Snapshot 81294
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy – Business Customers Page 1 of 14
Privacy Policy – Business customers
Last update: 11 June 2024
Introduction
We value your fundamental right to privacy. As a company based in the European Union,
we adhere to our obligations under the General Data Protection Regulation (GDPR). In
this document, we inform you about our processing of your personal data if you’re a
business customer (or a representative of one).
For clarity, we have divided the privacy policy into two parts:
• Part 1 contains general information about personal data processing.
• Part 2 applies to the processing of your personal data as a business customer (or
a representative of one).
If you have any questions or concerns regarding the processing of your personal data,
please don’t hesitate to contact us:
Ceili Oy
Privacy team
support@ceili.fi
We may update our privacy policies from time to time. The date of last update is shown
above. Minor changes will be shown in this document, and we ask that you review it
regularly. Changes that significantly aUect the rights and freedoms of our customers will
be communicated to you by email or notification if we have your contact details.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 2 of 14
Part 1: General information
Categories of personal data
As our customer (or a representative of one), we regularly process certain categories of
your personal data. These are:
• Name, contact details and position (e.g. your title at the company that you
represent)
• Messages and correspondence
• Financial information and public records (e.g. to fulfil our financial due diligence
or to make sure that you are entitled to represent your company)
• Payment information and payment history
(Some of these categories are normally information related to the company that you
represent, but in some cases such information may be considered your personal data
under the GDPR.)
Occasionally, we process certain additional categories of your personal data. These are:
• Technical identifiers (e.g. device identifiers, IP addresses, geolocation data)
• Video and sound recordings and photographs (e.g. if we record a video seminar
that you attend, or if we record a customer service phone call)
• Preferences and activity (e.g. if we take notes of your customer service
interactions and our customer relationship activity with you, or your participation
in our events)
• Social media content and other public information (e.g. if we take notes of your
company’s online presence or check your information for marketing purposes)
• Permissions and prohibitions (e.g. whether you’ve subscribed to our newsletters
or declined the use of certain cookies on our website)
Mandatory categories of personal data
Some categories of personal data are mandatory in the sense that without certain data,
we cannot provide our services to you or carry out other critical processes related to our
customer relationship. In some cases we may also have a legal duty to process certain
categories of your personal data.
In Part 2 of the privacy policy, we have marked clearly which categories of personal data
are mandatory for a given purpose.
Sources of personal data
We primarily process personal data that you give us, for instance when we discuss our
business matters or sign a contract.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 3 of 14
However, in some cases we may receive personal data relating to you from other
sources. These are:
• Public records (e.g. company registers, business data services)
• Marketing registers (e.g. if we include your information in our marketing dossier)
• Your company (e.g. if your employer updates your contact details with us)
• Social media and the internet
• Technical sources such as cookies, scripts, and similar technologies (e.g. if you
access our website or online services)
Retention periods of personal data
When processing your personal data, we adhere to the principle of data minimisation.
That means we only keep your personal data as long as necessary for the purposes that
we describe more in detail below, and only as long as we have a legal basis set out in
the GDPR to process the data.
As soon as no relevant purpose or legal basis applies, we will either destroy your
personal data or anonymise it in an irreversible manner.
In Part 2 of the privacy policy, we have marked clearly all retention periods of your
personal data for a given purpose.
Sharing your personal data with third parties
As a commercial service provider, we like most other companies have to outsource
some of the processing of your data to trusted partners. Because of that, we share
certain categories of personal data with third parties.
We always make sure that all disclosures are protected by a contractual arrangement
between us and our trusted partners to protect your personal data, as required by the
GDPR.
Our trusted partners can be categorised as follows:
Website, data storage and technical operations
• Web hosting companies (e.g. to operate our website and online services)
• Content management services and content delivery networks (e.g. to operate
our website and online services and to store and process online data)
• Cloud storage (e.g. to store customer and contract information)
• Online collaboration tools (e.g. if we plan and discuss internally the services that
we provide to you)
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 4 of 14
Communications and deliveries
• E-mail and messaging services
• Video call service providers (e.g. if we have a video call with you or you
participate in our webinar)
Financial service providers
• External accountants and auditors
• Accounting software service providers (e.g. to store our invoices for bookkeeping
obligations)
• Banks and payment processors
Professional advisers
• Law firms
• Business consultants
Customer and contract management
• Hosted customer management services
• Digital signature services
• Calendar and booking services (e.g. to book and handle meetings with you)
Public authorities
• Any information lawfully requested by a public authority
Mergers and acquisitions
• Should our company ever be party to a merger or acquisition, your personal data
could be transferred to the buyer or another company as a part of the transaction
Transfers to other controllers
• We use Google Analytics on our website. The data collected for those purposes
will be shared with Google, who uses the data also for its own purposes (e.g. for
providings its marketing solutions). In that case, Google acts as a joint controller
or as an independent controller of your personal data. Read more here:
https://support.google.com/analytics/answer/7318509?hl=en
Transfers outside the EU/EEA
We normally process your personal data within the European Union and European
Economic Area. In some cases, we or our trusted partners process your personal data
outside these areas.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 5 of 14
Because of that, some of your personal data are transferred to the following countries:
• United States: We and our trusted partners make sure that transfers are
protected under the EU-US Data Privacy Framework. If not, we and our trusted
partners make sure transfers are protected by contractual arrangements using
the Standard Contractual Clauses (SCC) issued by the European Commission.
Should we be unable to take any of these precautions, ultimately we’ll ask for
your consent for the transfer.
Your rights
According to the GDPR, you have various rights as we process your personal data.
These are:
• Right of access: You may ask us whether we process any personal data about
you, and if we do, you have a right to request a copy of some or all of the data.
You also have a right to ask for more information regarding the third-party
recipients of your personal data as well as our protective measures applicable to
the transfers of your data to our trusted partners and outside the EU/EEA.
If you request a copy of your data, we will send it to you electronically. In most
cases we will be glad to accommodate your request, but if we receive repeated
or manifestly unfounded requests from you, we may have to refuse or charge a
reasonable administrative fee to process your request.
• Rectifying incorrect or incomplete personal data: If you consider that some of
your personal data that we process is incorrect or incomplete, you may ask us to
correct or complete the data. We will investigate your request without undue
delay, and accommodate it if we can be suUiciently certain that the request is
justified.
• Erasing personal data (“the right to be forgotten”): If you don’t want us to
process your personal data, you may ask us to erase a part or all of it. We will do
our best to accommodate your request, but in some cases we may have to
refuse or postpone the request. This may happen e.g. if we have an on-going
business relationship with you and we need your personal data to perform our
services, or if we have a legal duty or a legitimate interest to retain some of your
data (we have described these in more detail in Part 2).
• Restricting the processing of personal data: If you consider that our
processing of your personal data breaches the GDPR or other laws, you may ask
us to restrict the processing (i.e. to stop the processing for the time being). We
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 6 of 14
will accommodate your request as well as possible while we investigate the
matter.
You may also ask us that we do not erase or otherwise process your personal
data if you need the data e.g. in a legal dispute and the erasure or other
processing would jeopardise your interests in that regard. We will aim to
accommodate your request as well as possible.
• Objecting to processing of personal data: As explained in detail in Part 2, we
sometimes process your data on the basis of our or someone else’s legitimate
interest. If that’s the case, you may object to our processing of your data on that
basis. We will aim to accommodate your request as much as possible, however
in some cases the legitimate interests in question may be so important that they
outweigh your interest to object.
If that happens, we will let you know about our reasons for not accommodating
your request and inform you about your right to lodge a complaint with the
relevant data protection authorities.
If we have contacted you for direct marketing purposes, you may also object to
our processing of your personal data for that purpose. (In other words, you may
prohibit us from contacting you for direct marketing purposes). We will
accommodate your request without undue delay.
• Withdrawing consent: As explained in detail in Part 2, we sometimes process
your personal data on the basis of your consent. If that’s the case, you may, at
any time, withdraw your consent for that processing. We will accommodate your
request without undue delay, however we may continue the processing if we
have another legal basis to do so. Please note that withdrawing consent will not
aUect the prior processing of your personal data.
• Right to lodge a complaint: If you consider that our processing of your personal
data breaches the GDPR or other laws, you may at any time lodge a complaint
with the relevant data protection authorities. In Finland, you can contact the
Data Protection Ombudsman: www.tietosuoja.fi
To exercice any of your above rights, please contact us using the contact details
shown at the beginning of the document. We’ll be glad to assist you.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 7 of 14
Cookies and tracking
Like most other companies, we use cookies and similar technologies on our website,
online services and in marketing. We will adhere to applicable laws regarding the
prerequisites for the processing of your personal data in such ways.
We have described in detail the types of cookies and similar technologies we use as
well as their purposes in our cookie policy.
Part 2: Processing of your data
As you are a business customer (or act as a representative of one), we process your
personal data in certain ways in the context of our business relationship. Here we
describe the purposes of processing your personal data together with the appropriate
legal bases for the processing, as well as the categories of personal data processed
together with their retention periods.
Purposes and legal bases of the processing of personal data
According to the GDPR, all processing of personal data must be justified using a legal
basis found in the law. We use the following legal bases for our processing:
• Contract (including contract preparation): As you are our business customer
(or represent one), to perform that contract we need to process certain
categories of your personal data.
• Legal obligation: As a commercial service provider, we have a number of legal
obligations to fulfil. For instance, we must keep financial records of our
transactions, which may include your personal data.
• Consent: In some cases, we may ask for your consent to process your personal
data. If we receive your consent, we may process your data on that basis within
the limits of the consent. For instance, we use cookies for statistical and
marketing purposes, which may only be done if we receive your consent.
• Legitimate interest: In some cases, we may process your personal data if it’s
justified for our or someone else’s legitimate interest. We only do so after having
assessed your rights and freedoms against the importance of the legitimate
interest (we conduct a so-called “balancing test”).
Here is a complete overview of our purposes of processing and the corresponding legal
bases:
Purpose Legal basis Examples
Performing Contract In order to perform our services as
services contracted, we need to process some of
your personal data.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 8 of 14
Legitimate As we perform our services to you, we have
interest a justified interest in processing some of
your personal data, e.g. to improve our
services.
Maintaining and Contract Apart from performing our services, we do a
developing our number of things to maintain our
customer contractual relationship with you. We may
relationship for instance take notes of our business
interactions with you.
Legitimate To improve our customer experience, we
interest may conduct case studies about our
customer relationship internally. These may
contain some of your personal data.
Billing and debt Contract As we perform our services to you, we bill
collection you as agreed in our contract. To send an
invoice, we may need to process some of
your personal data.
Legal obligation We have legal duties to keep records of our
business transactions. For instance, our
invoices must contain certain information
which may be your personal data.
Accounting and Contract To keep records of our sales and business
taxation transactions, we store and retain
information about our dealings with you.
These notes may contain your personal
data.
Legal obligation We have a legal duty to keep records of our
business transactions. For instance, we
must store and retain our invoices for a
number of years, which may contain you
personal data.
Risk management Contract To manage mutual risks and protect the
and protecting interest of you and us, we need to keep
interests records of our due diligence processes,
contractual relationships and business
dealings. These notes may contain your
personal data.
Legal obligation In some cases, we may have to process
certain background information as a legal
duty. For instance, we may have to check
and store information about economic
sanctions. These checks may involve
processing some of your personal data.
Legitimate To manage risks and to protect various
interest business interests, we process certain
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 9 of 14
categories of personal data. For instance,
we keep records of our contractual
relationships and business dealings for a
number of years in case a legal dispute
arises. Also, we keep records of the usage of
our intellectual property by our customers.
These notes may contain your personal
data.
Communications Contract As part of our customer relationship with
you, we often have discussions and
correspondence with you. We store and
retain these if they are relevant to our
contractual relationship.
Consent In some cases, for instance if you contact us
using a medium that processes certain
technical identifiers, we may ask for your
consent for processing the identifiers. Also,
we may ask for your consent to use our
communications with you for a purpose not
depicted here, such as as a customer
testimonial on our website.
Legitimate In some cases, we store, retain and process
interest our communications with you for various
legitimate interests such as improving our
customer service and training our staU.
Sales and Consent In some cases, to process your personal
marketing data for sales and marketing purposes, we
ask for your consent. This is case for
instance when we use cookies and similar
technologies for such purposes.
Legitimate As a commercial service provider, we often
interest have a justified reason to approach you with
the purpose of discussing our oUering with
you. In those cases, we process your
personal data as part of our legitimate
interests.
Technical Contract Some of the services that we provide to you
functioning and under our contract process personal data
security for technical reasons. For instance, to share
materials and deliverables with you
electronically, we need to ensure the proper
technical functioning and security of the
platform. This often includes processing of
personal data such as necessary technical
identifiers.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 10 of 14
Consent In some cases we oUer you technical
functions that do not strictly relate to our
contractual relationship. This is for instance
if you access our website for unrelated
reasons. In those cases we process
personal data for the technical functioning
of the services. If the processing is not
necessary for that purpose (e.g. in case of
cookies used to improve the visual appeal of
our website), we will ask for your consent to
process the data.
Legitimate In some cases we have a justified reason to
interest ensure the proper functioning and security
of our services. In those cases we process
certain technical personal data as part of
our legitimate interests.
Categories of personal data processed and their retention times
Below is a list of our retention times for diUerent categories of personal data under a
given purpose. Once a specific retention period runs out, we will destroy the relevant
personal data or anonymise it irreversibly, unless a diUerent purpose with a longer
retention period applies.
For instance, we keep personal data for the purposes of communications (like e-mails
containing your name and e-mail address) for 1 year. Once the retention period runs
out, we will destroy the relevant data unless we need to keep it for the purposes of risk
management for 3 years. If so, we will continue to retain the data until the 3-year
retention period runs out.
Purpose Category of Retention period(s) Examples
personal data
Performing Name, contact 1 year from the end To perform and
services details, position of performance deliver our
Messages and services to you, we
All personal data correspondence need to process
for this purpose are Technical identifiers your personal
mandatory to data. We will keep
facilitate our the data in an
contractual active dossier for
relationship. one year in case
there are for
instance
immediate issues
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 11 of 14
that have to be
fixed.
Maintaining and Name, contact 1 year from the end To maintain and
developing our details, position (*) of customer develop our active
customer Messages and relationship, or 5 relationship, we
relationship correspondence (*) years from the will process your
Preferences and collection and personal data. We
Personal data activity storage, whichever will store the data
marked with (*) are is sooner in your customer
mandatory to dossier, and if the
facilitate our customer
contractual relationship ends
relationship. (or you no longer
represent your
company towards
us), we will retain
the data for a
safety period of
one year.
Billing and debt Name, contact 1 year from the end As we bill you for
collection details, position of the current our services, we
Financial financial year process your
All personal data information and personal data on
for this purpose are public records invoices and in
mandatory to Payment transaction
facilitate our information and records. We will
contractual payment history retain that
relationship as well information for the
as to fulfil our legal current financial
obligations. year and one year
after that in order
to keep our
business records
up to date.
Accounting and Name, contact 1 year after the As part of our
taxation details, position current financial annual
Messages and year (except legally accounting, we
All personal data correspondence prescribed store and retain
for this purpose are Financial information) relevant personal
mandatory to information and data for the
facilitate our public records 6 years after the current financial
contractual Payment current financial year and one year
relationship as well information and year (legally after it.
as to fulfil our legal payment history prescribed
obligations. information) Some information,
such as invoices
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 12 of 14
and receipts, must
be retained for a
legally prescribed
period, which is six
years. During that
period, we will
only retain
personal data
which is necessary
for that purpose.
Risk management Name, contact 3 years from To protect your
and protecting details, position (*) collection and and our legitimate
interests Messages and storage interests, we retain
correspondence (*) personal data for
Personal data Financial one or three years
marked with (*) are information and from the last
mandatory to public records (*) instance of active
facilitate our Payment processing. We do
contractual information and so so that for
relationship as well payment history (*) instance in case of
as to fulfil our legal Video and sound a legal dispute
obligations. recordings and about our contract
photographs (*) or service, any
Technical identifiers 1 year from critical evidence
(*) collection and will not have been
storage (except as destroyed.
stated in cookie
policy)
Social media 1 year from
content and other collection and
public information storage
Communications Name, contact 1 year from the We retain personal
details, position (*) communication data from our
Personal data Messages and communications
marked with (*) are correspondence (*) with you for one
mandatory only if Technical identifiers year in case we
you wish to get in (*) want to continue
contact with us. Social media the discussion at a
content and other later time.
public information
Sales and Name, contact For the time being As we have a
marketing details, position legitimate interest
in approaching you
to discuss our
oUering, we keep
your name,
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 13 of 14
contact details
and position on file
for the time being,
however only as
long as you
represent the
company that is or
has been our
customer. This
means we may
contact you some
time in the future
unless you prohibit
us from doing so.
Messages and 3 years from If we haven’t had
correspondence collection and any business
Video and sound storage dealings with you
recordings and (or your company)
photographs for the past three
Preferences and years, we’ll erase
activity or anonymise your
Technical identifiers personal data
Social media unless we
content and other continue to retain
public information them under
another purpose.
Consents and Indefinitely If you have
prohibitions prohibited us from
approaching you
for sales and
marketing
purposes, we’ll
make a note of it
and retain it
indefinitely (or
until you instruct
us otherwise).
Technical Name, contact Deleted We’ll destroy or
functioning and details, position immediately anonymise your
security personal data
immediately once
Personal data they aren’t needed
marked with (*) are for the relevant
mandatory to the purpose.
extent that we have
a justified interest Note however that
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä
Privacy Policy – Business Customers Page 14 of 14
in ensuring the our cookie
technical management
functioning and system stores
security of our cookies (which
electronic services may include your
or we have a legal personal data) in
duty to acquire your accordance with
consent. our cookie policy.
Technical identifiers 1 year from the last We keep technical
(*) active processing identifiers for one
year from the last
active processing
(unless stated
otherwise in our
cookie policy) in
case we need to
investigate a
technical or
security issue in
the future.
Consents and Indefinitely If you have
prohibitions (*) prohibited us from
processing your
personal data for
non-necessary
technical
purposes, we’ll
make a note of it
and retain it
indefinitely (or
until you instruct
us otherwise).
Note however that
our cookie
management
system stores your
cookie and
tracking
preferences in
accordance with
our cookie policy.
Ceili Oy
Kauppakatu 28 B Company number: 2985314-6 ceili.fi
40100 Jyväskylä