Privacy Policy

The privacy of clients, business partners and other contacts is very important for Creaplan Consulting. Creaplan Consulting complies with and acts in accordance with the applicable data protection legislation, including amongst other the General Data Protection Regulation (EU 2016/679 “GDPR”), every time Creaplan Consulting processes personal data. In this Privacy Policy we describe how Creaplan Consulting collects, processes, and stores the personal data of its clients, potential clients, and other business contacts.

1. CONTROLLER

Creaplan Oy (Creaplan Consulting)

c/o Tilipalvelu SER Oy, Maaherrankatu 9 A 43

70100 Kuopio, Finland

+358400412112

vaida@creaplanconsulting.com

2. PURPOSE OF PROCESSING

Creaplan Consulting processes personal data for the following purposes:

  • Client assignments. Creaplan Consulting processes personal data in order to open and perform client assignments. The processing includes scheduling of meetings with the client, communication with the client and billing.

  • Maintenance and development of client relationships. Creaplan Consulting processes personal data in order to send newsletters to clients.

  • Maintenance of potential client relationships. Creaplan Consulting processes personal data of persons, who potentially may be interested in acquiring Creaplan Consulting’s services in the near future.

The legal basis for personal data processing in relation to client assignments is that processing is necessary for the performance of a contract to which the client is a party or in order to take steps at the request of the client to enter into a contract (as stipulated in the GDPR article 6.1(b)). In relation to newsletters and other marketing the legal basis for processing personal data is the legitimate interests (as stipulated in the GDPR article 6.1(f)) of Creaplan Consulting to develop its existing client relationships as well as to acquire new clients.

3. PERSONAL DATA COLLECTED

Creaplan Consulting collects and processes personal data that is relevant and limited to what is reasonably necessary for performing the client assignment and management of the client relationship. In addition to clients, Creaplan Consulting also collects personal data of persons who have recommended Creaplan Consulting’s services. Creaplan Consulting collects the following personal data of its clients and the persons who have recommended the services:

  • Clients. Full name, email address, phone number and position.

  • Persons recommending the services. Full name.

4. RETENTION OF PERSONAL DATA

Creaplan Consulting will store the personal data for no longer than what is reasonably necessary for the purposes for which the personal data is processed. Creaplan Consulting will remove the personal data that Creaplan Consulting has collected when the personal data is no longer needed for the purposes described above in this Privacy Policy. Some of the personal data that Creaplan Consulting collects, and processes based on the client relationships may be subject to minimum retention periods set by accounting and tax legislation.

5. SOURCE OF PERSONAL DATA

Creaplan Consulting collects personal data mostly directly from the clients. Clients can also give their contact details by sending a contact request via a contact form located on Creaplan Consulting’s website. In addition, personal data may be collected from publicly available sources, such as the websites of client companies.

6. DISCLOSURE OF PERSONAL DATA

Creaplan Consulting will not disclose personal data to third parties, unless required by the applicable legislation, authorities, or the performance of the assignment. However, Creaplan Consulting may use external data processors or subprocessors, in which case personal data will be disclosed to such third parties. In case Creaplan Consulting appoints external data processor or subprocessor, Creaplan Consulting will enter into a data protection agreement with the data processor in order to secure safe and adequate data processing.

In case Creaplan Consulting is sold to another business entity, or is merged with another business partner, personal data may be disclosed to the new business partner or owner.

In general, Creaplan Consulting will not transfer personal data outside the EU/EEA region. If the transfer of personal data outside the EU/EEA region is necessary, such transfer will be performed subject to appropriate safeguards required by applicable data protection laws.

7. INDIVIDUAL RIGHTS

According to GDPR, data subjects have the following rights related to personal data:

  • Right to access to their personal data;

  • Right to request the data controller to rectify inaccurate personal data and right to have incomplete personal data completed;

  • Right to request the data controller to erasure the personal data, when the processing is based on consent or on the legitimate interest of the data controller;

  • Right to object and restrict the processing of personal data, when the processing is based on the legitimate interest of the data controller;

  • Right to object automated individual decision making;

  • Right to request the data controller to transmit their personal data to another data controller when the processing of personal data is based on consent or agreement and the processing is automated.

In addition, data subjects have the right to request Creaplan Consulting not to send newsletters or other marketing-related communication.

Data subjects have the right to lodge a complaint with a supervisory authority, if the data subjects consider that their rights based on the GDPR or national data protection legislation have been infringed. Data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence. In Finland, the supervisory authority is the Finnish Office of the Data Protection Ombudsman (www.tietosuoja.fi/en).

In case the data subject wishes to exercise his or her rights, the data subject may contact Creaplan Consulting via email to vaida@creaplanconsulting.com.

8. DATA SECURITY

Creaplan Consulting applies the adequate technical and organizational measures to ensure that all the personal data that Creaplan Consulting is processing has been processed and stored safely.

9. UPDATES

This Privacy Policy has been updated in December 2022. Creaplan Consulting reserves the right to update and amend this Privacy Policy in order to reflect the changing legal requirements and the changing processing practices of Creaplan Consulting. Unless otherwise provided in mandatory applicable legislation, Creaplan Consulting may not directly inform any individual of such updates and amendments. Therefore, we kindly ask the data subjects to review this Privacy Policy from time to time for possible updates.