Privacy Notice
Your rights as a data subject
Updated 22 October 2026
Despro Engineering Oy (hereinafter “Despro”), acting as the data controller, processes personal data relating to customers, prospective customers, job applicants, website users and stakeholders. Despro complies with applicable data protection legislation, including the General Data Protection Regulation (EU 2016/679) and the Finnish Data Protection Act (1050/2018).
This document describes what personal data Despro collects, how and for what purposes personal data is processed, how personal data is disclosed to third parties, and how individuals can exercise their rights relating to the processing of their personal data.
1 Contact details of the data controller
Despro Engineering Oy
Business ID: 2582048-6
Kanslerinrinne 1 A, 33100 Tampere, Finland
For enquiries concerning data protection, please contact us at tietosuoja@despro.fi
2 What personal data do we process and for what purposes
Despro processes personal data relating to customers, prospective customers, job applicants, website users and stakeholders for the purposes of offering and providing services, communications and marketing, recruitment, and website maintenance and development. The categories of personal data that Despro may process, the purposes of processing and the legal bases for processing are described in more detail below.
Personal data processed in connection with offering and providing services and responding to enquiries, including name, email address, telephone number, preferred language of communication, information relating to employment or professional engagement (e.g. organisation, job title and employment history), and information concerning contractual relationships. The information processed depends on the nature of the assignment. Processing is based on Despro’s legitimate interest in processing data when providing services and developing its services. Where the data subject is personally a party to a contract, processing is based on the performance of that contract.
Personal data processed for communications and marketing purposes, including name, email address, telephone number, preferred language of communication, information relating to employment or professional engagement (e.g. organisation, job title and employment history), special dietary requirements depending on the event, and any other additional information provided. The data is processed for communications, marketing, organising events, and targeting communications and marketing. Processing is based on Despro’s legitimate interest in marketing and communicating about its services. Processing the personal data of newsletter subscribers is based on consent, which may be withdrawn at any time using the link at the end of each newsletter. Special dietary requirements provided for events are processed only with the participant’s consent and solely for the purpose of organising the event.
Personal data processed in connection with recruitment, including name, email address, telephone number, location information, information relating to job applications (e.g. education, work experience and skills), and information concerning the recruitment process. Applicants may also voluntarily provide other information relevant to recruitment. The data is processed to assess applicants’ suitability, communicate with applicants, make recruitment decisions and develop recruitment processes. Processing is based on steps taken at the applicant’s request prior to entering into a contract. Documentation of recruitment processes and retention of data after the recruitment process has ended are based on Despro’s legitimate interest in ensuring the quality of recruitment and defending legal claims.
Processing may involve one or more of the following operations: collecting, recording, organising, registering, examining, storing, handling, modifying, selecting, using or deleting data.
Providing personal data is voluntary. However, without the necessary information, Despro may be unable to provide services or respond to enquiries. For certain assignments, providing specific information may be a statutory requirement.
3 Where do we obtain personal data?
Personal data is mainly collected directly from data subjects or, in connection with services offered and provided by Despro, from parties involved in those services. Personal data may also be obtained from public sources, such as publicly accessible websites. Despro may also use other sources to collect personal data concerning a data subject’s duties or position within an organisation, or information about the data subject’s public role. Job applicant data is generally obtained from the applicants themselves and, with the applicant’s consent, from referees.
Some personal data may also be derived data. For example, Despro may combine, supplement and analyse data in its possession to generate new information. Some of the data used for these activities may be collected from sources such as the Trade Register, company websites and other similar public sources.
4 To whom is personal data disclosed
Personal data is disclosed to Despro’s service providers where the provision of a service requires the processing of personal data. In such cases, contractual measures are used to ensure that personal data is processed and protected appropriately and in accordance with applicable laws and this document.
Personal data may also be disclosed to third parties to the extent necessary to provide the service. Compliance with statutory obligations may also require the disclosure of data, for example, to public authorities.
5 Transfers of data outside the EU or EEA
Personal data is not transferred outside the European Union (EU) or the European Economic Area (EEA).
6 Principles governing the retention of personal data
Personal data is retained for as long as necessary for the purposes for which it is processed. As a general rule, personal data relating to contact persons is retained for as long as their employment or professional engagement with the customer organisation continues. The accuracy and relevance of data collected for marketing purposes is reviewed at least every two years, at which point unnecessary or outdated data is deleted. We also comply with other statutory retention periods, including those required by accounting legislation. Information about special dietary requirements collected for events is deleted after the event. Personal data collected in connection with recruitment is retained for 12 months before being deleted.
7 Principles of personal data security
Despro follows good information management practices, exercises a high degree of care and applies strict information security measures to protect personal data.
Despro and all third-party service providers involved in processing personal data implement appropriate technical and organisational measures to protect personal data against unauthorised use and accidental or unlawful destruction, disclosure, transfer or other unlawful processing. However, users should be aware that the use of the internet and email always involves data protection risks and that absolute information security cannot be guaranteed.
Access to personal data is restricted to individuals who need it in order to perform their duties.
8 Rights of data subjects
Data subjects have the rights described below under applicable data protection legislation. Please note that the precise application of these rights in individual cases depends on the purpose and circumstances of the processing of personal data.
Data subjects are requested to submit requests concerning their rights by email to tietosuoja@despro.fi. Despro may ask data subjects to verify their identity before processing a request. Requests will be answered without undue delay.
Requests are free of charge. If requests are manifestly unfounded or excessive, Despro may charge a reasonable fee based on the administrative costs of handling the request or refuse to act on the request.
8.1 Right of access to personal data and to obtain a copy
Data subjects have the right to obtain confirmation as to whether their personal data is being processed and to receive the information concerning the processing of personal data specified in data protection legislation. Data subjects also have the right to obtain a copy of the personal data undergoing processing.
8.2 Right to review and rectify personal data
Data subjects have the right to review the personal data concerning them that has been recorded in the register. They also have the right to request the rectification of incorrect or inaccurate personal data and the completion of incomplete data.
8.3 Right to erasure
Data subjects have the right to have their personal data erased without undue delay, provided that:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- the data subject withdraws the consent on which the processing was based and there is no other legal ground for the processing;
- the personal data has been processed unlawfully; or
- the personal data must be erased to comply with a legal obligation under European Union or national law.
8.4 Right to restriction of processing
Restriction of the processing of personal data means that, apart from storage, the personal data subject to the restriction may be processed only:
with the data subject’s consent;
for the establishment, exercise or defence of legal claims;
for the protection of the rights of another natural or legal person; or
for reasons of important public interest of the European Union or a Member State.
Data subjects have the right to have the controller restrict processing if:
the data subject contests the accuracy of the personal data, in which case processing is restricted for a period enabling the controller to verify the accuracy of the data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests restriction of its use instead; or
the controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims.
8.5 Right to object to processing
Data subjects have the right to object to processing on grounds relating to their particular situation where processing is based on legitimate interests. In such cases, Despro will cease processing the data unless processing is permitted under an exception provided for in the General Data Protection Regulation.
Data subjects also have the right to object to direct marketing at any time without providing any justification.
8.6 Right to withdraw consent
Where the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw that consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. However, the data subject’s personal data may be retained if retention is necessary to comply with a legal obligation applicable to the controller.
8.7 Right to data portability
Data subjects have the right to receive personal data concerning them that they have provided to the controller in a structured, commonly used and machine-readable format, and to transmit that data to another controller where technically feasible.
8.8 Right to lodge a complaint with a supervisory authority
Data subjects have the right to lodge a complaint with a supervisory authority if they believe that the processing of their personal data infringes applicable data protection rules. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
9 Internet usage data and cookies
Internet usage data
The information systems and software used to operate the website collect certain personal data, the transmission of which forms part of internet communication protocols. Such data includes, for example, the IP addresses or domain addresses of the computers of website visitors and the URI addresses of requested resources. Information systems and software may also collect server data concerning the time of requests, the methods used to make requests, the sizes of files received in response, numerical status codes indicating the server’s response status, and other parameters relating to the user’s operating system and network.
This information is not collected or used to identify users. However, due to the nature of the information, identification may be possible by processing and combining it with information held by third parties.
Despro uses this information to compile statistics on website usage and to ensure that the website functions properly. Processing is based on Despro’s legitimate interest in maintaining a functional and secure website.
This information may also be used to investigate information security incidents or other criminal offences involving the website. Except where needed for the investigation of a criminal offence, information relating to website connections is deleted immediately after processing or within seven days at the latest.
Cookies
Despro uses cookies on its website. Cookies are small text files that a website stores on a user’s device. Data collected through cookies, such as cookie identifiers and IP addresses, may constitute personal data. We use the following categories of cookies:
Necessary cookies enable the basic functions of the website, such as website security and storing cookie preferences. Their use does not require consent, and they cannot be disabled.
Analytics cookies (Google Analytics 4 and Hotjar) collect information on website usage, such as pages visited and time spent on the website, to help develop the website and services.
Marketing cookies (Dealfront/Leadfeeder and Snitcher) are used to measure marketing effectiveness and to target and optimise marketing.
Analytics and marketing cookies are used only with the user’s consent. Consent is requested through a cookie banner when a user first visits the website. You can change your preferences or withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can also delete cookies already stored on your device through your browser settings.
Some cookies are set by third parties. These service providers may also process data collected through cookies for their own purposes in accordance with their own privacy policies.
10 Changes to this Privacy Notice
Despro may update this document due to changes in data processing or applicable legislation. The latest version of this Privacy Notice is always available on Despro’s website: https://www.despro.fi/en/home/