In this privacy notice you will find information on what personal data we at Piñata process, how we process it and what rights you have regarding your personal data.
As a Finland based company Piñata is committed to the principles set out in the EU General Data Protection Regulation (Regulation 2016/679 EU, the “GDPR”).
1. Controller
Piñata, officially PinataHEL Oy, is a limited liability company based in Helsinki, Finland. We create animations, illustrations and other high-quality visual content for TV, print, web and mobile.
Should you have any questions regarding our data protection procedures after reading this privacy notice, please contact us at gdpr(at)pinata.fi.
Our official company details are:
Name: PinataHEL Oy
Business ID: 2190965-1
Address: Fredrikinkatu 47
00100 Helsinki
You can find more information about Piñata on our website: https://pinata.fi/
2. What personal data do we collect and what do we do with it?
Basic information
We collect the names and contact details of our customer contact persons, such as their email, phone number, position in the company and office address. Customer representative details are often also included in service agreements and statements of work entered into between us and our customer company. The contact information is collected directly from the customer and their contact persons. In addition to the basic contact details, we process and store the correspondence related to offering and maintaining the customer relationship. Such correspondence typically includes the details of the sender, such as their name, position and contact details, as well as the contents of the messages sent between us.
We retain the personal data related to our customers and business partners for the period of our contract and, if necessary, a reasonable time thereafter to fulfill the purposes explained in Section 3 below.
Sales leads and prospective customers
We also collect and maintain lists of sales leads and prospective customers. These may include the name, position and relevant business contact details of companies’ contact persons. We may collect such information from the prospective customers themselves or from open sources, such as the internet and social media. We store this data as long as our communications or negotiations are ongoing.
Newsletters
Piñata may send newsletters to its customers, stakeholders and other persons of interest. The personal data processed in this context includes only your email address.
You may at any time unsubscribe from our mailing list by clicking the unsubscribe link at the bottom of each email.
Financial information
We are obliged under the law to keep certain billing and other financial information, which may include personal data, for the period of 6-10 years.
Feedback and claims
We retain customer feedback, including complaints and claims, for the period necessary to reply to the feedback, troubleshoot possible problems or to establish, exercise or defend legal claims. We also keep the contracts and other communications between us related to the services indicated in the feedback/claim/complaint for the same period.
We collect the names and contact details of our contractors, who render services to us, as well as the business identification or personal identification number of the contractor, depending on whether the contractor offers their services via a business or personally. We also process the bank account details of our contractors to be able to make the agreed payments. We also collect and maintain information on the professional skills of our contractors. The information is provided by the contractors themselves.
We store the contractor data for the period of our contract and, if necessary, a reasonable time thereafter to fulfill the purposes explained in Section 3 below. The financial information, as well as information related to feedback and claims is stored in the same way as explained above in section 2 a.
We use cookies on our website. Cookies are little text files sent by our or our partners’ web server and stored in your browser or device. By means of cookies we can ensure that the website functions correctly and we can analyze how our website is being used. The analytics is offered by Google Analytics.
We collect the following information about you by means of cookies: IP address, Google Analytics identification number that is unique to each visitor, date and time of visitation, source of navigation (website from which you navigated onto our website), pages visited within our website, length of your visit. The information will be presented to us in form of aggregated statistics, where a single visitor cannot be directly identified.
The cookies placed by our website expire within 2 years.
You can find out more about Google’s data policies regarding Google Analytics by visiting https://support.google.com/analytics/answer/6004245 and you can review Google’s privacy policy at https://policies.google.com/privacy.
Job applicants may send us their job applications and resumés in free form via email. The job applicant controls what information they choose to share with us. Typically these include the name and contact details of the job applicant, as well as their job history, education, professional proficiency, language and technical skills, etc. We may also exchange emails with our job applicants.
We keep the job applications and resumés sent to us for the duration of the recruitment process and 3 years after that to be used for finding talent to our future productions. Please let us know if you don’t want us to save your application for future inquiries.
3. What are our purposes and legal bases for processing personal data?
Depending on the nature of your relationship with us, we will process your personal data for the following purposes:
- Provision of professional services to customer organizations
- Procurement of services
- Managing our customer and supplier relationships
- Acquiring new customers
- Promoting our services
- Invoicing and bookkeeping
- Fulfilling our contractual and legal rights and obligations
- Improving and developing our services, e.g. through processing customer feedback
- Defending our legal rights
Our processing of personal data for the above purposes is based on our legitimate interests to pursue those purposes. We also have legal obligations related to bookkeeping and taxation.
- Fulfilling our contractual and legal rights and obligations
- Maintaining a list of suitable professionals for the purpose of finding the right talent for the right productions
- Defending our legal rights
Our processing of personal data for the above purposes is based on our contract with the contractor and legitimate interests to pursue those purposes. We also have legal obligations related to bookkeeping and taxation.
- Displaying and functioning of our website (necessary cookies)
- Improving and developing our website by measuring and analyzing its use (analytics cookies)
The legal basis for the necessary cookies is our legitimate interest to display our website to anyone navigating onto our website. The analytics cookies used by us are based on each website visitor’s consent. The consents can be managed on our website any time.
- Recruitment
- Maintaining a catalogue of suitable candidates for future open positions
Our processing of the job applicants’ personal data is based on our legitimate interest for recruiting new personnel and finding the right talent for us. Your application data can be stored with us even after the recruitment process on your consent.
4. Who do we disclose your personal data to or share your personal data with?
We rely on digital services provided by external service providers when processing personal data. Such services are subcontracted in terms of the GDPR and include e.g. email, data storage, website hosting, digital co-working and data sharing services, etc. These services are governed by separate service agreements between us and our service providers, and we remain responsible for the personal data processed through them as data controllers.
We may share our contractors’ names and contact details as needed with our customers for the provision of the agreed services. Our customers process personal data in accordance with their own privacy policies.
We share our website analytics data with Google, which may use it for their own purposes. Providing consent to the processing of analytics data is voluntary (please see section 2 c above for more information.)
We do not share your personal data with other commercial partners.
5. Is your personal data transferred to other countries?
Your personal data is regularly stored within the EU. Some of our service providers may exceptionally transfer data, including personal data, to server locations outside of the EU, most likely to the USA. These transfers are, however, always governed by appropriate safeguards, such as the standard contractual clauses approved by the European Commission.
6. Your rights as a data subject
Data subjects have the following rights under the GDPR:
Right to access your information:
You have the right to know what information we have and process about you and may request us to provide you access to this data.
Right to rectification:
You have the right to request incorrect, outdated, or incomplete information about you to be rectified.
Right to erasure or restriction:
You have the right to request your data to be erased when the processing of your personal
data is no longer necessary and in certain other situations provided for in the GDPR. If we have a right to deny your erasure request, or if the retention of your personal data is necessary for the investigation of your claim otherwise, you have the right to require for the restriction of its processing from us.
Right to objection and right to withdraw consent:
you have the right to object to the use of your personal data for direct marketing, as well as other purposes based on our legitimate interest. If our processing of your personal data is based on your consent, you have the right at any time to withdraw such consent.
Right to data portability:
If our data processing is based on your consent or a contract between us, you have the right to receive a copy of the personal data you have provided to us yourself in a structured machine-readable format.
Right to lodge a complaint with the supervisory authority:
Finally, if you feel that your rights have not been respected in connection with our data processing procedures, you do have the right to lodge a complaint with the national supervisory authority. However, before doing so we would kindly ask you to contact us and voice your concern so that we may try to find a solution together.
The national supervisory authority in Finland is the Finnish Data Ombudsman’s Office (“Tietosuojavaltuutetun toimisto”): https://tietosuoja.fi
This Privacy Notice has been last updated on 2/12/2021.