Privacy policy

Note: This text must still be reviewed before publication.

Privacy at Cervi Group

Cervi Group is committed to protecting the personal data of its customers, employees, job applicants and website users. We process personal data lawfully, carefully and transparently.

This privacy notice applies to Cervi Group companies unless otherwise stated on an individual company’s website. The controller is always the Cervi Group company with which the customer, employee, job applicant or other individual has a relationship.

Controller

The controller is the Cervi Group company with which the customer, employee, job applicant or other individual has a relationship.

The name, business ID and contact details of each company can be found on that company’s website. For data protection questions, data subjects can also contact tietosuoja@cervi.fi.

What personal data we process

Personal data is processed in different situations as follows.

In a customer relationship

• name
• company and position
• contact details
• contract and order details
• invoicing details
• customer communications

In an employment relationship

• employment details
• salary and tax details
• working time records
• training records
• information required by labour legislation

In recruitment

• name and contact details
• CV and education details
• work history
• information related to the application

When using the website

• IP address
• technical browser information
• website usage data
• cookie identifiers

Chat and chatbot services

Chat or chatbot services may be used on the website to support customer service, information searches and the handling of enquiries. When the service is used, the contact and communication details provided by the user and the content of the conversation may be processed.

For what purposes the data is used

Personal data is processed, for example, for the following purposes:

• managing customer relationships
• delivering services and projects
• contract management
• invoicing and financial administration
• customer communications
• carrying out recruitment processes
• developing the website
• marketing (based on consent)

Provision of data: Providing personal data may be necessary, for example, to enter into a contract or to deliver a service. If the required personal data is not provided, the service or contract may not be possible to deliver.

Sources of data

Personal data is obtained primarily from the data subject themselves in connection with a customer relationship, employment relationship, recruitment process or use of online services. Data may also be obtained from an employer, customer, partner or another party authorised by the data subject, and from public registers and authority sources within the limits permitted by law.

Legal basis for processing personal data

Personal data is processed on one of the following bases

Contract: When processing is necessary for the performance of a contract or for taking steps related to it.

Legal obligation: For example, obligations related to accounting, taxation or labour legislation.

Legitimate interest: For example, maintaining customer relationships and developing services, or information security.

Consent: For example, marketing cookies and analytics.

Information security

The Cervi Group protects personal data with appropriate technical and organisational measures, such as access management, protection of information systems and staff instructions.

To whom data may be disclosed

Personal data may be disclosed to or processed by the following parties:

• Cervi Group companies
• IT and system providers
• financial administration service providers
• recruitment system providers
• authorities where required by law

Personal data is not sold to third parties.

Retention of personal data

Personal data is retained only for as long as necessary to fulfil the purpose of processing or for the period required by law.

Transfers of data outside the EU/EEA

Some service providers may process data outside the EU/EEA. In such cases, safeguards in accordance with the EU General Data Protection Regulation are used, such as the European Commission’s Standard Contractual Clauses (SCC) or the EU–US Data Privacy Framework.

Rights of the data subject

The data subject has the right to:

• access their own data
• request the correction of inaccurate data
• request the deletion of data
• restrict the processing of personal data
• object to direct marketing
• withdraw their consent

You can exercise your rights by contacting the controller. The controller’s contact details can be found on the website of the relevant Cervi Group company.

Supervisory authority

The data subject has the right to lodge a complaint with the Data Protection Ombudsman if they consider that the processing of personal data infringes applicable data protection legislation. Office of the Data Protection Ombudsman: https://tietosuoja.fi

Changes to this privacy notice

The Cervi Group may update this privacy notice as necessary. The current version is published on our website.

Last updated 22 October 2026

Website and cookies

Our websites may contain embedded content (for example videos, maps, articles, etc.). Opening embedded content from other websites is comparable to the visitor visiting the third party’s website themselves. These websites may collect data about you, use cookies, embed third-party tracking cookies and monitor your interaction with the embedded content, including tracking your interaction if and when you are logged in as a user on those websites.

The Cervi Group’s websites use cookies and other similar technologies to operate the site and for analytics and marketing. Users can change or withdraw their consent to cookies at any time in the site’s cookie settings. We use the following types of cookies.

Necessary cookies

Enable the technical operation of the website, such as site security and storing cookie settings.

Analytics cookies

Help us understand how the website is used and how it can be improved.

Marketing cookies

Enable the measurement of marketing campaigns and the targeting of marketing. Users can manage their cookie settings through the consent tool on the website.

Data collected in connection with Google Analytics and Google Ads may also be used for targeting and measuring marketing. If the user is logged in to their Google account and has given consent to marketing cookies, the data may be linked to the user’s Google profile. The use of data is based on the user’s consent, and the user can manage or withdraw their consent at any time through the cookie settings.

You can always change your cookie settings via the Privacy link at the bottom of the page.

Website analytics and marketing tools

The websites may use, for example, the following services:

• Google Analytics – website analytics
• Meta Pixel – marketing measurement
• Tracklution – campaign analytics
• Leadoo, Booosted, Groweo or other – chat service for website visitors

Marketing-related tools are activated with the user’s consent through the cookie settings. Chat and chatbot services are activated according to service-specific settings and the choices made by the user. Starting a conversation may start the service and the related processing of data.