Skip to content

Privacy Policy and Data Register Description

Privacy Policy and Data Register Description

 

Innovation Home Oy, updated 15.09.2026

Contact information
Company: Innovation Home Oy ("IH")
Business ID: 2709251–5
Address: Kansakoulukatu 3, 00100 Helsinki
Email: work@innovationhome.fi

Data Protection contact: Tommi Aaltonen

 

Innovation Home's data protection principles

Innovation Home respects your privacy and follows these principles when processing personal data:

1. We value the trust you place in us when you give us your personal data. We always use your personal data fairly and in a way that is worthy of that trust.
2. You have the right to clear information about how we use your personal data. We are always open about what data we collect, how we use it, who we share it with, and who you can contact if you have questions.
3. If you have questions about the use of your personal data, we will resolve them together without delay.
4. We take all reasonable measures to protect your data from misuse and to keep it safe.
5. We comply with all applicable Finnish and EU data protection legislation and cooperate with data protection authorities.
6. We take data protection into account in all of our services and are happy to answer our customers' data protection questions.
7. Our staff's employment contracts include a duty of confidentiality regarding all customer-specific information they have access to due to their duties. Access to customer data is limited to what is necessary to perform their duties.

 

Innovation Home's registers

IH maintains registers of its customers, contact persons, prospective customers, and its own staff. IH uses data collected directly from data subjects for communication, developing its own services, and maintaining contact with the aforementioned stakeholders. Communication may also include marketing communications, but this is limited to IH's own services. IH does not use personal data received from contractual customers or partners for the above purposes without the consent of the party concerned.

Only data necessary for the purpose of the register is stored in the registers. The deletion principles are described for each register below. Data stored in log files and messages already sent are not deleted, as they may be needed even years later to investigate potential misuse or resolve a dispute.

 

Content and processing principles of Innovation Home's registers

IH maintains registers of its customers, contact persons, prospective customers, and its own staff. IH uses data collected directly from data subjects for communication, developing its own services, and maintaining contact with the aforementioned stakeholders. Communication may also include marketing communications, but this is limited to IH's own services. IH does not use personal data received from contractual customers or partners for the above purposes without the consent of the party concerned.

Only data necessary for the purpose of the register is stored in the registers. The deletion principles are described for each register below. Data stored in log files and messages already sent are not deleted, as they may be needed even years later to investigate potential misuse or resolve a dispute.

Customer and Contract Registers (Hubspot)

  • Legal basis: performance of a contract
  • IH's information systems and paper archives
  • Customer and contact person details, contracts, offers, correspondence, meeting notes, email conversations, and calendar entries
  • Contact details are deleted upon request; other data is not deleted. Deletion can be requested at work@innovationhome.fi
  • Access rights held by IH staff and parties comparable to them

Billing Information Register

  • Legal basis: performance of a contract as well as a legal obligation (Accounting Act)
  • Procountor system
  • Customer's billing address and billing-related details, e.g. reference number and payment terms
  • Data is deleted upon request. Data on invoices already sent is not deleted. Deletion can be requested at work@innovationhome.fi
  • Access rights limited to IH staff and accountants who need the data to perform their duties. Accounting has been outsourced to Tili & Talous Kettunen Oy (Business ID 0868902-5).

Customer Information Register

  • Legal basis: performance of a contract for the designated contract contact person's data; processing of other members' data is based on IH's legitimate interest in administering membership, access control, and providing the service
  • IH's booking system Asio and HubSpot (CRM)
  • Email addresses, phone numbers, and position of customers' contact persons
  • Marketing opt-outs (all marketing, email only, SMS only)
  • Segmentation for targeting communications (e.g. contractual matters, marketing messages, industry-specific needs)
  • Contact details of companies and decision-makers may also be obtained and updated from public B2B data sources (Vainu)
  • Data is deleted upon request. Messages already sent are not deleted. Deletion can be requested at work@innovationhome.fi

Staff payroll register

  • Legal basis: legal obligation as well as performance of a contract (employment contract)
  • Payroll processing has been outsourced to Tili & Talous Kettunen Oy (Business ID 0868902-5)
  • Statutory data required for salary payment and annual reporting, including the personal identity code, which is collected solely for this HR purpose
  • Data is deleted upon request once the annual report has been completed. Salary payments already recorded are not deleted. Deletion can be requested at work@innovationhome.fi
  • Access rights limited to accountants, payroll processors, and IH's designated payroll administration staff

Staff employment contract register

  • Legal basis: performance of a contract as well as a legal obligation
  • Employment contracts, employment certificates, salary data, CVs, confidentiality undertakings. Stored in SharePoint and in the payroll system
  • Data is not deleted
  • Access rights limited to IH's management

Marketing Register

  • Legal basis: legitimate interest (B2B direct marketing)
  • HubSpot (CRM) and Mailchimp
  • The Mailchimp recipient list partly contains different contact details than HubSpot, for example contact details of businesses in the Arabia 135 block
  • Names and email addresses of contact persons at organisations in target industries
  • Used solely for communications related to IH's services
  • Collected from customers' public websites, member registers, or other public sources, including public B2B company information services (Vainu)
  • Data is deleted upon request. Messages already sent are not deleted.

User access data register

  • Legal basis: performance of a contract
  • Asio booking system
  • Data is deleted at the request of the individual or the organisation's administrator. Bookings already made or other database updates are not deleted. Deletion can be requested at work@innovationhome.fi

Access control and video surveillance register

  • Legal basis: legitimate interest (security, protection of property)
  • Avigilon Alta video surveillance system
  • Surveillance cameras only cover premises administered, rented, or owned by IH
  • Cameras are used to protect the property of IH and its customers and to ensure personal safety
  • Cameras do not record audio and do not use facial recognition
  • Recordings are retained for 30 days, after which they are deleted and overwritten
  • Access to recordings is limited to IH's responsible person (Tommi Aaltonen). No other IH employees have access to the system
  • Data is deleted at the request of the individual or the organisation's administrator. The requester must state the exact time when they, or a representative of the organisation they represent, appear in the recording

Printing System

  • Purpose: providing printing, scanning, and copying services
  • Legal basis: performance of a contract (membership/service agreement) as well as legitimate interest (security, service quality)
  • Data categories: name, email address, user ID/PIN/access card, usage log (job, time, page count), and the recipient's email address for scans
  • Processors: Canorama Oy; Canon uniFLOW Online (NT-ware Systemprogrammierung GmbH, Germany, EU/EEA)
  • Print jobs are retained for 3 days; logs only for as long as necessary
  • More information: uniFLOW Online Security White Paper.

Board and shareholder register

  • Legal basis: legal obligation (record-keeping requirements under the Finnish Limited Liability Companies Act) as well as performance of a contract (shareholders' agreement)
  • Assently system and Sharepoint
  • IH's board meeting minutes, shareholders' agreements, and general meeting minutes; names, contact details, and, where required for signing, personal identity codes of board members and shareholders
  • Data is not deleted, due to the statutory retention obligation under the Limited Liability Companies Act
  • Access rights limited to IH's management

 

Use of AI tools

Innovation Home uses AI-based tools as part of customer and member service, marketing, and internal administration.

  • HubSpot Breeze — part of our HubSpot agreement (data on EU servers). Operates within existing access rights and does not transfer data outside HubSpot. Customer data is not used to train AI models.
  • RosaBot — HubSpot's AI-based customer service bot on IH's website. Together with its name, the bot informs the user that it is “AI-assisted” right at the start of the conversation (a transparency requirement under Article 50 of the EU AI Act). Data collected in the conversation is stored in the same HubSpot system as other customer data.
  • Claude (Anthropic), Team plan — used by staff; login requires SSO authentication. Connected to several of IH's systems (including HubSpot, Microsoft 365, Vainu, Mailchimp, Adobe, Canva) to perform work tasks such as drafting contract texts, analytics, marketing, and content creation. Processing is based on the data processing agreement (DPA) included in Anthropic's commercial terms of service; submitted data is not used to train models. Data transfers to the United States are based on the EU Standard Contractual Clauses (SCCs).
  • ChatGPT (OpenAI), Business plan — used by administration for editing images and offer materials. IH has a signed data processing agreement with OpenAI. Training of models on submitted data is disabled. Data transfers to the United States are based on the EU Standard Contractual Clauses (SCCs). Not connected to other systems.

Staff are given internal guidance on what types of data may be entered into these tools.

 

Disclosure of Customer Data

IH does not disclose data from its customer registers to third parties, except to subcontractors that provide services to IH. In such cases, only the data necessary for providing the service is disclosed. IH does not sell or rent data from its customer registers to third parties. If customer data must otherwise be disclosed to an outside party for any reason, IH will request consent from the company and individuals concerned before disclosure.

IH also has the right to transfer the membership agreement, together with its associated rights and obligations, to a third party, for example in connection with a business sale or other corporate transaction. In such a case, personal data will also be transferred to the recipient of the agreement, who will continue processing it as controller on the same terms. The member company concerned will be notified of the transfer in writing.

 

Protection of Registers

IH's registers are stored using the appropriate means described above. Access to information systems requires a username, password, and the address of the database server. Data is not stored on paper.

 

Data subject's right to access, rectify, erase, and object

A data subject has the right, at any time, to request from IH the data stored about them in a register and to receive a copy of it. Access requests must be made in writing and addressed to the controller.

A data subject has the right to request correction of their register data.

A data subject also has the right to request the erasure of their data from a register. The erasure principles are described above for each register. Data stored in log files and messages already sent are not deleted, as they may be needed even years later to investigate potential misuse or resolve a dispute. IH also has the right to refuse erasure to the extent it is contractually necessary for an ongoing customer relationship, or if there is reason to believe that erasure would hinder the investigation of potential misuse.

A data subject has the right to prohibit the controller from processing their data for direct marketing, distance selling or other direct marketing, and market or opinion research. Such a prohibition must be made in writing and addressed to the controller.

 

Use of cookies and analytics on Innovation Home's website

Cookies are used on IH's website, and HubSpot is used to manage and analyse them. The purpose of cookies and analytics is to improve, develop, and target IH's website and its content. We ask visitors to our website for consent to the use of cookies. If a visitor does not give consent, no data is collected.

IH's website may contain links to third-party websites. IH is not responsible for third-party websites or their content.

 

Right to lodge a complaint

A data subject has the right to lodge a complaint with the data protection authority if they consider that their data has been processed in violation of IH's practices.

 

© Innovation Home, Privacy Policy and Register Description