25.5.2026

Huritao Oy ("Huritao") processes the personal data of clients, potential clients and stakeholders as a controller. Huritao processes the personal data in compliance with applicable data protection legislation, including the General Data Protection Regulation (EU 2016/679) and the Data Protection Act (1050/2018). This Privacy Notice describes the personal data that Huritao collects and how and for which purposes the personal data are processed. The Privacy Notice also describes how personal data are transferred to third parties and how you can exercise your rights related to the processing of personal data.

For more information about the cookies used on our website, please see our Cookie Policy.

1 CONTACT INFORMATION OF THE CONTROLLER

Huritao Oy

Business ID: 3597676-7

Address: Rikhardinkatu 2, 00130 Helsinki, Finland

Contact information for data protection matters

E-mail: privacy@huritao.com

2 WHAT PERSONAL DATA WE PROCESS AND FOR WHAT PURPOSES

Huritao processes personal data of clients, potential clients and stakeholders for carrying out assignments, the fulfilment of legal obligations and for communication and marketing purposes.

Please find below a more detailed description of the personal data that Huritao may process, the purpose of the processing and the legal basis for the processing.

• Data processed in connection with assignments, including name, date of birth and/or personal identification number, email address and telephone number, preferred language, information relating to employment or service relationship (e.g. organisation, job title, work history), nationality, any telephone or audio or visual recordings, information relating to contractual relationships. The data processed depends on the nature of the assignment. Processing of special categories of personal data may also be necessary for carrying out the assignment. The processing is based on Huritao's legitimate interest to process information in connection with the provision of services and to develop its own services.

• Data relating to legal obligations, such as data relating to knowing your customer, insider lists or conflict of interest checks. This data may include special categories of personal data, such as information on political opinion or position. The data is processed on the basis of a legal obligation imposed on the controller. The data processed in connection with assignments is also processed on the basis of a legal obligation.

• Data processed for communication and marketing purposes, including name, email address and telephone number, preferred language, information relating to employment or service relationship (e.g. organisation, job title, work history), depending on the event special dietary requirements and any other additional information provided. The data will be processed for communication, marketing, and event organisation purposes and for targeting the communication and marketing. The processing is based on the legitimate interest of Huritao to market and communicate its services.

3 WHERE PERSONAL DATA IS OBTAINED FROM

Personal data is mainly collected directly from the data subject or with regard to Huritao’s assignments from other parties related to the assignment. Personal data may also be obtained from public sources, such as public websites. In addition, Huritao may use other sources to collect personal data related to the data subject's tasks or position in the organisation or information about the data subject's public position.

Some of the personal data may also be derived data. For example, Huritao may combine, supplement and analyse information in its possession to create new information. Some of the data used for such activities may be collected from sources such as trade register, company websites and other similar public sources.

4 TO WHOM THE DATA IS DISCLOSED

Personal data is disclosed to Huritao's service providers if the provision of the service requires the processing of personal data. In such cases, contractual measures are taken to ensure that the personal data is processed and protected appropriately and in accordance with applicable laws and this Privacy Notice.

In addition, personal data may be disclosed to third parties to the extent that such disclosure is necessary for carrying out the assignment. Compliance with legal obligations may also require disclosure of data for example to authorities.

5 TRANSFER OF DATA OUTSIDE OF EU OR EEA

Personal data will not be transferred outside the EU or EEA.

6 PRINCIPLES FOR THE STORAGE OF PERSONAL DATA

Personal data will be stored for as long as necessary for the purposes for which the personal data are processed. In general, personal data of contact persons will be stored for as long as the employment or service relationship with the client organisation lasts. Data collected for marketing purposes will be reviewed at least every two years to ensure that they are up to date, at which time any unnecessary or outdated data will be deleted.

7 PRINCIPLES FOR THE PROTECTION OF THE REGISTER

Huritao follows good data management practices, a high level of due diligence and strict security measures for the protection of personal data.

Huritao and all third-party service providers involved in the processing of personal data implement appropriate technical and organisational measures to protect personal data against unauthorised use and accidental or unlawful destruction, alteration, disclosure, transfer or other unlawful processing.

Access to personal data is limited only to those persons who need it in order to carry out their tasks.

8 RIGHTS OF THE DATA SUBJECT

The data subject has the rights under data protection legislation described below in this notice. Please note that the specific application of these rights in each individual situation will depend on the purpose and context for which the personal data is processed.

The data subject is requested to send any requests concerning their rights by e-mail to:

privacy@huritao.com

In general, Huritao will not charge a fee from the data subject for processing the request. However, if the data subject's requests are manifestly unfounded or unreasonable, for example because of their repetitive character, Huritao may charge the data subject a reasonable fee based on the administrative costs of processing the request.

8.1 Right of access by the data subject and right to obtain a copy of personal data

The data subject has the right to obtain confirmation as to whether their personal data is being processed, as well as information on the processing of personal data as defined in data protection legislation. In addition, the data subject has the right to obtain a copy of the personal data being processed.

8.2 Right to review and rectification

The data subject has the right to review what information concerning them has been stored in the register. The data subject has the right to request the rectification of incorrect or inaccurate personal data.

8.3 Right to erasure

The data subject has the right to obtain the erasure of personal data concerning them without undue delay, when

• the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;

• the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;

• the personal data has been unlawfully processed; or

• the personal data has to be erased for compliance with a legal obligation in Union or Member State law.

8.4 Right to restriction of processing

Restricting the processing of personal data means that the personal data subject to the restriction may be processed, in addition to being stored, only:

• with the consent of the data subject

• for the establishment, exercise or defence of a legal claim

• for the protection of the rights of another natural or legal person

• for reasons of important public interest of the Union or of a Member State

The data subject has the right to obtain from the controller restriction of processing, if

• the accuracy of the personal data is contested by the data subject, in which event the processing is restricted for a period enabling the controller to verify the accuracy of the personal data;

• the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of a legal claim.

8.5 Right to object

The data subject has the right to object, on grounds relating to their personal situation, the processing of personal data if the processing is based on a legitimate interest. In such cases, Huritao ceases the processing, unless the processing is allowed under an exception in accordance with the General Data Protection Regulation.

In addition, the data subject has the right to object to direct marketing at any time, without reason.

8.6 Right to withdraw consent

Where the processing of personal data is based on the data subject's consent, the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. However, the personal data of the data subject may be retained if the retention of the personal data is necessary to comply with a legal obligation imposed on the controller.

8.7 Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller, where technically feasible.

8.8 Right to lodge a complaint with supervisory authority

The data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes the applicable data protection regulation.

9 CHANGES TO THE PRIVACY NOTICE

Huritao may update the Privacy Notice due to changes in data processing or applicable law. The latest Privacy Notice is always visible on Huritao's website.