Privacy policy
Updated 28 October 2026.
1. Data controller
Hallitustuki, Business ID 2197418-9
Bulevardi 21, 00180 Helsinki
Email: posti@hallitustuki.fi
Telephone: 020 340 200
This notice covers personal data processed through hallitustuki.fi, appointment bookings, enquiries, the quotation process and the management of customer relationships for our board services.
As a rule, the housing company itself is the controller of personal data concerning shareholders, residents and other individuals processed in the company's own administration. The housing company's own privacy practices apply to that processing.
Online store and digital tools
Personal data processing in connection with orders, payments, digital deliveries and tool licences in Hallitustuki's online store is described in the store's own privacy notice. It also covers invoicing, the management of ongoing licences, data storage in the tools and advertising measurement.
Read the online store's privacy notice.
2. Purposes and legal bases of processing
We process personal data for the following purposes:
Handling enquiries and requests for quotations
We process data to respond to enquiries, assess service needs, prepare quotations and determine suitability for an assignment and any potential conflicts of interest.
Processing is based on Hallitustuki's legitimate interest in handling enquiries addressed to it and conducting its business. Where the data subject is personally a party to a contract, processing may also be based on taking steps prior to entering into a contract.
Appointment bookings and online meetings
We use SimplyBook.me to manage bookings, confirmations, reminders and cancellations, and Microsoft's calendar and Teams services to arrange meetings. For these purposes, we process the contact details you provide, the selected service, the meeting time and booking and cancellation details.
Processing is based on Hallitustuki's legitimate interest in responding to enquiries and arranging the requested meeting. Where you are personally a party to a future contract, processing may also be based on taking steps at your request prior to entering into that contract.
Managing contracts and customer relationships
We process data to prepare and perform contracts, communicate with customers, manage customer relationships and issue invoices.
Processing is based on a contract, steps prior to entering into a contract, or Hallitustuki's legitimate interest in managing the contact details of housing company representatives.
Statutory obligations
We process invoicing and accounting data to comply with accounting legislation and other applicable laws.
Website operation and security
We process technical data to maintain the website's operation and security and investigate errors. Processing is based on Hallitustuki's legitimate interest in maintaining a secure, functioning website.
The use of non-essential cookies is based on the user's consent.
3. Personal data we process
We may process the following data:
name, email address and telephone number
the person's position or role in the housing company
the housing company's name
the service selected or enquired about
appointment time, booking and cancellation details, and information needed to arrange an online meeting
information about the selection of enhanced board support
information about the housing company and its circumstances provided through a form, by email or by telephone
messages, attachments and other correspondence
quotation, contract, customer relationship, invoicing and accounting data
information needed to assess suitability for an assignment and conflicts of interest
technical website data, such as IP address, browser and device information, time, logs and cookie preferences.
Our forms do not ask for personal identity codes, health information or other special categories of personal data. Please do not enter such information in a form or send it by ordinary email. If we receive it unnecessarily, we will delete it without undue delay.
4. Sources of data
We obtain data primarily from the data subject or the housing company they represent.
Where necessary, we may verify information about the housing company, its representatives and potential conflicts of interest using public sources, such as the Finnish Business Information System and Trade Register.
If we obtain personal data from a source other than the data subject, we will inform them of this notice no later than our first communication with them, or otherwise within the period required by data protection legislation.
5. Recipients and service providers
Personal data is processed by persons authorised by Hallitustuki and by the following categories of service providers to the extent necessary to provide their services:
Webnode AG and its website, server, content delivery and form service providers
Microsoft as the provider of email, calendar and Teams services
SimplyBook.me as the booking service provider
Google as a provider of advertising performance measurement services
invoicing and accounting service providers
IT and information security service providers
legal advisers and insurance companies where necessary to handle a legal matter.
Information submitted through Webnode forms is stored in Webnode's system and may be sent to Hallitustuki by email.
Data may be disclosed to authorities where required by law. Personal data is not sold. Service providers may also process data for purposes described in their own privacy policies. Google's advertising measurement and the related choices are described in section 11.
6. Processing outside the EU and EEA
The website service is provided by Webnode AG, which is based in Switzerland. Switzerland is covered by a European Commission adequacy decision on data protection.
Webnode s.r.o., based in Czechia, is also responsible for Webnode's day-to-day operations. Webnode may use subcontractors to provide its service.
If data is transferred to another country outside the EU or EEA, the transfer is based on a European Commission adequacy decision or other safeguards under the GDPR, such as the Commission's standard contractual clauses. Further information about the applicable transfer mechanisms is available from the controller.
Microsoft's, SimplyBook.me's and Google's services may also involve processing personal data outside the EU and EEA. Their privacy policies describe their processing and the applicable safeguards for transfers: Microsoft Privacy Statement, SimplyBook.me Privacy Policy and Google's data transfer frameworks.
7. Retention periods
We retain data as follows:
enquiries and requests for quotations that do not lead to a customer relationship: up to 12 months after the last contact
customer, quotation and contract data: for the duration of the customer relationship and, as a rule, for three years after it ends
data needed to handle a legal claim: for as long as reasonably necessary to establish, handle or defend the claim
accounting records: for the period required by accounting legislation, generally six years from the end of the calendar year in which the financial year ended
technical logs: only for as long as necessary for website security, operation and the investigation of errors
cookie preferences: for the lifetime of the cookie or until the user changes their selection.
The same deletion periods apply to responses stored in Webnode's form management system and form submissions delivered by email.
8. Data subjects' rights
Depending on the circumstances, data subjects have the right to:
obtain confirmation of the processing of their personal data and access that data
request the correction of inaccurate or incomplete data
request the erasure of data
request restriction of processing
object to processing based on legitimate interests
receive the data they have provided in a portable format where the legal requirements are met
withdraw their consent to cookies or other processing based on consent.
These rights are not absolute. For example, accounting data subject to a statutory retention requirement cannot be erased before the retention period ends.
Requests to exercise these rights can be sent to posti@hallitustuki.fi. We may verify the identity of the person making a request where necessary.
Data subjects have the right to lodge a complaint about the processing of their personal data with the Office of the Data Protection Ombudsman:
Office of the Data Protection Ombudsman
P.O. Box 800, 00531 Helsinki, Finland
tietosuoja.fi
9. Required information
Information marked with an asterisk on our forms is needed to respond to an enquiry, process a request for a quotation or prepare a contract. If the required information is not provided, we may be unable to handle the enquiry or prepare a quotation.
10. Automated decision-making
Hallitustuki does not make decisions about you that produce legal effects or similarly significant effects based solely on automated processing of personal data. Google's processing in connection with advertising measurement and possible personalisation is described in section 11.
11. Cookies
The website uses cookies necessary for its operation and security and for remembering the user's cookie preferences. These cookies do not require consent.
Any functional, performance or marketing cookies are used only with the user's prior consent. Users can continue using the website with essential cookies only.
Google Ads measurement starts only if you accept marketing cookies. It is used to evaluate advertising results. Measurement involves event data relating to page visits, enquiries and appointment bookings, as well as technical data such as IP address, browser and device information and advertising identifiers. Analytics and marketing technologies that require consent are used on the basis of your consent.
Google may use the data it receives to measure advertising and, depending on settings and the consents given, to personalise content and advertising. Further information: How Google uses information from partner sites.
You can change your cookie preferences or withdraw consent at any time using the Cookie settings link in the website footer.
12. Protecting personal data
Access to data is restricted to people who need it to perform their duties. We use appropriate technical and organisational safeguards and require service providers that process personal data to comply with data protection legislation.
