GDPR and Personal Data Policy
Purpose
The purpose of this policy is to ensure that the company processes personal data lawfully, securely, and transparently in accordance with the General Data Protection Regulation (GDPR).
This policy applies to all employees and covers all processing of personal data within the business.
What is personal data?
Personal data is any information that can directly or indirectly be linked to a living person, for example:
- Name
- Email address
- Phone number
- Personal identity number
- Customer and employment data
- IP address
Principles for processing
The company shall ensure that personal data:
- is processed lawfully, fairly, and transparently
- is collected for specific and legitimate purposes
- is not stored longer than necessary
- is protected against unauthorized access and loss
We only process personal data that is necessary for our operations.
When we process personal data
We primarily process personal data in order to:
- fulfill agreements with customers and suppliers
- manage employment relationships and payroll
- comply with legal obligations (e.g., accounting requirements)
- communicate with customers and stakeholders
- operate and develop the business
The legal basis is typically contract, legal obligation, or legitimate interest.
Storage and retention
Personal data is stored only as long as necessary:
- Customer data is stored as long as the business relationship exists and according to accounting requirements.
- Employment data is stored according to labor law and legal obligations.
- Data that is no longer needed is deleted or anonymized.
Security
The company protects personal data through:
- restricted access (authorized persons only)
- secure IT systems and passwords
- regular security routines and updates
Personal data breaches must be reported internally immediately.
Data processors
When external suppliers process personal data on our behalf, data processing agreements must be in place.
Data subject rights
Individuals whose data we process have the right to:
- receive information about the processing
- request access to their data
- request correction or deletion
- object to certain processing
Requests are handled without undue delay.
Responsibility and follow-up
Company management is responsible for ensuring compliance with this policy and updating it when needed.
All employees must follow this policy in their daily work.
This policy is adopted and reviewed annually.
Revision Log - GDPR-policy
Edition: 1.0
Date: 2026-06-01
Change: Document established