PRIVACY POLICY

Salvos Oyj
Website visitors and representatives of customers, suppliers, and other stakeholders
Updated: September 24, 2026

In this Privacy Policy (“Privacy Policy”), we explain how Salvos Oyj (“we” or “the Data Controller”) collects, processes, and shares your personal information, and what your rights are regarding your personal information, when you visit our website, when you are our customer, or when you act as a representative of our customers, suppliers, or other stakeholders. The term “personal data” refers to any information relating to an identified or identifiable natural person.

It is important to us that you can trust us to handle your information securely and in accordance with applicable laws. We encourage you to read this Privacy Policy and contact us if you have any questions.

Data Controller

Data Controller: Salvos Oyj
Business ID: 2309400-3
Mailing Address: Zatelliitintie 17 B, 90440 Kempele
Visiting Address: Maustetie 12, 92930 Pyhäntä
Contact Information: asiakaspalvelu@salvos.fi

This Privacy Policy applies to the processing of personal data in the following situations:

• Visits to our website: o https://salvos.fi
• Processing of Personal Data of Our Individual Customers (In this context, a "data subject" is a natural person who enters into a contract with us.)
• Processing of personal data of our customers, suppliers, and representatives of other stakeholders (collectively, “Representatives”) (In this agreement, the party entering into the agreement with us is a legal entity. The data subject is a representative of the legal entity.)

"Data subject" refers to the person whose personal data we process.

Purposes of Processing Personal Data

We process your personal data only for the purposes described in this Privacy Policy or for other purposes that are separately disclosed to you at the time your personal data is collected, and only to the extent that the processing of personal data is necessary for each specific purpose of processing.

We collect and process your personal information for various purposes, depending on the role in which you interact with us.

Website visitors:

• Enabling Use of the Website: We process your personal data to enable you to use our website and its features, and to ensure the overall security, functionality, and stability of the website, including the prevention and detection of potential misuse and attacks that threaten the security of the website. The collection and further processing of your personal data on our website is primarily carried out using automated technical means, such as cookies and other similar technologies.
• Collecting and Processing Feedback: If you submit feedback to us through our website, we will process the personal information you provide in connection with that feedback in order to handle the feedback and to contact you regarding it.
• Improving Our Website: We process the personal data you provide to improve the quality and functionality of our website by analyzing the features and functions you use on the website, as well as by analyzing the sections of the website you visit.
• Direct Marketing: We process your personal data to send you customer and newsletter communications, investor announcements, and our catalogs, as well as for other direct marketing purposes, including conducting marketing analyses and creating marketing audiences to promote our marketing efforts.
• Communication with You: We process your personal data, for example, if you contact us through our website.

Individual Customers

• Order Processing and Delivery: We process your personal data to process your order and deliver the products to you.
• Customer Relationship Management: Managing the agreement between us and you, monitoring compliance with agreements, and preventing and investigating any suspected misconduct.
• Compliance with Applicable Laws: Compliance with tax and corporate compliance requirements, as well as compliance with requests from authorities, such as those based on tax or accounting laws or other legal obligations applicable to us.
• Billing: Handling and managing billing between you and us.
• Communication with You: Communication with you regarding your orders, such as responding to inquiries you have made.
• Direct Marketing: Direct marketing and sending you customer letters and information about our products and services, including conducting marketing analyses and creating marketing audiences to promote our marketing efforts.
• Improving the quality of our products and services: We process your personal data to develop and improve the quality, functionality, or user experience of our products and services.

Representatives:

• Order Processing and Delivery: We process your personal data to fulfill the order placed by the organization you represent and to deliver the products to that organization.
• Customer and Business Relationship Management: Entering into and executing agreements between us and you or the organization you represent; conducting due diligence , identifying potential customers and creating business opportunities, managing and developing business relationships, monitoring compliance with agreements, and preventing and investigating potential misconduct.
• Compliance with Applicable Laws: Compliance with tax and corporate compliance requirements, as well as compliance with requests from authorities, such as those based on tax or accounting laws or other legal obligations applicable to us.
• Billing: Handling and managing billing between the organization you represent and us.
• Communication with You and Third Parties: Communication with current or potential customers, suppliers, or other stakeholders in the course of our business, for example, with stakeholders to maintain and improve our relationships or to respond to requests or inquiries from representatives of potential or current stakeholders.
• Direct Marketing: Direct marketing and sending you customer letters and information about our products and services, including conducting marketing analyses and creating marketing audiences to promote our marketing efforts.
• Improving the quality of our products and services: We process your personal data to develop and improve the quality, functionality, or user experience of our products and services.

Categories of Personal Data Processed

We process the following personal data:

Website visitors:

Information Regarding the Use of the Website	such as your IP address, information collected through cookies, the time of your visit, your browser version, and information about your use of our website.
Customer Service Information	such as information about your interactions with us and the information you provide during those interactions, including information provided through our feedback channels.
Contact Information	such as your name, email address, and phone number.

 Individual Customers

Contact Information	such as name, email address, and phone number.
Payment Information	such as information about payments ordered and made, payment methods, and the details thereof, as well as billing information.
Order Information	such as details about the products and services ordered, the shipping address, and other shipping-related information.
Communication Content	such as the information you have provided to us through customer service, email correspondence, and other means of communication, as well as the timing and other details of the communications between you and us.

Representatives:

Contact Information	such as name, email address, and phone number.
Information Related to Business Relationships	such as the name and business ID of the organization you represent, your position within the organization, your language preference, details of meetings between us and you, and details of any agreement between us and you or the organization you represent, as well as your relationship to that agreement.
Communication Content	such as information provided to us during meetings, in email correspondence, and through other means of communication, as well as the timing and other details of communications between you and us.

Legal Bases for the Processing of Personal Data

The processing of personal data is based on the legal grounds listed in the tables below, depending on the role in which you interact with us.

 Website visitors:

Purpose of the Processing	Personal Data Processed	Basis for Processing
Enabling Website Access	Information related to the use of the website (excluding personal data collected through non-essential cookies)	Legitimate interest in maintaining a secure and functional website for business purposes and for communicating with current and potential customers (Article 6(1)(f) of the GDPR).
Collecting and Processing Feedback	Customer Service Information	Legitimate interest in maintaining the feedback channel (Article 6(1)(f) of the GDPR).
Improving Our Website	Information Regarding Website Use, Customer Service Information, Contact Information	Legitimate interest in maintaining the customer service channel and improving the website (Article 6(1)(f) of the GDPR).   The processing of personal data collected through non-essential cookies is based on your consent (Article 6(1)(a) of the GDPR).
Direct Marketing	Information Regarding Use of the Website, Contact Information	Consent (Article 6(1)(a) of the GDPR).
Communicating with You	Contact Information, Customer Service Information	Legitimate interest in maintaining a communication channel and communicating with current and potential customers (Article 6(1)(f) of the GDPR).

Individual customers:

Purpose of the Processing	Personal Data Processed	Basis for Processing
Order Processing and Shipping	Contact Information, Billing Information, Order Information, Communication Content	Processing for the purpose of performing a contract and taking steps at the data subject’s request prior to entering into a contract (Article 6(1)(b) of the GDPR)
Customer Relationship Management	Contact Information, Billing Information, Order Information, Communication Content	Legitimate interest in monitoring compliance with agreements and in preventing and investigating possible suspected misconduct (Article 6(1)(f) of the GDPR).
Compliance with Applicable Laws	Contact Information, Billing Information, Order Information, Communication Content	Legal obligation (Article 6(1)(c) of the GDPR).
Billing	Contact Information, Billing Information, Order Information, Communication Content	Processing for the purpose of performing a contract and taking steps at the data subject’s request prior to entering into a contract (Article 6(1)(b) of the GDPR)
Communicating with You	Contact Information, Billing Information, Order Information, Communication Content	Legitimate interest in maintaining a customer communication channel (Article 6(1)(f) of the GDPR).
Direct Marketing	Contact Information	Consent (Article 6(1)(a) of the GDPR).
Improving the Quality of Our Products and Services	Contact Information, Order Information, Message Content	We have a legitimate interest in developing our products and services based on information we receive from our customers (Article 6(1)(f) of the GDPR).

Representatives:

Purpose of the Processing	Personal Data Processed	Basis for Processing
Order Processing and Shipping	Contact Information, Business Relationship Information, Communication Content	Our legitimate interest is to store the contact information of our customers’ representatives and to contact them when our customers order our products or services (Article 6(1)(f) of the GDPR).
Customer and Business Relationship Management	Contact Information, Business Relationship Information, Communication Content	A legitimate interest in managing and developing customer relationships with customers, suppliers, and other stakeholders; fulfilling contractual obligations; conducting due diligence and background checks to the extent permitted by applicable law, as well as to ensure compliance with contractual obligations and investigate suspected misconduct in business relationships (Article 6(1)(f) of the GDPR).
Compliance with Applicable Laws	Contact Information, Business Relationship Information, Communication Content	Legal obligation (Article 6(1)(c) of the GDPR).
Billing	Contact Information, Business Relationship Information, Communication Content	The legitimate interest in managing finances, invoicing, and payment processing in business relationships (Article 6(1)(f) of the GDPR).
Communication with You and Third Parties	Contact Information, Business Relationship Information, Communication Content	Legitimate interest in maintaining and developing business relationships through communication with customers, suppliers, and other stakeholders (Article 6(1)(f) of the GDPR).
Direct Marketing	Contact Information, Business Relationship Information, Communication Content	Legitimate interest in providing information about our services to current and potential stakeholders and maintaining business relationships (Article 6(1)(f) of the GDPR).   If required by applicable law, we will send you direct marketing only with your consent (Article 6(1)(a) of the GDPR).
Improving the Quality of Our Products and Services	Contact Information, Business Relationship Information, Communication Content	We have a legitimate interest in developing our products and services based on information we receive from our customers (Article 6(1)(f) of the GDPR).

Cookies

We use cookies and identifiers on our website to ensure it functions optimally and that content is displayed correctly. A cookie is a text file that is stored in your browser or on your device. We use cookies to personalize the content and ads we offer, to support social media features, and to analyze our visitor traffic.

You can change your browser's cookie settings at any time. Please note, however, that blocking cookies may impair the website's functionality, and not all content may display correctly.

See the cookie banner on our website for more information about the cookies we use.

Chat Assistant

Our website's chat assistant is powered by artificial intelligence. It answers questions about our buildings and, if you wish, forwards your inquiry to a sales representative or customer service.

We store the chat messages, the page URL, and a random session ID. We use this information to answer your questions and improve our chatbot. This processing is based on our legitimate interest in serving our website visitors. Please do not include sensitive information, such as health information, in the chat.

Responses are generated by third-party AI services, which may process messages outside the EU, such as in the United States. These transfers are based on the European Commission’s standard contractual clauses. Service providers do not use the messages to train AI models. The chat operates on a server in Finland.

If you leave your contact information in the chat, it will be saved in our customer relationship management system in the same way as information submitted through other forms on the website. We’ll include your first question and a brief summary of the conversation with your contact request so that the sales representative can see what you discussed. The message you send to customer service will be forwarded to the customer service email address.

Conversations are deleted after 90 days. You can request information about your conversations or have them deleted by emailing asiakaspalvelu@salvos.fi.

Collection of Personal Information

We collect your personal information primarily directly from you or from the organization you represent. You may provide us with your personal information, for example, through our website, by email, during phone conversations, at meetings, or in documents you submit.

If you are a Representative, we may collect and update personal information from publicly available sources or from the registries of government agencies and companies that provide personal information services.

We may automatically collect personal information using cookies when you visit our website.

Retention Period for Personal Data

We retain personal data only for as long as necessary to fulfill the purpose of processing or to comply with legal obligations. The data will be deleted or anonymized when its retention is no longer necessary for legal purposes or for the exercise of the rights or obligations of the parties.

The personal data of website visitors is primarily processed during their visit to the website. The specific retention periods for cookies can be found in the cookie banner. If you contact us through our website, your inquiry will generally be retained for two (2) years, unless we have an additional obligation or right to process the personal data contained in the communication for a longer period. Personal data collected for direct marketing purposes is retained for two (2) years after the end of the marketing campaign.

Personal data of individual customers is generally retained for 5 years from the date of your order or from the last time we contacted you regarding a potential order. We may be required to retain certain information for a longer period, for example, due to mandatory accounting laws. For example, accounting records must be retained for 10 years after the end of the fiscal year.

With regard to representatives, personal data is primarily retained for as long as our customer or business relationship with the organization you represent continues, as well as for two (2) years after the termination of that customer or business relationship. We may be required to retain certain information for a longer period, for example, due to mandatory accounting laws.

Personal data processed based on your consent will be retained until you withdraw your consent or until there is no longer a need to process such personal data, whichever occurs first.

Disclosure and Transfer of Personal Information

We may disclose your personal information to third parties that we use as service providers or subcontractors, such as providers of services intended for the maintenance of personal information. We use trusted contractual partners with whom we have agreed on terms that comply with data protection laws.

We may disclose your information to authorities if required by law, for example, to prevent or investigate fraud or other illegal activities. Your personal information may also be disclosed to other parties pursuant to an order from a competent court or if required by mandatory legislation. In addition, we may disclose your information to a business acquirer or other party involved in a business reorganization in connection with a potential sale of the business or other business reorganization.

When transferring data, we ensure a high level of information security and data protection in accordance with the EU General Data Protection Regulation. Third parties and their subcontractors may transfer personal data outside the European Union or the European Economic Area. In such cases, we comply with applicable laws and their requirements, such as the Standard Contractual Clauses (SCCs) approved by the European Commission. The Standard Contractual Clauses are available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

We or our subprocessors may transfer your personal data outside the European Union or the European Economic Area if it is necessary for us to provide the service, for example, when using global cloud services. In connection with these services, personal data is primarily stored within the European Union, but in certain situations it may be transferred to countries where the service providers or their subprocessors operate. You may request additional information from us regarding the service providers we are currently using by contacting us at the email address provided at the beginning of this Privacy Policy.

Information Security Principles

The security of personal data is important to us. We have implemented appropriate technical and organizational measures to protect personal data:

• Access to the data is restricted to those individuals who need it to perform their job duties.
• Information systems and devices are protected by technical measures, such as firewalls and passwords.
• Our staff has been trained to handle data appropriately and in accordance with the instructions provided by the data controller.
• Backups of electronic files are made regularly.
• Materials containing personal information are disposed of in a secure manner.
• If, despite our security measures, a data breach occurs that is likely to adversely affect the data protection of data subjects, we will notify the competent authorities and the affected data subjects as soon as possible, if required by applicable data protection laws.

Your Rights as a Registered User

Below, we have compiled a summary of the rights you have as a registered user under mandatory data protection laws. The regulations governing some of these rights are complex in nature, and there are several exceptions to these rights. To keep this privacy policy concise, this summary does not include all the details of the regulations.

Access to Your Personal Information

You have the right to ask us whether we are processing personal data about you. If we are processing your personal data, you may request access to that data. You may also request information about how we process your personal data, as well as your rights regarding that data. If your personal data is inaccurate, you have the right to ask us to correct it.

Deletion of Your Personal Information (“Right to Be Forgotten”)

You may ask us to delete your personal information at any time. We must comply with your request unless we have a legitimate basis for continuing to process your personal information. Please note, however, that certain data may be subject to statutory retention periods, during which we are not permitted to delete such data.

The right to transfer data from one system to another

If we process your personal data based on your consent or a direct contract with you, and we do so using automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer it to another data controller.

Objection to Processing

You have the right to object to the processing of your personal data if the processing is based on our legitimate interests. Upon your objection, we will cease processing your personal data unless we have compelling legal grounds to continue processing. You also have the right to object to the use of your personal data for marketing purposes at any time, and we will stop such processing immediately. We will ask for your consent to send marketing communications when we collect your personal data.

Restriction of Processing

You have the right to request that the processing of your personal data be restricted in certain situations. If your request is granted, we will retain your data but will not process it further except under limited circumstances.

Withdrawal of Consent

If you have given your consent to certain processing activities, you may withdraw your consent at any time in the future. Withdrawing your consent does not affect the lawfulness of the processing carried out prior to the withdrawal.

How to Exercise Your Rights

You can exercise your rights by contacting us using the contact information provided at the beginning of this Privacy Policy. We may refuse to process your request if it is manifestly unfounded. If you request multiple copies of your personal data or submit more than one request per year, we may charge a reasonable fee to cover our administrative costs.

Appeals

If you believe that our processing of your personal data violates applicable data protection laws, you have the right to file a complaint with the competent supervisory authority. In Finland, the competent authority is the Office of the Data Protection Ombudsman (https://tietosuoja.fi/yhteystiedot). However, we hope that you will contact us first.

Changes to the Privacy Policy

We reserve the right to modify or update this Privacy Policy as necessary.