out on the basis of that consent prior to its withdrawal (Article 7 of the GDPR);
- the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data relating to the data subject and the right to have incomplete personal data completed, including by means of providing an additional statement, taking into account the purposes for which the data were processed (Article 16 of the GDPR);
- the right to have personal data erased by the controller without undue delay, provided that (i) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (ii) the data subject withdraws the consent on which the processing was based and there is no other legitimate reason for the processing; (iii) the data subject objects to the processing on the basis of a specific personal situation and there is no legitimate reason for or the data subject opposes the processing for the purposes of direct marketing; (iv) the personal data have been processed unlawfully; or (v) the personal data must be erased in order to comply with a legal obligation imposed on the controller by Union or national law (Article 17 of the GDPR);
- the right to obtain from the controller restriction of processing where one of the following applies: (i) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (iii) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; or (iv) the data subject has objected to the processing of the personal data on the basis of his or her particular situation, pending verification of whether the data controller’s legitimate grounds prevail over those of the data subject (Article 18 of the GDPR);
- the right to obtain personal data concerning him or her which the data subject has provided to the controller in a structured, commonly used and machine-readable format, and the right to transfer such data to another controller without hindrance from the controller to whom the personal data have been provided, where the processing is based on consent within the meaning of the Regulation and is carried out automatically (Article 20 of the GDPR);
- the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data concerning him or her is in breach of the EU General Data Protection Regulation (Article 77 of the GDPR).
Requests for the exercise of the rights of the data subject shall be addressed to the contact person of the controller mentioned in section 1.
12 Google reCAPTCHA authentication
Our site is protected by Google’s reCAPTCHA authentication.
Google’s Privacy Policy
Google Terms of Service
13 Web analytics
The website uses analytics and marketing technologies to improve the website’s functionality, user experience and marketing.
The services used may include, for example:
- Google Tag Manager
- Google Analytics
- Google Ads
These services enable us to collect information on, for example, website usage, visitor numbers, traffic sources, actions taken on the site and the effectiveness of our marketing. The data is used to develop the website, improve services and target marketing and communications.
Analytics and marketing cookies are only activated once the user has given their consent via the cookie banner.
14 Targeted marketing
The website uses marketing technologies that enable content and advertising tailored to visitors’ interests to be displayed across various services.
Targeted marketing can be carried out, for example, on the following services:
Information about the user’s visit to the website, the pages they have viewed and other actions taken on the website may be used for targeted marketing.
Targeted marketing is carried out solely on the basis of the user’s consent.
15 Cookies and managing cookies
This website uses cookies and similar technologies to ensure the website functions properly, to improve the user experience, for analytics and for targeted marketing.
Users can manage their cookie settings via the website’s cookie banner. Users can accept or reject non-essential cookies and change their consent at a later date via the cookie settings.
Essential cookies are necessary for the website to function and cannot be disabled via the cookie settings. Other cookies, such as analytics and marketing cookies, are only enabled once the user has given their consent via the cookie banner.
Further details on the cookies in use, their purposes and retention periods can be found in the website’s cookie settings.
Updated on 26.8.2026