Privacy Policy

Information on the processing of personal data at Fairness League initiative

Updated: 1st of September, 2026

Our initiative stores and processes personal data as required by the EU’s General Data Protection Regulation (GDPR).

1. Data Controller

Luoto & Company Oy

Business ID 2754976-5

Runeberginkatu 5, 00100 Helsinki, Finland

www.reiluudenliiga.fi

Contact person for data protection matters:

Lauri Nousiainen

lauri.nousiainen@luotocompany.fi

+358 40 718 4066

2. Whose Personal Data Do We Process?

We process the personal data of potential cooperation partners, users of our website, and other individuals connected with our operations.

3. What Personal Data Do We Process?

We may process, for example:

• First and last name
• Job title
• Contact details
• Other textual information related to cooperation
• Marketing consent or opt-out
• Information collected through cookies
• Information collected from social media channels

We process only personal data that is necessary for the relevant purpose.

4. Purposes and Legal Bases for Processing

Cooperation Relationships

We process personal data for managing cooperation relationships, providing services, administering agreements, invoicing, communications, and customer service.

Legal basis: performance of a contract or Luoto & Company’s legitimate interest in managing cooperation relationships.

When relying on legitimate interest, we assess the necessity of the processing, the individual’s position and reasonable expectations, as well as the effects of the processing on the individual.

You may object to direct marketing at any time.

Electronic direct marketing. Where consent is required by law, electronic direct marketing is based on consent. Consent may be withdrawn at any time.

Website and cookies. Strictly necessary technologies are used for the operation and security of the website.

Legal obligations. Personal data may also be processed for accounting purposes, compliance with obligations imposed by authorities, information security, and the establishment, exercise, or defence of legal claims.

Legal basis: compliance with a legal obligation or legitimate interest.

5. Where Do We Obtain Personal Data?

Personal data is primarily obtained directly from the data subject and in connection with customer and cooperation relationships.

Personal data may also be collected from public and lawful sources, such as:

• company websites;
• public business and contact information services;
• professional social media services;
• news sources and other publicly available sources; and
• other commercial data sources.

If personal data has been obtained from a source other than the data subject, we will provide the information required under Article 14 of the GDPR, as a rule, no later than at the time of the first communication with the data subject and in any event within one month of obtaining the data, unless a lawful exception applies.

6. Recipients and Service Providers

We do not sell personal data.

In processing personal data, we may use, for example:

• cloud services;
• email and communications services;
• website and hosting services;
• analytics and marketing services;
• financial administration and IT service providers; and
• other business support services.

Service providers process personal data on behalf of Luoto & Company in accordance with applicable agreements. Personal data may be disclosed to public authorities where required by law and, where justified, in connection with corporate transactions or restructuring.

7. Transfers of Personal Data Outside the EU and EEA

Some service providers or their subcontractors may process personal data outside the EU or EEA.

In such cases, we use a transfer mechanism permitted under the GDPR, such as:

• an adequacy decision by the European Commission;
• the EU–US Data Privacy Framework, where the recipient participates in the framework;
• the European Commission’s Standard Contractual Clauses (SCCs); or
• another transfer mechanism permitted under the GDPR.

Where necessary, we use supplementary technical, organisational, or contractual safeguards.

Further information about the transfer mechanisms used may be requested from the contact person for data protection matters.

8. Retention Periods

We retain personal data only for as long as required by the purpose for which it is processed or by applicable law.

The main retention periods are:

• Data relating to cooperation relationships: for the duration of the relationship and for up to 2 years after its termination;
• Data relating to potential cooperation relationships: for up to 2 years from the most recent relevant contact or review of the data;
• Contact requests: for up to 2 years after the matter has been concluded;
• Marketing consents: for as long as the consent remains valid;
• Marketing opt-outs: for as long as retention is necessary to comply with the opt-out;
• Accounting and contractual records: for the period required by law;
• Cookie and analytics data: in accordance with the retention periods specified in the cookie settings.

When there is no longer a legal basis or other justification for retaining the data, it will be deleted or anonymised.

9. Protection of Personal Data

We protect personal data using appropriate technical and organisational measures.

Access to personal data is restricted to persons whose duties require such access. Where appropriate, we use measures such as access control, individual user credentials, strong authentication, protection of data communications, backups, and information security monitoring.

10. Rights of the Data Subject

Under applicable legislation, you have the right to:

• access your personal data;
• request the rectification of inaccurate personal data;
• request the deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• in certain circumstances, receive your personal data and have it transmitted to another data controller;
• withdraw your consent at any time; and
• lodge a complaint with the competent supervisory authority.
• In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
• Requests concerning data protection may be submitted to lauri.nousiainen@luotocompany.fi.

We will respond to requests without undue delay and, as a rule, within one month. Where necessary, we may request additional information to verify the identity of the person making the request.

11. Automated Decision-Making

Luoto & Company does not make decisions based solely on automated processing of personal data that produce legal effects concerning the data subject or similarly significantly affect the data subject.

12. Cookies

The website does not use tracking cookies.

13. Changes to This Privacy Notice

We may update this privacy notice if our operations, systems, or applicable legislation change.

The current version will be published on our website. Where necessary, we will separately inform data subjects of material changes concerning the processing of personal data.