PRIVACY NOTICE

EU General Data Protection Regulation (EU) 2016/679, Articles 13 and 14, and the Finnish Data Protection Act (1050/2018)

Subcontractor and Partner Register / Ziirto Oy

Created: 21 January 2025 · Last updated: 25 August 2026

1. Controller

Ziirto Oy (Business ID 3155114-7)

Lentäjäntie 3, FI-01530 Vantaa, Finland

2. Contact person for data protection matters

Harri Hirvonen

Email: harri.hirvonen@2mm.fi

Requests concerning data subject rights (Section 10) should be addressed to the email address above.

3. Whose data we process

This notice describes how Ziirto Oy processes the personal data of the contact persons of its subcontractors and partners. Subcontractors are persons or companies that provide services to Ziirto (including independent interim professionals and consultants). A partner is a company that provides services to Ziirto’s customers. The data subjects are the contact persons of these companies as well as persons operating as sole traders or through their own companies.

4. Purposes and legal bases of processing Purpose of processing	Legal basis	Clarification
Preparing, verifying, managing and developing subcontracting and partnership agreements, and delivering assignments	Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))	Contract where the data subject is themselves a contracting party (e.g. a sole trader); legitimate interest where the data subject acts as a company’s contact person.
Invoicing, payments and accounting	Legal obligation (Art. 6(1)(c))	The Accounting Act and other mandatory legislation.
Obtaining and retaining reports required under the Finnish Contractor’s Obligations Act	Legal obligation (Art. 6(1)(c))	The Act on the Contractor’s Obligations and Liability when Work is Contracted Out (1233/2006), where its conditions of application are met.

Communicating about the cooperation and mapping potential subcontractors and partners

Legitimate interest (Art. 6(1)(f))

Communications relate to the data subject’s professional role. The data subject has the right to object to the processing (Section 10).

We do not make decisions based solely on automated processing within the meaning of Article 22.

5. Categories of personal data

• Identification and contact details: name, workplace contact details (postal address, telephone number, email), title and role
• Information relating to the contractual relationship: contracts, offers, assignments, invoicing and payment information (for sole traders, also the Business ID and invoicing address)
• Reports required under the Contractor’s Obligations Act where the Act applies (e.g. tax and pension insurance information; in the case of self-employed persons, such information may constitute personal data)
• Communication records: contacts, meetings and feedback
• Change history of the above data

6. Sources of personal data

• From the data subjects themselves and from other contact persons of the subcontractor or partner company
• From public registers (the Finnish Trade Register, the Business Information System) and contractor’s obligations information services in connection with contract preparation and statutory reports
• From the registers of companies belonging to the same group

Where data has been obtained from sources other than the data subject, this notice serves as the information to be provided under Article 14.

7. Recipients and disclosures of personal data

• Customers: where a subcontractor or partner participates in the delivery of a customer assignment, the contact person and professional information necessary for the assignment is disclosed to the customer. Otherwise, data is not disclosed to third parties without the data subject’s consent.
• Group companies: data is processed within companies belonging to the same group as Ziirto (including 2mm Performance Oy, JustLogi Oy) for internal administrative purposes and for providing services, including in a consortium structure where a group company acts as a subcontractor for the assignment.

Processors: the provider of the ERP and invoicing system, the electronic signature service provider, and providers of IT and communications services. Processors act on our behalf under agreements pursuant to Article 28. Information on the processors currently used is available from the contact person referred to in Section 2.

Authorities: for the fulfilment of statutory obligations (e.g. the Tax Administration).

8. Transfers of data outside the EU or EEA

Personal data is processed within the EU/EEA and is not, as a rule, transferred outside the EU/EEA. Should an individual service provider exceptionally process data outside the EU/EEA, the transfer would be carried out in accordance with Chapter V of the GDPR, on the basis of a European Commission adequacy decision or the standard contractual clauses adopted by the Commission (2021/914), supplemented with additional safeguards where necessary. Further information is available from the contact person referred to in Section 2.

 

9. Retention periods

Data category / situation	Retention period
Data relating to the contractual relationship	For the duration of the contractual relationship and for a maximum of 10 years after its termination, for the purpose of potential legal claims (Finnish Act on the Limitation of Debts).
Data included in accounting records	In accordance with the Accounting Act: 6 years from the end of the calendar year in which the financial period ended (accounting books 10 years).
Reports under the Contractor’s Obligations Act	At least 2 years from the completion of the work covered by the contract.
Contact details of potential subcontractors and partners	A maximum of 36 months from the most recent active interaction.

At the end of the retention period, the data is reliably deleted or anonymised.

10. Rights of the data subject

Data subjects have the following rights under the GDPR. Requests should be addressed to the contact person referred to in Section 2. We will respond to requests without undue delay and in any event within one month of receipt of the request.

• Right of access (Art. 15): confirmation of processing and a copy of the personal data undergoing processing.
• Right to rectification (Art. 16): rectification of inaccurate data and completion of incomplete data.
• Right to erasure (Art. 17): e.g. where the data is no longer necessary, where consent is withdrawn and there is no other legal basis, or where the data subject objects to the processing on justified grounds. This right is limited by statutory retention obligations (e.g. the Finnish Accounting Act).
• Right to restriction of processing (Art. 18): e.g. for the period during which the accuracy of the data is being verified.
• Right to data portability (Art. 20): applies to data that the data subject has provided themselves and that is processed by automated means on the basis of consent or a contract.
• Right to object (Art. 21): on grounds relating to the data subject’s particular situation, where the processing is based on legitimate interest.
• Right to withdraw consent (Art. 7): at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with a supervisory authority (Art. 77): Office of the Data Protection Ombudsman, Lintulahdenkuja 4, FI-00530 Helsinki, Finland, tietosuoja@om.fi, www.tietosuoja.fi/en.

11. Principles of data security

Personal data is protected in accordance with Ziirto’s information security policy through appropriate technical and organisational measures: access rights management, strong authentication, encryption, firewalls, and limiting access to persons whose duties require the processing. Personnel are trained annually in secure processing in compliance with data protection legislation. Manual materials are stored in locked premises. Service providers are contractually required to maintain a corresponding level of information security.

12. Changes to this notice

We may update this notice as our operations develop. Material changes will be announced on our website. The current version is available at ziirto.fi/tietoturva.

In the event of any discrepancy between the Finnish and English versions of this notice, the Finnish version shall prevail.