EP-Logistics Oy Privacy Policy

Privacy policy in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (2016/679). Last updated 26 October 2026.

1 Controller

EP-Logistics Oy (Business ID 2259958-7)

Nuijamiestentie 5 C, 3rd floor

FI-00400 Helsinki, Finland

info@ep.fi

+358 9 134 4531

2 Contact for privacy matters

Privacy enquiries and requests: info@ep.fi (subject line “Privacy”).

3 Purposes, legal bases and retention periods

We process personal data only for the purposes described below. As we mainly work with business clients, the data we process relates primarily to contact persons at companies and organisations.

A Responding to enquiries

Personal data: name, email address, phone number, organisation and message content.

Legal basis: legitimate interest in responding to the enquiry. For quote requests, steps prior to entering into a contract (Article 6(1)(b) and (f) GDPR).

Retention period: 24 months from the last contact, unless the enquiry leads to a client relationship.

On the contact form, name and email address are required so that we can reply to your message. Providing other information is optional. Contact form messages are delivered to our email and are not stored in the website database.

B Managing client relationships and assignments

Personal data: contact person’s name, title, organisation, contact details and assignment-related correspondence.

Legal basis: performance of a contract and legitimate interest (Article 6(1)(b) and (f)).

Retention period: for the duration of the client relationship and 5 years after it ends. Accounting records are kept for 6–10 years in accordance with the Finnish Accounting Act.

C Newsletter and marketing communications

Personal data: name, email address, organisation and subscription and unsubscription records.

Legal basis: for subscribers who signed up themselves, consent (Article 6(1)(a)). For representatives of client and partner companies, legitimate interest (Article 6(1)(f)) and section 200 of the Finnish Act on Electronic Communications Services (917/2014).

Retention period: until the recipient unsubscribes or objects to marketing. Inactive recipients are removed after 5 years.

The newsletter is sent no more than four times a year. Every message includes a link to unsubscribe.

D Recruitment

Personal data: name, contact details, application, CV and other information the applicant sends to rekry@ep.fi.

Legal basis: steps prior to entering into a contract and legitimate interest (Article 6(1)(b) and (f)). For open applications, the applicant’s consent (Article 6(1)(a)).

Retention period: applications for a specific position 2 years after the recruitment ends, and open applications 12 months.

E Website operation and security

Personal data: IP address, browser and device data, and strictly necessary cookies.

Legal basis: legitimate interest (Article 6(1)(f)).

Retention period: log data up to 12 months.

F Website analytics and company visitor identification

Personal data: browsing and usage data, IP address, cookie identifiers and the organisation identified from the IP address. We use Google Analytics and Leadfeeder.

Legal basis: consent (Article 6(1)(a)). Consent can be given and withdrawn through the cookie banner.

Retention period: as stated in the Cookie Policy.

Leadfeeder identifies, based on the IP address, which organisation’s network a website visit comes from. We use this information to target sales and marketing at company level, not to identify individual visitors.

4 Sources of personal data

We primarily collect data directly from you, for example through the contact form, by email, through a newsletter subscription, a job application or in the course of client work. We may also receive contact details of client and partner representatives from their employer or from public sources such as company websites. Website usage data is collected using cookies and similar technologies.

5 Cookies and embedded content

We use strictly necessary cookies to ensure the website functions properly. Analytics and marketing cookies (Google Analytics, Leadfeeder) are used only with your consent. The Google Maps map on our contact page may set cookies and transmit data to Google, so it is shown only after you consent.

You can change your choices at any time using the “Manage consent” button at the bottom of the page. More information is available in our Cookie Policy.

6 Recipients and processors

We do not sell or rent personal data. Our website is maintained by our own staff. We also use the following service providers, which process data on our behalf under data processing agreements in accordance with Article 28 GDPR.

• HubSpot: customer relationship management and newsletters. Data is stored in a data centre located in the EU.
• Microsoft 365: email, including contact form messages and job applications.
• Google Analytics (Google Ireland Ltd): website visitor statistics.
• Leadfeeder: identification of organisations visiting the website.
• Google Maps (Google Ireland Ltd): map on the contact page.
• Seravo: website hosting.

Data may be disclosed to authorities where required by law.

7 Transfers outside the EU/EEA

We store personal data primarily within the EU and EEA. HubSpot, Microsoft and Google belong to US-based groups, so they or their sub-processors may also process data outside the EU and EEA, for example when providing technical support. In such cases, transfers are based on a European Commission adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses approved by the Commission.

8 Data security

A Manual records

No data is kept in manual form.

B Electronically processed data

Personal data is stored in secured electronic systems. Access is restricted by personal credentials to employees who need the data for their work. Everyone processing the data is bound by confidentiality.

9 Your rights

Under the GDPR, you have the right to:

• know whether we process your data and access it
• have inaccurate data corrected
• have your data erased
• restrict processing
• object to processing based on legitimate interest, and object to direct marketing at any time
• receive data you have provided in a portable format, where processing is based on consent or contract
• withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact info@ep.fi. We will respond within one month. We may ask you to verify your identity.

10 Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en). We encourage you to contact us first so that we can resolve the matter.

11 Automated decision-making

We do not make automated decisions based on personal data that have legal or similarly significant effects.

12 Changes to this policy

We update this policy as needed, for example when our services or applicable laws change. The current version is always available on this page.