Privacy and Data Protection Policy

Insinööritoimisto Pohjatekniikka Oy

Effective Date: 1.10.2026
Last updated: 1.10.2026

1. Introduction

Insinööritoimisto Pohjatekniikka Oy (“Pohjatekniikka”) is committed to protecting personal data and respecting the privacy of employees, customers, suppliers, subcontractors, business partners, job applicants, website visitors and other stakeholders.

Personal data is processed in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (GDPR).

This Privacy and Data Protection Policy describes the general principles applied by Pohjatekniikka to the collection, processing, storage, protection and deletion of personal data.

2. Data Controller

Insinööritoimisto Pohjatekniikka Oy
Nuijamiestentie 5 B
00400 Helsinki, Finland
Tel. +358 9 4777 510

Data Protection Contact Person:
Tapio Ranta-aho, CEO
tapio.ranta-aho@pohjatekniikka.fi
+358 9 4777 510 or +358 50 597 8613

Questions and requests concerning personal data may be addressed to the contact person above.

3. Personal Data We Process

Depending on the relationship and purpose of processing, Pohjatekniikka may process personal data including:

name and contact details;
employer, position and professional contact information;
customer, supplier and subcontractor contact information;
information required for contracts, projects and project administration;
employee and job applicant information;
professional qualifications, training and competence information;
information required for construction-site or project access;
invoicing and other administrative information;
communications and correspondence; and
website usage and technical information, where applicable.

Only personal data necessary for the relevant purpose is processed.

4. Purposes and Legal Basis for Processing

Personal data may be processed for purposes including:

managing customer, supplier, subcontractor and business relationships;
performing and administering contracts and projects;
communicating with customers and other stakeholders;
managing employment relationships and recruitment;
meeting legal, contractual and regulatory obligations;
managing access, competence and safety requirements related to projects and construction sites;
invoicing and financial administration;
protecting the Company’s legitimate business and legal interests; and
operating and improving the Company’s website.

Depending on the circumstances, processing is based on performance of a contract, compliance with a legal obligation, Pohjatekniikka’s legitimate interests or consent where consent is required.

5. Information Security and Protection of Personal Data

Information is managed in a controlled and secure manner.

Pohjatekniikka applies appropriate technical and organisational measures to protect personal data, confidential information and project materials against unauthorised access, loss, alteration or disclosure.

Access rights to documented information are assigned according to work duties and responsibilities. Project information is stored, archived, revised and distributed in a controlled manner.

Employees and subcontractors handling confidential or personal information are required to understand and comply with applicable confidentiality, information-security and data-protection requirements.

Information-security and personal-data incidents and identified risks are reported and addressed without undue delay.

6. Disclosure of Personal Data and Service Providers

Personal data may be disclosed or made available to customers, authorities, service providers, subcontractors or other parties where necessary for the relevant business activity, required by law or otherwise permitted under applicable data protection legislation.

Where external service providers process personal data on behalf of Pohjatekniikka, appropriate confidentiality, information-security and data-protection requirements are applied.

Personal data is not sold to third parties.

7. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), Pohjatekniikka ensures that an appropriate legal basis and safeguards required by applicable data protection legislation are in place.

8. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected or as required by applicable legislation, contractual obligations or legitimate business requirements.

Retention periods therefore depend on the type of information and purpose of processing.

Personal data that is no longer required is appropriately deleted, anonymised or securely disposed of.

9. Rights of Data Subjects

Subject to the conditions established by applicable data protection legislation, individuals may have the right to:

obtain information about the processing of their personal data;
request access to their personal data;
request correction of inaccurate or incomplete personal data;
request deletion of personal data;
request restriction of processing;
object to processing;
request data portability where applicable; and
withdraw consent where processing is based on consent.

Requests concerning these rights may be submitted to Pohjatekniikka’s Data Protection Contact Person.

Individuals also have the right to lodge a complaint with the competent data protection supervisory authority.

10. Personal Data Breaches

Suspected loss, unauthorised disclosure, unauthorised access or other incidents involving personal data shall be reported internally without delay.

Pohjatekniikka assesses reported incidents and implements appropriate corrective measures. Where required under applicable data protection legislation, a personal data breach is reported to the competent supervisory authority and/or affected individuals.

Data-protection and information-security incidents may also be handled through Pohjatekniikka’s deviation and corrective-action process.

11. Website and Cookies

Pohjatekniikka’s website may use cookies and similar technologies necessary for website functionality and, where applicable, website analytics.

Information concerning cookies and available choices is provided through the website’s cookie management functionality.

Non-essential cookies are used in accordance with applicable requirements concerning consent.

12. Responsibilities and Continuous Improvement

Data protection and information security form part of Pohjatekniikka’s documented management system.

Data-protection responsibilities are addressed through employee induction, information-security practices and documented information management.

The effectiveness of information-security and data-protection practices is evaluated as part of management reviews, risk management, deviation management and continuous improvement processes.

13. Changes to This Policy

Pohjatekniikka may update this Policy where necessary due to changes in legislation, Company activities, information systems or data-processing practices.

The current version of the Policy is published on Pohjatekniikka’s website.