Privacy Policy

Last updated

1. Who We Are

ENGINORD Oy (“ENGINORD”, “we”, “us”, “our”) is the data controller responsible for the personal data described in this privacy policy.

This privacy policy applies to personal data processed in connection with www.enginord.com and related business interactions including contact and early enquiries, subscriptions to ENGINORD Insights, and expressions of interest in joining ENGINORD's expert network.

It does not apply to (i) third-party websites linked from our site, which have their own privacy practices, or (ii) personal data ENGINORD processes as a data processor on behalf of a client under a specific engagement, such processing is governed by the relevant client contract and, where applicable, a separate data processing agreement.

2. Summary

This section summarises the policy in plain terms. The full detail follows in the sections below.

  • What we collect: contact details you provide (name, organisation, e-mail, phone), the content of your enquiry, professional information if you apply to join our expert network, and limited technical data collected automatically when you visit our website.

  • Special category data: we do not knowingly process it. Please do not include health, religious, political, trade-union or similar information in messages you send us.

  • Data from third parties: we do not purchase or source personal data from third parties, other than reviewing publicly available professional information (e.g., LinkedIn) as part of expert-network due diligence, with your knowledge.

  • Why we process it: to respond to enquiries, evaluate expert-network applications, operate and secure the website, and with your consent send Insights updates.

  • Who we share it with: IT, hosting, e-mail/CRM and analytics providers acting as our processors under contract, and professional advisers or authorities where legally required. We do not sell personal data.

  • Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to the Finnish Data Protection Ombudsman, see Section 10.

3. What Personal Data We Collect and Why

We collect different personal data depending on how you interact with us. Each subsection below sets out the data, the purpose, and the legal basis we rely on (see Section 4 for what these legal bases mean).

3.1 Visiting our website

When you visit our website, we automatically collect certain data, including your IP address, browser and device type, the pages you view, the referring URL, your approximate location, and cookie identifiers. We use this information to operate and secure the site, understand how it is used, and improve its content. For essential and security-related data, our legal basis is legitimate interest; for non-essential analytics or marketing cookies, we rely on your consent (see Section 5).

3.2 Contact and early enquiries

When you contact us or submit an enquiry, we collect your name, organisation, country, e-mail address, and telephone number if provided, together with the content of your message. We use this information to respond to your enquiry, to prepare and negotiate an early engagement, and for internal record-keeping. Our legal basis is the steps taken at your request prior to entering into a contract, together with our legitimate interest in maintaining business records.

3.3 ENGINORD Insights subscription

When you subscribe to ENGINORD Insights, we collect your e-mail address and engagement data such as opens and clicks from our e-mail platform. We use this information to send you the content and updates you requested. This processing is based on your consent, which you can withdraw at any time via the unsubscribe link.

4. Legal Bases We Rely On

As an EU/EEA-based controller, ENGINORD relies on the following legal bases under Article 6 GDPR:

  • Consent: where you have actively opted in, for example to non-essential cookies or the Insights newsletter. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

  • Contract / pre-contractual steps: to take steps you request before entering into an engagement, such as responding to a early enquiry or assessing an expert-network application.

  • Legitimate interests: for example, keeping business records, securing our website, and preventing misuse balanced against your rights and freedoms.

  • Legal obligation: where processing is required by law, such as accounting and tax record-keeping under Finnish law.

5. Cookies and Similar Technologies

Our website uses cookies to operate, secure and improve the Site, and where you give your consent for analytics and marketing purposes. Full details of the cookies we use, their purpose, provider and duration, and how to manage or withdraw your consent at any time, are set out in our Cookie Policy, accessible via the cookie banner and the site footer.

You can manage or withdraw cookie consent at any time via the consent banner or your browser settings. Disabling non-essential cookies will not affect your ability to browse the site, though some features may work differently.

6. Who We Share Your Data With

We do not sell personal data, and we do not share it with third parties for their own advertising purposes. We may share personal data with:

  • Processors: our IT hosting/CMS provider, e-mail and CRM platform, and analytics providers, each acting on our instructions under a data processing agreement (Article 28 GDPR).

  • Professional advisers: lawyers, auditors and similar, where necessary for their engagement.

  • Public authorities: where disclosure is required by law, court order, or to a regulator.

  • Business transfers: in the event of a merger, acquisition, financing, or reorganisation, personal data may be transferred to the parties involved, subject to the same protections described here.

7. International Data Transfers

Where we use service providers located outside the European Economic Area (for example, cloud hosting, analytics or CRM platforms based in the United States or United Kingdom), we ensure an adequate level of protection through mechanisms recognised under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses, an applicable adequacy decision, or another lawful transfer mechanism.

8. How Long We Keep Your Data

We retain general enquiries that do not convert into an engagement for up to two years from your last contact with us, based on our legitimate interest and applicable limitation periods. Client and contract records are retained for the duration of the contract plus the statutory period required by law under the Finnish Accounting Act. Website analytics data is retained according to the default retention period of our analytics tool, typically 14 to 26 months, based on your consent. If you subscribe to Insights, we retain your data until you unsubscribe, also based on your consent.

When a retention period ends, we securely delete or anonymise the data, unless a longer period is required or permitted by law.

9. How We Protect Your Data

We apply appropriate technical and organisational measures to protect personal data, including access controls, encryption of data in transit, confidentiality obligations for staff, and due diligence on the processors we use. However, no method of transmission or storage over the internet can be guaranteed 100% secure, and we cannot promise that unauthorised third parties will never defeat these safeguards.

10. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Access:  to obtain confirmation of, and a copy of, the personal data we hold about you.

  • Rectification: to have inaccurate or incomplete data corrected.

  • Erasure: to have your data deleted, where applicable.

  • Restriction: to limit how we process your data in certain circumstances.

  • Portability: to receive data you provided to us in a structured, machine-readable format, and to have it transmitted to another controller where technically feasible.

  • Objection:  to object to processing based on legitimate interests, including direct marketing.

  • Withdraw consent: at any time, without affecting the lawfulness of processing before withdrawal.

ENGINORD does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

To exercise any of these rights, contact us at info@enginord.com. We may need to verify your identity before responding, and will address requests within the timeframes required by the GDPR.

11. Right To Сomplain 

If you believe we are not processing your personal data lawfully, you have the right to lodge a complaint with the Finnish supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), P.O. Box 800, FI-00531 Helsinki, Finland; visiting address Lintulahdenkuja 4, 00530 Helsinki; e-mail tietosuoja@om.fi; website tietosuoja.fi.

12. Children

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from children, and our website is not intended for use by minors.

13. Third-Party Links

Our website may link to third-party websites, such as LinkedIn or partner sites. This privacy policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party website you visit.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The “Version dated” notice on the cover page will be updated accordingly. We encourage you to review this page periodically.

15. Contact Us

If you have questions or comments about this privacy policy, or wish to exercise any of your rights, please contact us, ENGINORD Oy, 3590724-3, P.O. Box 17, FI-02101 Espoo, Finland, www.enginord.com, info@enginord.com