+358 50 464 7513 myynti@resaco.fi Rovaniemi · Remote-first
Book a Free Analysis

Privacy Policy

Last updated: 28 July 2026

This Privacy Notice explains how Resaco Oy processes personal data when you use our website, contact us, download material, subscribe to communications, apply for a role or otherwise interact with us online.

1. Controller

Resaco Oy
Business ID 3259870-5
Hallituskatu 26, 2nd floor
96100 Rovaniemi, Finland

Privacy contact: CEO Olli Junes
Email: olli.junes@resaco.fi
Phone: +358 45 6717 116

2. Scope

This notice applies to Resaco’s public websites and online forms. A separate agreement or notice may apply to customer projects where Resaco processes personal data on behalf of a customer.

3. Personal data we collect

  • Contact and lead data: name, company, work email, phone number, areas of interest, message and related correspondence.
  • Content and subscription data: name, work email, requested guide or other material, subscription choice and consent record.
  • Recruitment data: name, contact details, role interests, application text, CV or resume, LinkedIn or portfolio URL and information you choose to provide.
  • Customer and business relationship data: organisation, role, agreed services, communications, meetings, proposals, contracts, billing information and relationship history.
  • Technical and usage data: IP address, device and browser information, timestamps, referring page, pages viewed, interactions, consent choices and identifiers generated by permitted analytics or advertising tools.
  • Security data: server and application logs, fraud or abuse indicators and information needed to investigate incidents.

4. Sources of data

We receive data directly from you, from your organisation, through website forms and correspondence, from public business sources and, with your consent, from analytics and advertising technologies. We may combine these sources where necessary for the purposes described below.

5. Purposes and lawful bases

  • Responding to inquiries and preparing an offer: steps requested before entering into a contract, performance of a contract and our legitimate interest in managing business inquiries.
  • Managing customer relationships and delivering services: performance of a contract, compliance with legal obligations and our legitimate interest in maintaining appropriate business records.
  • Providing guides and requested materials: performing the action you requested and our legitimate interest in operating the service.
  • Sending optional newsletters or marketing communications: your consent where consent is required. You may withdraw it at any time.
  • Recruitment: taking steps at your request before a possible employment contract, complying with employment-related obligations and our legitimate interest in evaluating applications and defending legal claims.
  • Website analytics and advertising measurement: your consent. Non-essential technologies are not used before consent.
  • Security, troubleshooting and preventing misuse: our legitimate interest in protecting the website, users and business, and compliance with legal obligations.

Where processing is based on legitimate interests, we assess that the processing is necessary and proportionate and does not override your rights. You may object to such processing on grounds relating to your particular situation.

6. Where the data is stored and who receives it

Website form submissions are stored in the site’s WordPress and Gravity Forms database. Lead information is also transferred to Resapp, Resaco’s own ERP system, for sales and relationship management. Resapp is an internal Resaco system, not an external newsletter service.

Access is limited to Resaco personnel who need the data for their work. We may use carefully selected providers for hosting, IT support, email delivery, security, analytics, advertising, document handling and professional advice. These providers process data only under appropriate instructions and agreements. We may also disclose data where required by law or a competent authority, or where necessary to establish, exercise or defend legal claims.

There is currently no external newsletter platform connected to the website. If one is introduced, this notice and the relevant service information will be updated before it is used.

7. Analytics, advertising and external media

Subject to your consent, the production website may use Google Tag Manager, Google Analytics, Google Ads and Meta Pixel. LinkedIn Insight Tag may also be enabled. Google Tag Manager is a tag delivery system and may only activate non-essential tags according to your consent choice.

The site may contain YouTube or Vimeo videos. Data can be transferred to the video provider when you choose to load or play external media. Details of active technologies and your controls are described in our Cookie Policy.

8. International transfers

Some technology providers may process data outside Finland, the EU or the EEA, including in the United States. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision, the EU-US Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where needed.

9. Retention

  • Inquiries and lead data: up to 24 months after the last meaningful interaction, unless a customer relationship begins or longer retention is required for a legal claim.
  • Customer and contract data: for the customer relationship and afterwards for applicable statutory limitation and record-keeping periods. Accounting material is retained for the periods required by Finnish law, commonly 6 or 10 years depending on the record.
  • Newsletter and marketing choices: until consent is withdrawn or after 24 months of inactivity, unless a shorter period is configured.
  • Recruitment applications and attachments: up to 24 months after the recruitment decision. Longer talent-pool retention requires separate consent.
  • Technical and security logs: normally up to 12 months, unless longer retention is necessary to investigate an incident or legal claim.
  • Analytics and advertising data: according to the retention settings stated in the cookie controls and provider configuration.

Data may be anonymised and retained as statistics where it can no longer identify a person.

10. Security

We use access controls, role-based permissions, encryption where appropriate, backups, monitoring and contractual safeguards to protect personal data. No online system is completely risk-free, but we review safeguards in proportion to the nature of the data and processing.

11. Automated decision-making

We do not use website data for decisions based solely on automated processing that produce legal or similarly significant effects.

12. Your rights

Depending on the processing, you may have the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of data;
  • request restriction of processing;
  • object to processing based on legitimate interests and object at any time to direct marketing;
  • receive data you provided in a portable format where the legal requirements are met;
  • withdraw consent at any time without affecting processing carried out before withdrawal; and
  • lodge a complaint with a supervisory authority.

Send requests to olli.junes@resaco.fi. We may need to verify your identity. You may lodge a complaint with the Finnish Data Protection Ombudsman at tietosuoja.fi.

13. Changes to this notice

We may update this notice when our services, providers or legal obligations change. The current version and update date are published on this page.