This Privacy Policy describes how Renow Oy (“we”, “us”, or “our”) collects, uses and discloses your personal data when you visit our websites, including renow.ai (“Site”), and use the services and features available on the Site, such as forms, newsletters and games (“Services”). In this Privacy Policy, the word “user” or “you” refers to the visitors of the Site and the users of the Services.
1 Data controller
Renow Oy, Business ID 3322228-3 (“Renow”)
Address: Hermannin rantatie 10, 00580 Helsinki
2 Contact details for privacy matters
Email: privacy@renow.ai
3 Purposes of processing and legal basis for processing
3.1 The purposes of the processing and the legal basis for the processing are the following:
a) We use your personal data to respond to your requests and enquiries, such as contact and meeting requests, to provide you the Services and to communicate with you about our services. The legal basis for this processing is our legitimate interest or the necessity to take steps at your request prior to entering into a contract.
b) We use your personal data to improve our business, services, and the customer experience and to develop our operations, as well as for analytics and statistical purposes. The legal basis for this processing is our legitimate interest. Once this personal data is anonymized, it no longer constitutes personal data.
c) We use your personal data to prevent abuses and to detect, investigate or take action regarding possible fraudulent, illegal, or malicious activity. The legal basis for this processing is our legal obligation or our legitimate interest.
d) We use your personal data to send you newsletters and other marketing communications about our services and to organise events, games and competitions, including delivering any prizes. The legal basis for this processing is your consent or our legitimate interest, as permitted by applicable law. You can unsubscribe from our marketing communications at any time.
3.2 If consent is the legal basis for the processing of personal data
a) Should your consent be the legal basis for the processing and you withdraw the given consent, the withdrawal of the consent does not affect the lawfulness of the processing based on the consent before its withdrawal.
4 Cookies
4.1 Like many websites, we use cookies on our Site. We use cookies to power and improve our Site and our services (including to remember your actions and preferences), to run analytics and better understand user interaction with the services (in our legitimate interests to administer, improve and optimize the services). We may also permit third parties and service providers to use cookies on our Site to better tailor the services, products and advertising on our Site and other websites.
4.2 Please keep in mind that removing or blocking cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available.
5 Categories of personal data
The following personal data can be processed by us:
(a) Contact details and identifying information:
(i) Name
(ii) Email
(iii) Phone number
(iv) Company and job title
(b) Information you provide through the Site:
(i) Information you submit in forms on the Site, such as your company, your role and your message
(ii) Nicknames, scores and other information related to your use of games and other features of the Site
(iii) Your subscriptions and marketing preferences
(c) Customer support information:
(i) Communication with customer support
(ii) Information you choose to include in communication with us
(d) User provided information
(i) Information you provide when you submit ratings, comments or respond to surveys
(ii) Information you provide by phone or email
(e) Usage data:
(i) IP address
(ii) Device and device identification number
(iii) Browser type and version
(iv) Internet service provider
(v) Date and time you used the Services
(vi) Sites visited and the session duration
(vii) From where you followed the link to the Services
(viii) Other information on your interaction with the Services
6 Sources of personal data
Personal data is collected directly from you, for example when you fill in a form on the Site, subscribe to our communications or contact us, and automatically when you use the Site. Other possible sources:
(a) Potential personal data collected by cookies, as described in Section 4.
7 Recipients or categories of recipients of personal data
Personal data may be processed by our sub-processors who process the personal data on our behalf to provide services to us. Such sub-processors include, for example, the following categories of service providers:
(i) Cloud, hosting and other IT service providers, such as Google Cloud and Microsoft
(ii) Customer relationship management and email marketing service providers, such as HubSpot
(iii) Analytics and advertising service providers, such as Google Analytics and Google Ads
(iv) Providers of embedded content, such as YouTube for videos
8 Transfers of personal data to third countries
8.1 We use international cloud services or other service providers defined in Section 7 in the processing of personal data, and the personal data may be transferred to countries outside the EU/EEA (“Third Countries”) in connection with those services. If personal data is transferred outside the EU or EEA, the legal basis for the transfer of the personal data to Third Countries is the Binding Corporate Rules, the European Commission’s Standard Contractual Clauses for the transfer of personal data to processors established in third countries (“Standard Contractual Clauses”), the EU-U.S. Data Privacy Framework, alternative data export mechanisms for the lawful transfer of personal data (as recognized under EU data protection laws) or another legal basis. Further information is available in the service providers’ data processing terms.
9 Period for which personal data will be stored
9.1 We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy.
9.2 For the personal data we process, the retention period or the criteria for determining the retention period is defined based on law and the purpose of use. Some personal data may be used for multiple purposes, in which case the actual retention period is determined by the longest applicable retention time or criteria. If one or more of the shorter retention periods have already expired, the personal data will only be used for the purposes that require a longer processing time.
9.3 The personal data can be processed for longer than the pre-defined time periods, if the personal data in question is necessary for the establishment, exercise or defence of legal claims.
10 Methods how register is secured
The personal data processed by us is secured by using the following methods and principles:
(a) Locks at our premises;
(b) Firewall, anti-malware and spam filtering systems of our communication networks and other software and hardware that protect the security of communication networks;
(c) Mandatorily required high quality passwords;
(d) Personal user rights that can be traced in the systems;
(e) Limited number of superusers;
(f) Training of our personnel; and
(g) Our policies and guidelines relating to personal data matters.
Please be aware that any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.
11 Right of access
11.1 You have the right to get information on what personal data is being processed by us, or information that no such personal data is being processed.
11.2 Where such personal data is being processed by us, we will provide you with a copy of the personal data and the following information:
(a) The purposes of the processing;
(b) The categories of personal data concerned;
(c) The recipients or categories of recipients to whom the personal data is to be or has been disclosed;
(d) The period for which the personal data will be stored;
(e) The existence of the right to request from us the rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to the processing of such personal data;
(f) The right to lodge a complaint to the supervisory authority and the contact details of the supervisory authority;
(g) Communication of the personal data undergoing processing and of any available information as to its source; and
(h) The significance and envisaged consequences of such processing, at least in the case of measures which produce legal effects concerning you or significantly affects you and which are based solely on automated processing intended to evaluate certain personal aspects relating to you or to analyse or predict in particular your performance at work, economic situation, location, health, personal preferences, reliability or behaviour.
11.3 For any further copies requested by you, we may charge a reasonable fee based on administrative costs.
12 Right to data portability
On your request, if we process the personal data based on your consent or based on a contract with you and if the processing is carried out by automated means:
(a) We will provide you with the personal data which you have provided to us, in a structured, commonly used and machine-readable format;
(b) On your request and if technically feasible, we transmit the personal data in the same format directly to another controller.
13 Rectification and right to lodge complaint with supervisory authority
13.1 We will, on your request, without undue delay correct, erase or supplement the personal data in case of erroneous, unnecessary, incomplete or obsolete personal data taking into account the purpose of the processing, including by way of supplementing a corrective statement.
13.2 If we do not take such action on your request, we will inform you without delay and at the latest within one (1) month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. Please note that you may bring the matter to be handled by the local supervisory authority.
13.3 You have the right to lodge complaints to the local supervisory authority. The contact details of the Finnish supervisory authority are:
https://tietosuoja.fi/en/office-of-the-data-protection-ombudsman
14 Right to object processing
You have the right to object, on grounds relating to your particular situation, to the processing of your personal data which is based on either of the following legal basis for processing: (i) when the processing has been found necessary for the purposes of our legitimate interests or (ii) when the processing is necessary for the performance of a task carried out in the public interest. You however do not have the right to object, if we demonstrate compelling legitimate grounds for the processing which override your interests or fundamental rights and freedoms, or if we need to process the personal data for the establishment, exercise or defence of legal claims.
15 Right to restriction of processing
15.1 ‘Restriction of processing’ means the marking of the stored personal data with the aim of limiting its use in the future.
15.2 If you request, we must restrict the processing in the following situations:
(a) The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data;
(b) The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
(c) We no longer need the personal data for the purposes of the processing, but it is required by you for the establishment, exercise or defence of legal claims; or
(d) You have objected to the processing, but verification whether our legitimate grounds override those of yours is still ongoing.
15.3 In the situations listed above, we can only process the personal data:
(a) With your consent or for the establishment, exercise or defence of legal claims;
(b) For the protection of the rights of another natural or legal person;
(c) For reasons of important public interest of the European Union or of a European Union Member State; or
(d) To store the personal data.
16 Right to be forgotten
16.1 You have the right to have your personal data erased on your request if one of the following grounds applies:
(a) The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
(b) You withdraw the consent on which the processing is based and where there is no other legal ground for the processing;
(c) You object to the processing in accordance with Section 14;
(d) The personal data has been processed unlawfully; or
(e) The personal data has to be erased for compliance with a legal obligation in the European Union law or in a European Union Member State law to which we are subject.
16.2 However, we do not have to erase the personal data to the extent we still need to process the personal data:
(a) For exercising the right of freedom of expression and information;
(b) For compliance with a legal obligation which requires processing by the European Union or the European Union Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
(c) For reasons of public interest in the area of public health in accordance with legal requirements;
(d) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with legal requirements; or
(e) For the establishment, exercise or defence of legal claims.
17 Automated decision-making and profiling
You have the right not to be subject to a decision based solely on automated processing of your personal data, including profiling based on your personal data, which produces legal effects concerning you or similarly significantly affects you.
We do not use personal data collected through the Site for decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.