Snowfox Privacy Notice
Updated on 19th of September 2023
Introduction
Snowfox, part of the Bravedo Group, uses this Privacy Notice to describe how we collect, process and protect the personal data of website visitors and contacts in our marketing database.
Why and what personal data do we process?
The data we collect concerns our clients, potential clients, partners, individuals who are interested in our products as well as recruitment candidates. We collect and process personal data only for the following, specifically determined purposes. Below you can see a list of the types of personal data we process for each purpose.
- Processing related to recruitment and job applications
- Basic information (name, contact information)
- Information included in the uploaded resume and CV Basic information (name, social security number, contact information)
- Processing related to marketing and customer relationship management
- Basic information (name, contact information, company details)
- Email correspondence
- Tracker; unique device identifiers for advertising and/or analytics
What legal basis is the processing of personal data based on?
Data protection legislation requires that processing of personal data is based the legal bases included in the GDPR. We process your personal data based on the following legal basis:
Legitimate interest: Legitimate interest is used as a legal basis when your personal data is processed for recruitment or product marketing purposes. When relying upon legitimate interest, we evaluate and consider the significance of the interest according to data protection legislation, ensuring that it does not cause an unreasonable risk or impediment to you.
Consent: In certain situations, we process your personal data only if you have given explicit consent beforehand. For example, we only install advertising and analytics cookies to your browser on your explicit consent. In some situations, consent may be present based on your own actions, such as if you yourself freely share some personal information.
Where do we get the personal data we process?
Personal data is mainly collected directly from you on this website, either by you filling out a form with your contact details, submitting a resume, or opting into tracking cookies. Personal data can also be collected by you filling out a form in Google Marketplace. Sometimes we might get your information from public sources such as company websites or third-party sources such as event attendee lists.
How do we use cookies?
Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide reporting information.
Cookies set by the website owner (in this case, Snowfox) are called "first party cookies". Cookies set by parties other than the website owner are called "third party cookies". Third party cookies enable third party features or functionality to be provided on or through the website (e.g. like advertising, interactive content and analytics). The parties that set these third party cookies can recognize your computer both when it visits the website in question and also when it visits certain other websites.
We use first and third party cookies for several reasons. Some cookies are required for technical reasons in order for our website to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to track and target the interests of our users. Third parties serve cookies through our website for advertising, analytics and other purposes.
To whom is personal data transferred or disclosed to?
We process personal data confidentially, and we never sell, rent, or otherwise needlessly disclose your personal data to external parties.
The collected personal data is partly processed and stored outside the EU/EEA, for example when service providers are located outside the EU. The service providers used have contractually committed to ensuring adequate level of data protection in all processing activities.
How do we protect your personal data?
We protect your personal data with appropriate technical and organizational safeguards against loss, unauthorized access, and other misuse. Your personal data is processed only by employees who are authorized to do so based on their role.
Automated decision-making
Automated decision-making refers to decision made fully automatically, for example based on an algorithm without human intervention. The processing of your personal data at Snowfox does not include automated decision-making.
Retention times
We store your personal data only as long as necessary for the purposes of the data processing.
After the retention time has ended, your personal data is either written over in the backup copies and system background or made unidentifiable by irrevocably changing the personal data into a form that does not enable identifying an individual person.
What rights do I have?
Right to be informed
You have the right to be informed about the processing of your personal data in a concise, transparent, intelligible, and accessible from, presented in clear and plain language. The purpose of this privacy notice is to address the right to be informed and help you understand how we process your personal data. If after reading this notice you have further questions, you can contact us as advised in the “Contact information” section.
Right to access
You have the right to get confirmation of what personal data we process concerning you. Thereby, you can evaluate and confirm that the data is processed lawfully. Additionally, you have the right to ask and receive a copy of the personal data we process. Instructions for requesting a copy of your data can be found in the next section, “How can I exercise my rights?”.
Right to data portability
In certain situations, you have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and, if desired, transmit that data to another controller. This right exists when we process your personal data based on consent or contract and the data processing is digital in nature.
Right to rectification
Our goal is to maintain personal data in a current and accurate form and to delete false, insufficient or inaccurate personal data without delay. You have the right to demand the rectification of inaccurate personal data concerning you and completion of insufficient personal data.
Right to restrict processing
The restriction of processing means that, in addition to storage, the personal data subject to the restriction can only be processed
- with your consent,
- for the establishment, exercise or defense of legal claims,
- for the protection of the rights of another natural or legal person, or
- for reasons of important public interest of the Union or a Member State.
The right exists in the following situations:
- The data subject contests the accuracy of the personal data. In such cases, the processing will be restricted for a period enabling the controller to verify the accuracy of the personal data.
- The processing is unlawful, but the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
- The controller no longer needs the personal data for the purposes of the processing, but it is required by the data controller for the establishment, exercise or defence of legal claims.
- The data subject has objected to the processing of the personal data for purposes other than direct marketing and is awaiting verification on whether the legitimate grounds of the controller override those of the data subject.
Right to object to data processing
In certain situations, you have the right to object to data processing by requesting that your data will not be processed at all. If the data is processed for the performance of a task carried out for reasons of public interest, in the exercise of official authority or for the purposes of the compelling legitimate interests pursued by us or a third party, you have the right to object to the processing on grounds relating to your particular situation.
In such cases, the processing must be stopped unless
- the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or
- the processing is necessary for the establishment, exercise or defense of legal claims
If the personal data is processed for direct marketing, you have the right to object to the processing without any specific grounds, after which the data may no longer be processed for purposes of direct marketing.
Right to erasure and to be forgotten
In certain situations, you have the right to be forgotten, or to have your personal data erased entirely. This right exists when, for example, the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, the processing was based on consent and you withdraw the consent, or the personal data has been processed unlawfully.
Right to withdraw consent
When your personal data is processed based on consent, you have the right to withdraw your consent at any time. If you withdraw your consent, processing of personal data will not be continued unless another legal basis, such as legal obligation, requires continuing the processing of data. You can withdraw your consent, for example, by clicking the “unsubscribe” link at the end of a newsletter email.
Right to file a complaint to a supervisory authority
In addition to the rights mentioned previously, you have a right to file a complaint to a supervisory authority if you believe that our privacy practices do not follow the General Data Protection Regulation. A complaint can be filed, for example, if the rights described in this notice are not implemented appropriately. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
How can I exercise my rights?
If you have questions regarding the aforementioned rights or you wish to examine your personal data or otherwise exercise your rights, please be in contact with us. The contact information of our data protection officer can be found at the end of this notice.
Exercising your rights is generally free of charge. In certain situations defined by law, for example, if you request multiple copies of your personal data, we may request a fee equivalent to the cost of implementing your request beforehand.
We respond to all requests without undue delay, at the latest one month after the request has been received. We will inform you about the measures we have taken in order to complete your request. If for some reason we have to decline your request, we will inform you about the refusal and reasoning for it in one month after the request has been received.
If there are multiple requests, or they are complex, we may require additional time of up to 2 months for implementing the request. In this case, we will inform you about the need for additional time and reasoning for the delay in one month after receiving the request.
If you want to file a complaint to the supervisory authority, more information can be found on the website of the Office of the Data Protection Ombudsman: https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman
Data controller and contact information
Data controller is the entity, who decides how and why personal data is processed. Snowfox decides the purposes and measures for processing personal data on our website. Thereby, Snowfox is the data controller for the personal data processing.
Snowfox has appointed a data protection officer, who is an internal data protection expert. The data protection officer supervises the processing of personal data, advises employee’s regarding data protection matters and acts as a contact person for requests and questions regarding data subject rights.
Contact information of the data controller:
Snowfox Oy
Company ID: 2937591-4
Tripla Workery West, Firdonkatu 2 7th floor, 00520 Helsinki
Contact information of the data protection officer:
privacy@snowfox.ai
Updates to the privacy notice
We continuously improve our privacy practices, which is why this privacy notice will also be updated occasionally. Updates may be due to changes in legislation. We recommend, that you re-visit this page to be informed about any possible changes. If needed, we may also inform you directly about any changes in our privacy practices.
