Privacy policy and cookie policy

The following parties are responsible for the processing of personal data referred to in this privacy policy as joint controllers:

• Confederation of Finnish Entrepreneurs
• Regional organizations of the Finnish Entrepreneurs' Association
• Local associations of the Finnish Entrepreneurs' Association
• Finnish Entrepreneurs' Association Sypoint Ltd (0581846-9)

The joint controllers jointly determine the purposes and means of processing personal data. The joint controllers will be referred to as “Finnish Entrepreneurs” or “we”.

When using certain social media functionalities, for example when maintaining the Finnish Entrepreneurs' page on Facebook, we may also be joint controllers with the social media service provider in question.

***

This privacy policy applies to situations where the Federation of Finnish Entrepreneurs and its regional and local associations and Suomen Yrittäjät Sypoint Oy jointly determine the purposes and means of processing personal data, and therefore act as joint controllers within the meaning of data protection legislation. None of the parties to the processing could fulfil the purposes of the processing described in this privacy policy without the other parties.

The joint controllers have agreed that the Federation of Finnish Entrepreneurs is responsible for providing information through this privacy policy and is the primary party you can contact when exercising your rights. This does not prevent you from contacting, for example, your local association regarding the processing of personal data.

Regarding Finnish Enterprises, you can primarily contact:

• Finnish Entrepreneurs Association
• Postal address: PO Box 999, 00101 Helsinki
• Visiting address: Kyllikinportti 2, 00240 Helsinki
• Email address:  jasenpalvelu@yrittajat.fi
• Phone number: 09 229 221

To exercise your rights, you can contact the persons named in “Where do we disclose personal data?”.

In addition, we have agreed on the following regarding joint data protection:

• Representatives of a local association only have access to their own association's membership information.
• Representatives of regional organizations have access to the CRM system, which processes the personal data of members, elected officials, stakeholders, event participants and potential member representatives. Representatives of the regional organization have limited access to the data and can only edit their own member data.
• Representatives of the central organization, the Federation of Finnish Entrepreneurs, have access to and the right to edit all personal data described in this privacy policy. The central organization may produce statistical analyses for the use of regional organizations based on the data. At the Federation of Finnish Entrepreneurs, we process the data of representatives of elected officials, stakeholders, customers and potential members in the interests of both the local organization, the regional organization and the central organization: for example, membership acquisition measures aim to ensure that the company becomes a member of the local organization.

We also act as joint controllers when we maintain a page on Facebook or utilize Facebook features on our pages, such as the Like button. We are joint controllers with Facebook for usage data on our Facebook pages. We collect statistical data, such as likes and visits to our Facebook pages, the visibility of our publications, and the demographic profiles of the people our publications have reached. We also see the public information of people who have liked or commented on our pages, such as their name and profile picture, and other information in accordance with the privacy settings set by the user on Facebook. Find out more about the processing of personal data From Facebook's privacy policy.

Our mobile applications, which are made available to the user through, for example, the Apple App Store, Google Play or Microsoft Store, are subject to this privacy policy and the privacy policies of the respective service provider. You can access them via the terminal device you are using or by visiting the website of the respective app store.

We process the personal data of individual members of the Federation of Finnish Entrepreneurs, representatives of member companies, trusted persons, representatives of stakeholder groups, customers, representatives of potential members, and users of the website and applications.

The data processed depends on the groups of data subjects, but mainly includes the data subject's name and contact information, as well as information related to the organization the data subject represents, such as publicly available information about the organization. We collect information about website users using cookies, as described in more detail in the cookie policy.

***

We process the following data groups about registered persons:

Individual members or contact persons of member companies

Groups of data subjects:

• member company representatives
• senior members
• student members
• honorary and supporting members

Information to be processed:

• personal data of the data subject, such as name, gender, language of service, date of birth, study information, address, telephone number, email, photograph, political party information
• membership information, such as membership information, changing associations, termination of membership and related reasons, billing and payment information, product and order information, customer feedback and contacts, communication tracking information
• Basic information about the organization represented by the data subject, such as the organization's name, business ID, industry information, number of employees, date of establishment of the company, public Business and Community Information System register information, and contact information, such as business, mailing and billing address, telephone number, email, social media web addresses, language of communication

Trustees

Data subject group:

• Trustees and representatives of the local associations, regional organizations and central organization of the Federation of Finnish Entrepreneurs
• Trustees and representatives of industry associations.

Information to be processed:

• personal information, such as name, address, email, telephone number, date of birth, gender
• information regarding the position of trust, such as the position of trust, the start date of the position of trust, and the end date of the position of trust

Stakeholder representatives

Groups of data subjects:

• political decision-makers
• officials
• media representatives
• representatives of other organizations
• Entrepreneurial candidates for political positions of trust
• other relevant stakeholders

Information to be processed:

• personal data of the data subject, such as name, address, email, telephone number, organization, job title and, for those holding or running for public office (MPs, municipal councilors), party information

Customers      

Data subject group:

• people registered for the event
• People who have purchased products, such as rewards products, or subscribed to the magazine
• recipients of an award, product or magazine

Information to be processed:

• personal data of the data subject, such as name and contact information, allergy information, date of birth, job title, information about entrepreneurial career or other achievements
• information about the organization represented by the data subject, such as the organization's name and contact information, billing information, membership of the organization
• Order-related information, such as the name and type of event, product, or order

Representatives of potential members

Data subject group:

• representatives of potential member companies

Information to be processed:

• personal data of the data subject, such as name and contact information, job title
• information about the organization represented by the data subject, such as the organization's name and contact information
• information that the data subject has provided, for example, when subscribing to a newsletter or making a contact request
• other information collected during a previous membership or customer relationship

Website and app users

Groups of data subjects:

• website users who do not log in to the services or otherwise provide their personal information
• website and application users who log in to services or download material, subscribe to a newsletter, request contact, or make an online purchase, or who can be identified by opening an email we send

Information to be processed:

• information about the use of services and the user's terminal device through cookies and other similar technologies
• information provided by the data subject themselves on forms, such as name, contact information, billing information, delivery address, membership of an organization

We can combine the above-mentioned information and derive new information from it through data analytics, for example, modeling the behavior of a specific segment (target group).

We process personal data mainly for the following purposes:

• information about individual members and representatives of member companies for membership management, communications, marketing, sales and operational development, as well as for the provision of member services
• information about trusted representatives for communication, issuing IDs related to electronic tools, checking the criteria for awarding merit badges, and storing the organization's trusted representative history
• stakeholder information for communicating about our operations and goals and for organizing stakeholder meetings and events
• customer information for the implementation of the event, delivery of the service or order, invoicing, collecting feedback, handling any complaints, marketing and sales
• information about the recipient of the award products to verify whether the criteria for the award are met and to issue a certificate of honor
• information about potential member representatives for membership marketing and sales
• website users' information for the provision of services (e.g. logging in and order delivery), for analyzing website usage and targeted marketing and advertising, and for ensuring data security

We process personal data:

• based on a contract, such as for managing the membership relationship and implementing member services, as well as, for example, for delivering an online store order or providing training
• based on legitimate interest, for example, for membership and trustee relationship management, as well as marketing, sales and related profiling
• based on consent, for example, for setting cookies, implementing the Business Directory service and electronic direct marketing in certain situations
• based on a legal obligation, for example, to maintain the association's membership register and to process personal data contained in documents to comply with accounting obligations

We may combine information about different data groups, such as membership information, event participation information, email opening information, and usage information of our services and analyze it statistically. We may profile you into a specific segment (target group) and use information derived from data analytics to develop our services and target marketing and advertising.

We do not make automated decisions that would have legal effects on the data subject.

***

We process data for the following purposes on the following grounds:

Agreement:
When we deliver an order, carry out an event for which the data subject has registered, or take care of our rights and obligations under the membership agreement of a personal member, the processing is based on the fulfillment of the agreement. Without the processing of personal data, we cannot deliver or invoice the order. If the provision of some information is voluntary, it is marked separately in each form.

Legitimate interest related to a member, trustee or customer relationship:
We process the data of member representatives and individual members for the purposes of member registration, electronic and other member communications, providing services and benefits associated with membership, conducting surveys and research that promote the purpose of the organization, noting, analyzing and compiling statistics on the anniversaries of member companies and entrepreneurs, and implementing and developing customer service and operations. We process the data of trusted persons for communications, issuing codes related to electronic tools, checking the criteria for issuing badges of merit, and recording the organization's trusted person history. We process the data of the recipient of an award or other product or magazine to deliver the products in question. Without processing personal data, we cannot fulfill the membership or customer agreement that we have made with the organization you represent or related to you, or enable a person to act in positions of trust in the organization. If you wish, you can influence the processing under “What rights do you have?” in the manner described.

Legitimate interest related to stakeholder communication:
One of the basic requirements of our operations is that we can promote the interests of our members. This can only be achieved through stakeholder communication. We believe that it is also in the interest of the data subject belonging to the stakeholder groups to learn about themes that are important to Finnish entrepreneurs and to pass on information to readers (media) or political stakeholders (political influencers). We believe that you can reasonably expect processing due to your public role. If you wish, you can influence the processing under “What rights do you have?”  in the manner described.

Legitimate interest related to other processing:
To the extent that we develop our services, conduct membership acquisition or other marketing and carry out related statistical analysis and profiling by combining information from different data sources, or ensure data security based on a legitimate interest, we believe that the processing is beneficial to both us and the data subjects. The processing of personal data enables us to offer you even better services, to inform people who are likely to be interested in our membership benefits, and to keep our services safe for all users. We strive to be as transparent as possible about our practices and to give you the opportunity to influence the “What rights do you have?”  in the manner described.

Consent:
We set cookies and process the personal data collected with them based on your consent. We may also ask you for consent for electronic direct marketing. You can withdraw your consent at any time. Failure to provide consent will result in the advertising you see not being targeted to you and you will not receive electronic direct marketing that is sent based on consent. We add the information of member companies and their representatives to the Business Directory service that have given permission for the publication of the information.

Legal obligation:
To the extent that we process personal data in the association's membership register on the basis of the Associations Act or process personal data contained in documents on the basis of the Accounting Act, the processing is based on compliance with a legal obligation. Also, in order to comply with the obligations of the General Data Protection Regulation, we must retain some information with which we can demonstrate our compliance with the Regulation.

We collect personal data primarily from the following sources:

• We obtain the information about the representative of a member company from the member company or the registered person themselves;
• We obtain information about trusted persons from the data subject themselves;
• information from stakeholder representatives from public sources, such as organisations' websites;
• We receive information about event participants when they register for the event;
• customer information, such as the recipient of a service, prize, product or magazine subscription, we receive from the subscriber of the service or product in question;
• information about potential member representatives from the PRH's list of established companies, from partners and from public information sources on the internet; and
• We collect information about website users using cookies or similar technologies or from the registered person themselves via forms or chat service.

We generally process personal data for as long as it is necessary for the purpose of the processing. We strive to ensure that the data we process is up-to-date and error-free. You can also control the retention period and scope of the data under "What rights do you have?" through the opportunities for influence described in more detail.

***

The retention periods for personal data vary by data group:

• We process the data of the member and the representative of the member company as long as the membership and/or the person's position in the organization in question is valid and we delete the data after 3 years have passed since the membership ended;
• We process the data of stakeholders' representatives as long as the person belongs to the stakeholder group in question due to their position and we delete the data within a reasonable time after a change of role;
• We retain the information of trusted persons for historical records and registers as long as the person has not objected to the retention of their personal data for the above purposes;
• We process customer data for an average of 3 years from the date of participation in the event or the end of the order, after which we process name and contact information as well as aggregate customer relationship information for marketing and sales purposes as described in the following section;
• We process the data of potential member representatives for an average of 3 years from the date of collection, provided that the data subject represents the organization targeted by marketing and sales and has not specifically requested the deletion of their data;
• We retain the information of website users for the duration of the membership or customer relationship and for 3 years after its termination, after which we process name and contact information as well as aggregated information about the membership or customer relationship for marketing and sales purposes in the manner described in the previous paragraph; and
• We retain any personal data contained in the documents for at least six years after the end of the financial year to which the transaction relates in order to comply with statutory accounting obligations.
• We retain the personal data of those who have given a ban on direct marketing to the extent necessary to comply with the ban.

You can influence the processing of your personal data in several different ways. The extent and means of exercising your rights depend partly on the purposes of use. You can, among other things, check the personal data stored about you, request its correction or completion, restrict or object to processing, refuse marketing, withdraw your consent, request the portability of your data or file a complaint with the supervisory authorities.

***

You can influence the processing of your personal data in the following ways:

Review, correct and delete information:

You have the right to inspect the personal data stored about you. At your request, we will correct, supplement or delete personal data that is incorrect, incomplete or outdated for the purpose of the processing. Personal data that is required to be retained by law cannot be deleted.

Transferring data:

If you wish, you can receive the personal data you have provided, which we process automatically based on consent or contract, in a commonly used machine-readable format and have it transferred to a third party.

Right to object to direct marketing and related profiling:

You can object to the processing of your data for direct marketing purposes at any time. You can object to electronic direct marketing by clicking on the link at the end of the email.

Right to object and restriction:

You may object to processing based on legitimate interest on grounds relating to your particular situation. For example, in such a situation, processing will be restricted for the period of time while the grounds for objection to processing are being assessed. Processing may also be restricted, for example, when you contest the accuracy of your personal data, in which case processing will be restricted for the period during which we can verify the accuracy of the data.

Withdrawal of consent:

You can withdraw your consent at any time. You can withdraw your consent to electronic direct marketing by clicking the link at the end of the email.

Cookie-related choices:

You can control the use of cookies and similar technologies by changing your cookie settings here. Please note that cookies that are essential for the use of our services (such as the shopping cart, login and cookie consent management tool cookies) will be used regardless of this choice.

Right of appeal:

You can file a complaint with an authority if you believe that your data has been processed in violation of this privacy policy and applicable legislation. The supervisory authority is the Data Protection Commissioner (www.privacyprotection.fi).

When exercising the above rights, we ask you to contact us primarily:

jasenpalvelu@yrittajat.fi

Please be prepared to prove your identity. We may ask you for additional information to verify your identity if necessary.

We generally choose secure data storage locations in Europe, including data centres and subcontractors. In some cases, data processing may require transferring or providing access to an organisation outside the EU or EEA. In such cases, we comply with the requirements of data protection legislation, including, among other things, requiring adherence to the EU Commission's Model Contractual Clauses.

We disclose information to third parties in carefully considered situations, for example to partners to provide member benefits, for research purposes, to authorities based on their legal request, to the receiving party in connection with a corporate transaction, or based on the consent of the data subject.

In connection with the implementation of digital advertising, third parties may collect information about users of our services through cookies as independent data controllers. In addition, we may disclose user cookie information to third parties so that they can target advertising on the pages of Suomen Yrittäjät or elsewhere on the Internet.

***

We disclose information in the following carefully considered situations:

Consent:
We may disclose your information to third parties if you have given your consent.

Membership benefits and other partners:
We may share your information with partners so that they can offer benefits related to membership or, for example, the guide you downloaded, to you or the member company you represent.

Proceedings:
We may disclose event participant information to partners essential to organizing events, such as catering, transportation, congress and travel agency companies.

Studies:
We may disclose information for statistical, scientific or historical research purposes, provided that the information has been altered in such a way that the data subject can no longer be identified.

Reorganization:
If we merge or otherwise reorganize our operations, your personal information may be disclosed to the receiving organization and its advisors.

Authorities:
We may disclose your personal data in a manner required by the competent authorities, based on applicable legislation.

Collection:
We may disclose your information to our selected partners to collect our receivables.

Digital advertising:
Based on your cookie consent, we may disclose your cookie ID and IP address, as well as information about the page you browsed (e.g. page URL, ad slot size) for the purpose of targeting advertising. The information cannot be used to identify you personally. For more information about cookies, please see our cookie policy.

We use third party services to ensure the lawful processing of data through contractual arrangements and by instructing third parties on the processing of data. These third parties process data only on our behalf and as personal data processors.

The secure processing of your personal data is important to us. We use various organizational and technical measures to protect your personal data from unlawful or unauthorized processing. With regard to our subcontractors, we ensure that we only use processors who implement adequate safeguards so that the processing meets the requirements of the General Data Protection Regulation and ensures the protection of the rights of the data subject. We conclude a data processing agreement with each processor in accordance with data protection legislation.

***

We use, among other things, the following safeguards to ensure the security of your personal information:

• Only certain, predefined employees of the controller have access to and are authorized to use personal data.
• The use of personal data is protected by user-specific IDs, passwords and access rights. The system is also protected by firewalls and other technical means.
• The data is located on a computer located in a data center on a server where unauthorized access is prevented.
• The data is located in locked and guarded facilities.
• Data is backed up regularly.

To the extent that we use subcontractors for processing and the data is processed on servers other than those under our control, we guarantee through contractual arrangements that personal data is processed in accordance with applicable data protection legislation. The processor of personal data must implement appropriate technical and organizational measures, such as:

• pseudonymization and encryption of personal data;
• the ability to guarantee the continued confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to quickly restore data availability and access in the event of a physical or technical failure; and
• a procedure for regularly testing, examining and evaluating the effectiveness of technical and organizational measures to ensure the security of data processing.

We reserve the right to update this privacy policy, for example due to the development of our services or changes in legislation or official recommendations. Changes to the privacy policy will be communicated in our services and/or personally, for example by email.

***

This privacy policy was last updated on February 27, 2025.

The previous privacy policy was published on February 14, 2023, when the Federation of Finnish Entrepreneurs' separate privacy policies regarding members, stakeholders, events, marketing, the website and online store were combined into a single privacy policy, and a new cookie consent management tool was introduced on the site.

You can find previous versions here:

• Privacy policy valid until February 27.2.2025, XNUMX
• Privacy policy valid until February 14.2.2023, XNUMX