Privacy policy for clients
B2 Impact Oy is committed to upholding the rights of data subjects and the protection of personal data. This privacy statement describes how B2 Impact Oy collects, processes, stores and protects your personal data.
1. Data controller
B2 Impact Oy
Business ID: 0873725-0
Tiilitehtaankatu 7 A
FI-65100 Vaasa, Finland
2. Contact person for privacy matters
B2 Impact Oy
Tiilitehtaankatu 7 A
FI-65100 Vaasa, Finland
privacy@b2-impact.fi
3. Name of filing system
B2 Impact Oy client and marketing database
4. Legal basis and purpose of processing data
The processing of personal data is based on the execution of the legitimate interests of the controller (Article 6.1(f) and Recital 47), the performance of a contract within a client relationship (Article 6.1(b)), or the consent of the data subject (Article 6(1)(a)).
The purpose of processing personal data is to enable communication with the client and customers and for marketing activities.
5. Category of data subjects
The category of data subjects consists of the contact persons of clients, contact persons for potential clients, and contact details for the contact persons of the controller’s stakeholders.
6. Data content of the filing system
Name
Position within company
Telephone number
Email address
Company/organisation
Company’s industrial classification
Know Your Customer Information
Contact history
Information related to the customer relationship and assignments
Other classification and financial information on the company’s activities
7. Regular sources of data
Personal data is collected from the form available on the company’s website, in connection with commission agreements, and directly from the data subject through other means. In addition, personal data may be collected from public registries.
8. Regular categories of recipients
The controller may make use of an external subcontractor or software service provider to process personal data on behalf of the controller. In such cases, the controller is responsible for ensuring the lawfulness of processing.
9. Transfer of data outside the EU or EEA
The company will not transfer the personal data of data subjects outside the EU or EEA countries. Under certain conditions, certain processors of personal data acting on behalf of the company may transfer personal and other data of data subjects outside the EU or EEA. In such cases, however, the data will be transferred in compliance with the provisions of the EU General Data Protection Regulation on the protection of personal data. As the data controller, the company is fully responsible for the actions of processors acting on its behalf.
10. Period of storing personal data
Personal data will be stored for the period of time necessary for the management or establishment of the client relationship. Some data is also stored in connection with assignments submitted by the client and this data is stored for as long as necessary for the performance of the assignment. The retention periods are based on the Act on the Registration of Debt Collectors, the Act on the Prevention of Money Laundering and Terrorist Financing, and the assessment of necessity.
11. Profiling
The company does not carry out profiling of personal data in the filing system.
12. Description of technical and organisational protective measures
The processing of personal data is carried out with due diligence. Members of personnel who process personal data receive initial training and regular yearly training. Data in the filing system may only be processed by individuals entitled to do so by reason of their duties. Processors of personal data are subject to a non-disclosure obligation.
The company processes the personal data of the data subject in both printed and electronic form.
Printed material
Printed material is scanned into an electronic form and stored as part of the filing system. After this, the material is destroyed by disposing of it in a locked security bin.
Electronic material
The company has implemented the technical and organisational measures it has deemed necessary to protect the filing system from unauthorised access and use.
13. Right of access and right to rectification
The data subject shall have the right to access their personal data stored in the filing system. The request for access must be made in writing, and ensure that the company is able to verify the identity of the data subject. If necessary, the controller may ask the individual requesting access to prove their identity. Request for access must be submitted by email to privacy@b2-impact.fi. Rectification may be requested once each year without additional fee, after which the company shall charge an administrative fee of EUR 20 for each further request as compensation for the work caused. The company shall respond to the individual presenting the request within the period of time specified in the GDPR (usually one month from the request).
If a data subject finds their data to be inaccurate, they have the right to request that their data be rectified or erased. However, the right to erasure does not apply, inter alia, where a statutory obligation requires the retention of the data, where the data are still necessary for the purposes for which they were collected or otherwise processed, or where the processing is necessary for the establishment, exercise or defence of legal claims. The controller must notify third parties with whom they have shared the data or from whom they have received the inaccurate data of the rectification, unless this would require disproportionate effort. Reqests for rectification shall be submitted to the Data Protection Officer at privacy@b2-impact.fi.
14. Other rights of data subjects
In addition to the rights listed above, the data subject also has other rights. The rights can be exercised either by submitting a request to the Data Protection Officer at privacy@b2-impact.fi.
Data subjects have the right to request the restriction of processing until, for example, the controller has verified the accuracy of the data. Data subjects have the right to object to direct marketing at any time. If the personal data of the data subject is processed on the basis of consent, this consent may be revoked at any time.
Subject to certain exceptions, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. However, the company states that it does not engage in automated decision making based on profiling that would produce legal effects concerning the data subject or otherwise significantly affect them.
Data subjects have the right to file a complaint to the regulatory authorities on matters related to the processing of their personal data. In Finland, the leading supervisory authority in matters related to the processing of personal data is the Office of the Data Protection Ombudsman.
15. Changes to the privacy statement
This privacy statement may be updated at a later date, for example, due to changes in the company’s procedures on the processing of personal data or changes in official regulations or legislation. This privacy statement was last updated on 1st of July 2026.