Registry and privacy policy
The company processes personal data in accordance with applicable data protection legislation, including the European Union GDPR (EU 2016/679) and applicable national data protection legislation, such as the Finnish Data Protection Act (1050/2018).
1. Introduction
The company processes personal data in accordance with applicable data protection legislation, including the European Union GDPR (EU 2016/679) and applicable national data protection legislation, such as the Finnish Data Protection Act (1050/2018).
This Privacy Policy describes how Grants Funding Oy collects, uses, stores, protects and discloses personal data in connection with its website, digital services, sales and marketing activities, customer relationships, stakeholder communications, service delivery and business administration.
Grants Funding Oy is a growth funding specialist that helps its clients secure financing to execute their growth projects.
This Privacy Policy applies to personal data processed by Grants Funding Oy when Grants Funding Oy acts as a data controller. It also describes, at a general level, how Grants Funding Oy processes personal data when acting as a data processor on behalf of its customers.
1.1 Scope of this Policy
The material processed by Grants Funding Oy consists mainly of information concerning companies, their business activities, funding opportunities, public company data and market data. As a rule, such company data is not personal data.
Personal data is processed in particular where the information relates to identifiable natural persons, such as company contact persons, representatives of customer organisations, potential customers, partners, users of online services or individuals communicating with Grants Funding Oy.
2. Data Controller
Grants Funding Oy
Business ID: 2967478-9
Office:
Itämerenkatu 3A
00180 Helsinki
Finland
Website: https://grants.fi/
3. Contact Point for Data Protection Matters
For any questions concerning this Privacy Policy or the processing of personal data, please contact:
Grants Funding Oy
Itämerenkatu 3A
00180 Helsinki
Finland
Email: privacy@grants.fi
If a separate data protection contact or Data Protection Officer is appointed later, the contact details will be updated in this Privacy Policy.
4. Definitions
Personal data means any information relating to an identified or identifiable natural person.
Processing means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
Controller means a party that determines the purposes and means of processing personal data.
Processor means a party that processes personal data on behalf of the controller and in accordance with the controller’s documented instructions.
Data subject means the individual whose personal data is being processed.
5. Role of Grants Funding Oy as Controller and Processor
Grants Funding Oy acts as a data controller when it processes personal data for its own purposes, such as:
- sales and marketing
- customer relationship management
- stakeholder communications
- service delivery
- invoicing and administration
- website operation and analytics
- information security
- compliance with legal obligations
- the establishment, exercise or defence of legal claims
Grants Funding Oy may act as a data processor when it processes personal data on behalf of a customer and in accordance with the customer’s documented instructions under a separate agreement, assignment agreement or data processing agreement.
Where Grants Funding Oy acts as a processor, the customer is responsible for ensuring that it has a lawful basis for processing and that the relevant data subjects have been appropriately informed, unless otherwise agreed in writing.
6. Services and Online Channels
Grants Funding Oy operates public online services and uses external service providers in connection with its online presence, communications, marketing, analytics and service delivery.
Such services and technologies may include, for example:
- company website: https://grants.fi/
- GrantedAI service
- social media services, such as Facebook and LinkedIn
- CRM and marketing automation services
- email and communication services
- analytics and cookie technologies
The services may process identifiers, usage data, communication data, cookie and analytics data and other information necessary for providing the service, measuring website usage, managing communications, improving services, maintaining information security and carrying out sales and marketing activities.
Some services are provided by external service providers. Service providers may process personal data on behalf of Grants Funding Oy under an agreement and documented instructions. Social media services and certain other third-party services may also process personal data independently in accordance with their own privacy policies and terms.
7. Purposes of Processing Personal Data
Grants Funding Oy processes personal data for the purposes described below.
In Grants Funding Oy’s operations, the processing of personal data is predominantly B2B in nature. Personal data is processed primarily for contacting company contact persons, managing customer relationships, delivering services, documenting customer communications, carrying out sales and marketing, and fulfilling legal and contractual obligations.
7.1 Sales and Marketing
Personal data may be processed for B2B sales and marketing purposes, such as identifying potential customer companies, contacting company representatives, managing sales activities, arranging meetings, sending marketing communications and assessing the effectiveness of sales and marketing activities.
Processing generally concerns individuals in their professional roles. The data subject always has the right to object to direct marketing.
7.2 Customer Relationship Management
Personal data may be processed for managing customer relationships, communicating with customers, providing services, maintaining customer records, managing meetings, handling requests and ensuring continuity of customer service.
In order to ensure continuity of the customer relationship, sales and service, Grants Funding Oy may store customer-related email communications, meeting data, notes and other customer interaction data in its CRM and customer management systems.
The storage of email messages may take place partly automatically and concerns customer and sales communications based on the customer contacts, customer relationship data and email addresses held in the system.
The purpose is not to store employees’ private messages, HR matters, health data, special categories of personal data or other communications unrelated to the customer relationship.
7.3 Service Delivery
Personal data may be processed for delivering services requested by customers, managing assignments, preparing materials, providing access to digital services and maintaining service-related communications.
7.4 Events, Webinars and Downloaded Content
Personal data may be processed when a person registers for an event, participates in a webinar, downloads content, requests materials or otherwise interacts with Grants Funding Oy’s content or communications.
7.5 Website, Analytics and Information Security
Personal data may be processed for maintaining the website and digital services, analysing usage, improving user experience, preventing misuse, ensuring information security, detecting technical issues and protecting the rights and property of Grants Funding Oy and its users.
7.6 Legal, Financial and Administrative Purposes
Personal data may be processed for invoicing, accounting, contract management, regulatory compliance, responding to lawful requests, resolving disputes and establishing, exercising or defending legal claims.
8. Categories of Data Subjects
The personal data processed by Grants Funding Oy may concern the following categories of data subjects:
- contact persons of active customers
- contact persons of potential customers
- representatives of partners and stakeholders
- individuals participating in events, webinars or other activities
- individuals downloading guides, reports or other content
- newsletter subscribers
- users of the website and digital services
- representatives of suppliers and cooperation networks
- other persons who contact or interact with Grants Funding Oy
9. Categories of Personal Data
Depending on the context, Grants Funding Oy may process the following categories of personal data:
Grants Funding Oy may process a wide range of information concerning companies, such as company name, industry, financial data, funding data, growth projects and other business-related information. Such information is generally not personal data unless it can be linked to an identified or identifiable natural person.
- name
- job title or role
- organisation or company
- business contact details, such as email address, phone number and address
- communication history
- information about meetings, requests and customer interactions
- information about downloaded content
- event or webinar registration and participation data
- areas of interest
- marketing consent and subscription preferences
- website usage data
- cookie and analytics data
- IP address and online identifiers
- invoicing and contract-related information
- information contained in business cards or similar contact materials
- content of customer and sales communications to the extent it relates to managing the customer relationship, sales or service
- customer interaction data stored in the CRM system
- other information provided by the data subject, the customer or another lawful source in connection with the services
Grants Funding Oy does not intentionally collect or process special categories of personal data, such as health data, political opinions, religious beliefs or biometric data, unless such processing has been separately agreed and a lawful basis exists.
10. Sources of Personal Data
Personal data may be collected directly from the data subject, for example through:
- website forms
- email communications
- phone calls
- meetings
- event and webinar registrations
- newsletter subscriptions
- downloaded content
- contracts
- customer interactions
- use of Grants Funding Oy’s digital services
Personal data concerning company representatives and other professional contacts may also be collected from lawful external sources, such as:
- company websites
- public registers
- business information services
- social media services
- partners
- customers
- other publicly available or lawfully obtained sources
11. Legal Bases for Processing
Grants Funding Oy processes personal data only where there is a lawful basis under applicable data protection legislation.
The legal bases may include contract, legitimate interest, consent or legal obligation.
11.1 Contract
Processing may be necessary for the performance of a contract or for taking steps prior to entering into a contract. This may apply, for example, to customer relationship management, service delivery, contract administration and customer communications.
11.2 Legitimate Interest
Processing may be based on the legitimate interests of Grants Funding Oy or a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests. Legitimate interests may include maintaining customer relationships, carrying out B2B sales and marketing, improving services, maintaining information security, preventing misuse and establishing, exercising or defending legal claims.
11.3 Consent
Processing may be based on consent, for example where required for certain types of electronic marketing, cookies, analytics or other optional processing. The data subject may withdraw consent at any time.
11.4 Legal Obligation
Processing may be necessary for compliance with legal obligations, such as accounting, taxation, corporate recordkeeping, regulatory compliance or responding to lawful requests from authorities.
12. Processing Purposes, Data Categories and Legal Bases
| Purpose | Examples of Personal Data | Legal Basis |
|---|---|---|
| Sales and marketing | Name, role, company, email, phone number, interests, communication history, downloaded content | Legitimate interest or consent |
| Customer relationship management | Name, role, company, contact details, meeting and communication data, service-related information | Contract or legitimate interest |
| Service delivery | Contact details, customer communications, assignment-related information, user account or service usage data where applicable | Contract or legitimate interest |
| Events and webinars | Name, organisation, contact details, registration and participation data | Consent, contract or legitimate interest |
| Website analytics and development | Cookie data, online identifiers, IP address, usage data | Consent or legitimate interest, depending on the technology used |
| Information security | Technical logs, IP address, usage data and security-related data | Legitimate interest or legal obligation |
| Invoicing and administration | Contact details, contract details, invoicing information and accounting records | Contract or legal obligation |
| Legal claims and compliance | Relevant communication, contract and transaction data | Legitimate interest or legal obligation |
13. Cookies and Analytics
Grants Funding Oy’s website and digital services may use cookies and similar technologies. Cookies may be used for enabling essential website functionality, improving user experience, measuring website usage, analysing content and campaign effectiveness, supporting marketing activities, maintaining information security and developing services.
Some cookies may be strictly necessary for the website or service to function. Other cookies, such as analytics or marketing cookies, may require the user’s consent depending on applicable law and the specific technology used.
14. Recipients and Service Providers
Personal data may be processed by service providers acting under a contractual relationship on behalf of Grants Funding Oy. In addition, personal data may be disclosed to other recipients only where there is a lawful basis for the disclosure and the disclosure is necessary for the purposes described in this Privacy Policy.
Such recipients or service provider categories may include, for example:
- IT, hosting and cloud service providers
- email and communication service providers
- CRM and marketing automation providers
- analytics and cookie technology providers
- event and webinar service providers
- accounting, invoicing and administrative service providers
- legal and other professional advisors where necessary
- customers, partners or other parties where disclosure is necessary for service delivery, customer relationship management, fulfilling the agreed purpose or complying with a legal obligation
- public authorities where required by law
Grants Funding Oy requires service providers processing personal data on its behalf to process personal data only in accordance with applicable data protection legislation, contractual obligations and Grants Funding Oy’s documented instructions.
If a recipient processes personal data as an independent controller, the recipient is responsible for the processing of personal data in accordance with its own data protection obligations.
15. Disclosure of Personal Data
Grants Funding Oy does not sell personal data. Personal data may be disclosed to third parties only where there is a lawful basis for doing so.
This may include, for example:
- disclosure based on the data subject’s consent
- disclosure necessary for performing a contract or providing a requested service
- disclosure to service providers acting on behalf of Grants Funding Oy
- disclosure to a customer, partner or other party where necessary for the agreed purpose
- disclosure required by law or a competent authority
- disclosure necessary for establishing, exercising or defending legal claims
If a customer, partner or other receiving party independently determines the purposes and means of processing after receiving personal data, that party acts as an independent controller and is responsible for its own compliance with applicable data protection legislation.
16. Transfers Outside the EU or EEA
Personal data may be processed outside the European Union or European Economic Area where this is necessary due to the technical implementation of the services used by Grants Funding Oy or its service providers. Where personal data is transferred outside the EU or EEA, Grants Funding Oy ensures that the transfer is based on a valid transfer mechanism required by applicable data protection legislation.
17. Data Retention and Processing
Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy. The retention period depends on the type of data, the purpose of processing and applicable legal or contractual requirements.
17.1 Sales and Lead Data
Sales and lead data is retained for as long as the data is necessary for B2B sales, marketing, establishing a customer relationship or related contact. When the data is no longer relevant, it is deleted, anonymised or deactivated, unless there is another lawful basis for retention.
17.2 Customer Data
Customer data, customer communications and notes relating to the customer relationship are retained for the duration of the customer relationship and thereafter for as long as necessary for continuity of the relationship, documentation of the service, potential reactivation, contractual obligations, legal obligations or legal claims.
17.3 Application and Project Materials
We retain application and project materials, including personal data contained therein, in order to serve the customer throughout the full lifecycle of the project. As a general rule, such materials are retained for a maximum of ten years from the end of the project, so that we can support the customer in potential audits, follow-on projects and clarification requests.
The extended retention period is justified in particular because public funding authorities — such as Business Finland and ELY Centres — may initiate recovery proceedings several years after the completion of a project.
The customer and the data subject have the right to request deletion of their data. We will delete the data in accordance with applicable data protection legislation, unless there is still a lawful basis for retaining it.
17.4 Processing of Personal Identity Codes
We process personal identity codes where necessary to identify a data subject unambiguously, for example in the preparation of funding applications and in dealings with public authorities. Personal identity codes are processed solely for this purpose and are not used for any other purposes.
17.5 Accounting and Statutory Data
Accounting records required by law are retained for the period required by applicable accounting legislation. Other data required by statute is retained for the period required by the applicable legislation. Personal data will be deleted, anonymised or securely archived when it is no longer needed for the purposes for which it was collected, unless continued retention is required or permitted by law.
17.6 Deletion of Personal Data and Notification to Recipients
When personal data is no longer needed for the purposes for which it was collected or disclosed, Grants Funding Oy deletes, anonymises or securely archives the data in accordance with applicable law, contractual obligations and the retention principles described in this Privacy Policy.
The termination of a customer relationship or contractual relationship does not automatically mean that all personal data will be deleted immediately if there is still a lawful basis for retaining the data, such as a legal obligation, documentation of the service, fulfilment of contractual obligations, investigation of potential claims, or the establishment, exercise or defence of legal claims.
If Grants Funding Oy has disclosed personal data to recipients and the personal data is rectified, erased or its processing is restricted due to a data subject’s request or another lawful basis, Grants Funding Oy will notify those recipients to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort.
Service providers acting on behalf of Grants Funding Oy process personal data under an agreement and documented instructions, and must delete or return personal data in accordance with the agreement, Grants Funding Oy’s instructions and applicable law. If a recipient acts as an independent controller, it is responsible for the processing, retention and deletion of personal data in accordance with its own data protection obligations.
18. Data Security
Grants Funding Oy implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, disclosure or misuse.
Such measures may include, where appropriate:
- access control based on job responsibilities
- password protection and centralised password management
- encryption and secure storage
- confidentiality obligations for personnel
- instructions and training concerning personal data handling
- limiting access to personal data to persons who need it for their duties
- maintaining and updating information security of ICT systems
- monitoring, backup and recovery practices where applicable
- contractual safeguards with service providers
Grants Funding Oy makes use of the logging, version history and audit trail functionalities provided by the systems it uses, where applicable.
19. Processing of Customer Personal Data as Processor
Where Grants Funding Oy processes personal data on behalf of a customer, it processes such personal data only for the purposes defined in the applicable agreement, assignment, documented instructions or data processing agreement.
In such cases, Grants Funding Oy:
- processes personal data only to the extent necessary
- ensures that persons authorised to process personal data are bound by confidentiality obligations
- implements appropriate security measures
- assists the customer where required by applicable data protection legislation and the agreement
- maintains necessary documentation of processing activities where applicable
- deletes or returns personal data in accordance with the agreement and applicable law
If a customer provides Grants Funding Oy with personal data that is not necessary for the agreed purpose, Grants Funding Oy may instruct the customer on the appropriate handling or transfer method and may delete unnecessary files or data in accordance with applicable instructions and legal requirements.
20. Rights of the Data Subject
The data subject has rights under applicable data protection legislation, including the right of access, right to rectification, right to erasure, right to restriction of processing, right to object, right to data portability where applicable, right to withdraw consent and right to lodge a complaint with a supervisory authority.
21. Exercising Data Subject Rights
Requests concerning data subject rights should be sent to:
Grants Funding Oy
Itämerenkatu 3A
00180 Helsinki
Finland
Email: privacy@grants.fi
Grants Funding Oy may request additional information necessary to verify the identity of the person making the request. Grants Funding Oy responds to requests within the time limits required by applicable data protection legislation.
22. Automated Decision-Making and Profiling
Grants Funding Oy does not make decisions based solely on automated processing that would produce legal effects concerning the data subject or similarly significantly affect the data subject, unless such processing is separately communicated and a lawful basis exists.
Grants Funding Oy may use data to analyse customer interests, improve services, personalise communications or target B2B marketing. Such processing does not produce legal effects concerning the data subject.
23. Changes to this Privacy Policy
Grants Funding Oy may update this Privacy Policy from time to time. The latest version will be available on Grants Funding Oy’s website. If material changes are made, Grants Funding Oy may inform data subjects through appropriate channels where required or appropriate.
24. Language Versions
This Privacy Policy may be made available in different languages. If differences are identified between language versions, Grants Funding Oy will endeavour to correct the differences without delay. Mandatory law always applies primarily.
Last updated: 10 June 2026