Version: 01_Nr. Registration: 65/ 14.05.2025

Introduction

This information note (“Privacy Policy”) describes the types of personal data that are processed, how they are used, your options regarding these processes, and how your rights as a data subject are respected according to data protection legislation, when you use our website https://isoskills.fi (the “Website”), or when you enter into contractual relationships with us, IsoSkills Group SRL (the “Company”).

Data Controllers

This website is jointly operated by two entities acting as controllers of personal data:

• Romania: ISOSKILLS GROUP SRL, headquartered at Calea Floreasca no. 169, CORP X, Floreasca CUBE-BUSINESS HUB2 Building, 2nd floor, room 5C, Sector 1, Bucharest, Romania, registered with the Trade Register under no. J40/16676/2017, VAT no. RO38292530.
• Finland: IsoSkills Oy, Regus Center, 3rd floor, Metallimiehenkuja 10, 02150 Espoo, Finland.

These two entities act as joint controllers pursuant to Article 26 of the GDPR, collaborating in the provision of services through the website www.isoskills.fi.

 

Romania: ISOSKILLS GROUP SRL, headquartered in Bucharest, Calea Floreasca, No. 169, CORP X, within “Floreasca CUBE-BUSINESS HUB2”, Room 5C, 2nd Floor, Sector 1, registered with the unique identification code RO38292530 and Trade Registry number J40/16676/2017.

Finland IsoSkills Oy, Regus Center, 3rd floor, Metallimiehenkuja 10, 02150 Espoo

Joint Controllership

In the context of the joint operation of this website, IsoSkills Group SRL and IsoSkills Oy have established, through an internal agreement, their respective responsibilities in ensuring compliance with GDPR obligations. The essence of this arrangement is available to data subjects upon request.

In general:

• IsoSkills Group SRL is responsible for operations in Romania, including local contractual relations and communication with Romanian authorities.
• IsoSkills Oy manages operations in Finland and communication with clients in the Nordic region.

Data subjects may exercise their rights by contacting either entity, and the request will be forwarded to the relevant party, as appropriate.

Applicability

This Privacy Policy applies to the following categories of individuals:

– Representatives of corporate clients – natural persons acting on behalf of corporate clients;

– Users – individuals who browse the Website without becoming clients;

– Collaborators.

1. Categories of Personal Data

We process the personal data (collectively, “Personal Data”) that:

– you provide us in the context of concluding and executing a contract or in any other context where you interact with the Company;

– we generate as a result of your interaction with us;

– we obtain from other sources such as public authorities, financial institutions, your organization (if you are a corporate client representative), or third-party service providers.

Types of Personal Data:

• Identification data – first name, last name, Personal Numeric Code (only when required by law);
• Contact data – address, email address, phone number;
• Professional data – client name, headquarters address, tax code, your role if acting as a representative, data on our collaborators;
• Content data – information posted/uploaded on the Website (e.g., reviews);
• Interaction data – information received from you as part of support services, complaints, or requests;
• Device and cookies data – IP address, general location (city level), browser type, operating system, access time, accessed page link, device details, and timestamps.

2. Purposes and Legal Basis of Processing

No.	Processing Purpose	Legal Basis
1.	Analysis and management of the Company’s activity. We process a series of personal data in order to optimally organize and streamline the Company’s activity, respectively to analyze how customers use the services and fulfill their contractual obligations.	Our legitimate interest in ensuring the adequate provision of services and improving our services (Art. 6 para. (1) letter f) of the GDPR).
2.	Support services and resolution of petitions/complaints. We collect and process a series of Personal Data to provide support services to our customers, as well as to any other persons who contact us through the available channels to respond to their requests, requests and petitions.	Our legitimate interest in ensuring adequate management of the relationship with our Customers and Website Users (Art. 6 para. (1) letter f) of the GDPR).
3.	Carrying out promotional activities or prize campaigns.	Legitimate interest in effectively promoting the Company’s activities and services, in compliance with the proportionality test (Art. 6 para. (1) lit. f) of the GDPR). Your consent in the case of promotional campaigns/lotteries that require active registration (Art. 6 para. (1) lit. a) of the GDPR). If you have given your consent to a prize competition, you have the possibility to revoke it at any time, with effect for the future, but this will lead to the impossibility of participating in the draw and winning the prizes offered. Fulfillment of legal obligations, regarding the withholding and payment of any taxes associated with the prizes offered (Art. 6 para. (1) lit. c) of the GDPR).
4.	Analyzing your interaction with the Company in order to provide personalized offers. In certain situations, we may use the information collected from you (e.g. contract history) in combination with data we obtain from our sales and/or marketing teams regarding your interaction with the Company, which we use in the context of our commercial communications. We want to streamline our activity of promoting the Company’s services, offering our customers relevant and personalized services.	Legitimate interest in carrying out an effective promotion of the Company’s products, offering our customers the most relevant ones. We consider that these types of analyses comply with the proportionality test being based on limited information that we hold in the context of the development of contractual relations with the Company’s customers (Art. 6 para. (1) letter f) of the GDPR).
5.	Commercial communications. We would like to keep you informed about our services and campaigns through our commercial communications sent by email and/or telephone. We will only send you such communications if we have obtained your consent to do so. When you act as a contact person of a legal entity Client or former collaborator, we may send commercial communications (by automated means of remote communication) addressed to the legal entity professional, using the contact details provided in the commercial communications subscription form.	Your consent (Art. 6 para. (1) lit. a) GDPR).   You can unsubscribe from these communications at any time by clicking the “Unsubscribe” button in any communication sent by automated means. You can also withdraw your consent using the contact details in Section 7 (Contact Details). If you do not give your consent or, as the case may be, withdraw your consent, you will no longer receive announcements regarding our offers.
6.	Operation of IT systems, system security and prevention of abuse. When you use or access the Website, our systems automatically collect a series of Data About Your Device which are used to prevent and investigate possible abuse/fraud in the use of our IT systems/services provided by us, as well as to ensure the operation of the services and the long-term viability of our IT systems.	Our legitimate interest in ensuring the functioning of the services offered, the viability of IT systems, the prevention and investigation of fraud and abuse in the use of our systems/Services (Art. 6 para. (1) letter f) of the GDPR).
7.	Analysis and statistics on the operation of the Website, cookies and similar technologies. We may use the personal data provided by visitors/users of the Website for the purpose of conducting analysis and statistics on the operation of the website and how the functions/services offered through the Website are used. The analysis and statistics we perform help us to better understand how we could improve the functionalities of the Website, as well as to optimize the promotion of the Company’s products. To perform these analyses and statistics, we will use the Google Analytics service. These analyses are performed using cookies or similar technologies. For details on these technologies, please refer to the Cookies and Similar Technologies Policy.	Depending on the cookie technologies actually used at a given time on the Website, the legal basis for processing may be: (i) in the case of necessary cookie technologies – legitimate interest (Art. 6 para. (1) letter f) of the GDPR) and (ii) in the case of the other categories of cookies used (functional, performance and/or marketing/tracking cookies) – consent (Art. 6 para. (1) letter a) of the GDPR).
8.	Defending our rights and interests in judicial/administrative proceedings. The Company may also process your Personal Data for the establishment, exercise or defense of a legal right in a court proceeding, an administrative proceeding or other official proceedings in which the Company is involved.	The legitimate interest of the Company consisting in defending our rights and interests in judicial/administrative proceedings (Art. 6 para. (1) letter f) of the GDPR).
9.	Legal compliance (tax, archiving, disclosure to authorities)	Compliance with legal obligations. The processing of your personal data may also be necessary to fulfill our legal obligations under applicable law, such as: compliance with specific obligations under financial and tax legislation; compliance with requirements relating to document archiving (including financial and tax documents); compliance with the obligation to disclose data to public authorities in the context of investigations, controls or requests for information.

3. Data Recipients

We may disclose your Personal Data to:

• Electronic communications service providers – such as companies that provide us with e-mail services in connection with various functional aspects related to the Company’s activity;
• Our agents who help us manage the Company’s activity (such as database providers, website developers, other IT service providers);
• Entities with whom we collaborate to provide you with our services;
• Our external consultants (such as lawyers, auditors, etc.);
• Public authorities and institutions, in compliance with the applicable legal powers and procedures regarding data disclosure;
• Potential acquirers and/or consultants of acquirers, when the Company will be subject to an acquisition and/or restructuring process, in compliance with legal provisions.

4. International Data Transfers

As a rule, when we disclose data to third parties, we transfer the data to countries belonging to the European Economic Area or to countries that have been recognized as having an adequate level of protection by a decision of the European Union Commission.

Some of our partners have servers located in third countries and, therefore, your personal data may be transferred to such third countries where the respective servers are located. In these situations, we will ensure that the transfer will be carried out on the basis of appropriate guarantees (such as, by using Standard Contractual Clauses adopted by the competent authority or certification procedures), or, in any other case, in compliance with the requirements set out in the legislation on the protection of personal data.

You can ask us to provide you with a complete list of countries outside the European Economic Area to which your personal data may be transferred, as well as details of the measures adopted for such transfers, using the contact details in Section 7 Contact Details.

5. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which they were collected, in compliance with internal procedures regarding data retention, including applicable archiving rules. Below we specify some rules used by the Company in determining the terms of retention of personal data:

1. a) The personal data of the persons registered in our marketing database will be retained until the exercise of the right to withdraw consent / respectively until the exercise of the right to object.
2. b) The personal data necessary for the resolution of complaints / complainants, the provision of answers to questions, requests or other petitions (other than those related to our contractual relationships) will be retained for a period of 24 months from the final resolution of the request / request. If the request concerns the contractual relationships with you / your organization. (when acting as a Representative of a legal entity), Personal Data will be retained for the entire duration of the limitation period for civil liability.
3. c) Data from supporting documents for financial-tax reporting will be retained for a period of up to 10 years, starting with the following fiscal year;
4. d) Data from e-mail / physical correspondence will be retained in the electronic / physical archive according to our personal data processing policy;
5. e) Data related to cookies and similar technologies are retained according to the specific terms set for the respective technologies, the storage term may be between the duration of the browsing session and a duration of up to 2 years. Cookies – between session duration and up to 2 years.

6. Your Rights

According to the law, you have the following rights related to the processing of your Personal Data for which the Company is responsible as a controller:

• Right of access to data – you can obtain from us confirmation that we are processing your Personal Data, as well as information regarding the specifics of the processing;
• Right of rectification – you can request us to amend your incorrect Personal Data or, as the case may be, to complete data that is incomplete;
• Right to erasure – you can request the deletion of Personal Data when: (i) they are no longer necessary for the purposes for which we collected and process them; (ii) the data are processed contrary to the law; respectively (iii) the data must be deleted in accordance with the relevant legislation;
• Right of opposition – you can object at any time to processing based on the legitimate interest of the Company, for reasons related to your particular situation;
• Right to withdraw consent – ​​in relation to our processing based on your consent, you may withdraw your consent at any time and free of charge, without affecting the lawfulness of the processing carried out until the withdrawal of consent. To exercise your right to object, you can contact us using the details in Section 8 (Contact Details);
• Right to restriction of processing – you may request the restriction of the processing of your personal data if: (i) you contest the accuracy of the personal data, for a period that allows us to verify the accuracy of the data in question; (ii) the processing is unlawful and you oppose the erasure of the personal data, requesting instead the restriction of their use; (iii) the data are no longer necessary for our processing, but you request them from us for legal action; respectively (iv) if you have objected to the processing, for the period of time during which it is verified whether the legitimate rights of the Company as a controller prevail over your rights as a data subject;
• Right to data portability – you can ask us to transfer your data to another controller, if our system is compatible with such a system or, where applicable, to provide you with an electronically accessible copy of these data. This right applies only when we process Personal Data by automated means based on the contract and/or your consent;

You also have the right to file a complaint with the data processing supervisory authority if you consider that your rights have been violated: National Authority for the Supervision of Personal Data Processing in Romania, B-dul G-ral. Gheorghe Magheru 28-30 Sector 1, postal code 010336 Bucharest, Romania, anspdcp@dataprotection.ro.

7. Contact

If you require further information regarding the data processing activities covered by this information notice, or wish to exercise your rights vis-à-vis the Company, you may contact us using the following contact details:

By physical correspondence at the following address: Calea Floreasca, No. 169, CORP X, within ”Floreasca CUBE-BUSINESS HUB2”, room 5C, Floor 2, sector 1

By e-mail at: office@isoskills.fi

You may also contact our Data Protection Officer directly at the following e-mail address: gdpr@isoskills.fi