Privacy Policy

1. Data Controller

This Data Protection Policy covers the use of personal data for marketing, sales, and support purposes by Confirma Finland, with its respective companies (listed below) acting on its behalf as Joint Data Controllers. Inquiries regarding data protection should be directed to DL Software Oy, the group’s representative (see contact details in section 2). 

Confirma Finland is part of the Confirma Software Group, headquartered in Solna, Sweden, under Confirmasoft AB (Swedish Business ID 559203-6486). The companies belonging to Confirma Finland are:

• DL Software Ab (Business ID 1013484-6)
• Ab DL Software International Oy (Business ID 0660505-1)
• SKJ Systems Ltd Oy (Business ID 0869218-7)
• Nethit Systems Ltd Oy (Business ID 1742225-0)
• Cash-In Consulting Oy Ab (Business ID 0646115-8)
• Tietoaika (Business ID 0646080-9)
• NetBaron Solutions Oy (Business ID 1793463-5)
• Computer Program Unit Oy (Business ID 0635481-1)

This privacy policy does not apply to situations in which Confirma Finland processes data on behalf of a customer acting as a data controller and in which Confirma Finland, as a result, acts as a data processor. 

2. Data Protection Officer

Confirma Software's Data Protection Officer is Sebastian Sandvik.

All requests regarding the data subject’s rights should be sent by certified mail to the following address: 

Confirma Finland / Data Protection
c/o DL Software Oy
Uumajankatu 2
65350 Vaasa, Finland

For general questions about the processing of personal data, you can also send an email to info@confirma.fi. 

3. Purpose of Processing Personal Data

The purpose of processing marketing data is to provide Confirma’s customers and other data subjects with up-to-date information about Confirma’s products and services, as well as other news that may be of interest to the data subject. 

The purpose of processing marketing data—other than for newsletters and direct business-to-business marketing and sales—may also be to provide existing and potential customers with new services or products, and to inform them about what Confirma has to offer.

4. Categories of Personal Data

For marketing and newsletter purposes, the following categories of personal data may be processed:

• Name 
• Email address 
• Phone number 
• Organization Name 
• Organization ID 

For customer relationship purposes, including support, and for the purpose of providing the services purchased by the data subject or the organization represented by the data subject, the following categories of personal data may be processed:

• Name
• Title
• Personal Identification Number
• Date of Birth
• Address
• Previous addresses
• Email address
• Phone number
• Customer Number
• Bank account number
• Electronic billing address
• Customer group
• Financial Management and Other Program Identifiers
• Username for programs and the customer service portal
• Organization Name
• Organization ID and VAT number
• Organizational Industry

Confirma does not retain the aforementioned information in all cases; only the information that is or may be necessary for managing customer relationships is used. The data is processed electronically in Confirma’s various customer management programs, depending on the services provided to the customer.

Confirma may, in exceptional cases, process sensitive data to the extent that such data may be necessary for debt restructuring, bankruptcy proceedings, or other processes in which the customer’s social rights must be protected, or if Confirma considers the data necessary to defend its own rights or those of a third party in legal proceedings. Sensitive data is not processed as part of regular processing activities.

5. Legal Basis for Processing

The legal basis for processing the data in the customer registry is primarily the fulfillment of agreements between Confirma and its customers. The processing of contact person data is based on Confirma’s legitimate interests in maintaining cooperation with the customer, as well as in demonstrating what instructions the customer has provided and how obligations have been fulfilled. This legitimate interest is weighed against the risks associated with the processing. The interest is considered particularly strong because the processing of contact person data is a necessary condition for the functioning of the customer relationship and the provision of software that is essential to the customer’s business activities.

Certain mandatory laws, including accounting requirements, require the processing of personal data, including when such data has become part of Confirma’s accounting records. The legal basis for processing in this case is the fulfillment of Confirma’s statutory obligations.

Confirma regularly sends email messages about the company’s products and services, industry or company developments, and events and occasions organized by Confirma. The processing of the recipient’s data is based on the consent given by the data subject when registering for the email list.

The data subject has the unrestricted right to withdraw their consent to processing, after which all processing based solely on consent will be terminated. Withdrawal of consent generally does not affect processing if the processing is not based on consent.

6. Data Retention Period

Confirma retains personal data until the agreement between the parties ends, or until there is no longer a legal basis for processing, or until the personal data is no longer required for the purpose of processing, whichever occurs first. Data is automatically deleted at regular intervals. However, upon termination of the agreement, Confirma may retain data necessary to comply with statutory requirements, such as those set forth in the Accounting Act.

Furthermore, Confirma may retain personal data if such information is needed to document communications or to defend itself or third parties against asserted claims. If the contact person requests the deletion of data, Confirma will delete all contact person data that is not necessary to comply with statutory requirements, contractual obligations, or legitimate interests.

7. Data Sources

The personal data processed in the registry come from the data subjects themselves, the population information system, trade and business registries, postal registries, courts, and enforcement authorities. Confirma may also obtain data from private registries for marketing purposes.

In cases where it is found to be very difficult to contact the data subject using the aforementioned data sources, Confirma may use other reliable sources, such as private address or telephone directories, or foreign authorities.

8. Transfer of Personal Data

Data in the customer registry may be transferred to authorized parties, courts, government agencies, credit reporting agencies, and other business partners that the customer uses, in accordance with the customer’s instructions.

Confirma does not regularly transfer data to recipients outside the European Economic Area (EEA). However, if Confirma transfers data to such recipients on an exceptional basis—for example, when the data subject has moved outside the EEA—it will ensure that the recipient complies with the requirements of applicable law.

9. Data Subject Rights to Access, Rectification, Restriction, and Objection

The data subject has the right to access the personal data processed about them. Data subjects also have the right to correct inaccurate data and the right to object to the processing to the extent that the processing is based on the public interest or the legitimate interests of Confirma or a third party. All data requests and other requests related to rights must be made in writing and in a manner that allows Confirma to verify the identity of the requester.

10. Automated Decision-Making

Confirma does not use automated decision-making or profiling in the processing of personal data, as defined in Article 22 of the General Data Protection Regulation and other relevant legislation. Confirma may, for example, use automated deletion of personal data in accordance with predetermined specifications, but does not use automated decision-making or profiling that produces legal effects concerning the data subject or that similarly significantly affects the data subject.

11. Supervisory Authority

The Finnish Data Protection Authority oversees the processing of personal data in Finland. This also applies to situations where companies belonging to Confirma Finland operate outside of Finland. Data subjects have the right to file a complaint with the supervisory authority.

12. Cookies