Privacy Statement

At Y4 Works, your data matters. This privacy statement tells you who processes your personal data, why we do it, and when we do it. Below, you will find a detailed description on how your data is collected and processed.

Registrar

Y4 Works Oy (“Y4”, “me”)
Y-tunnus: 2978296-6
Osoite: Kanavaranta 9, 00160 Helsinki
Puh: +358 44 741 8648
Sähköposti: tiimi@y4works.fi

If you have questions on data protection at Y4 Works, you can contact:

Otso Kratz
p. +358 44 241 0689
tietosuoja@y4works.fi

Grounds and purposes for processing your data

We collect personal data from our customers, potential customers and visitors to maintain client relationships, to market our services, to measure our service results, to develop our digital services, to fulfill our employer obligations, and to recruit responsibly.

We collect data both on business customers (advisory, consultancy and training services) and on individual customers (employment support, career coaching and training).

We process personal data on the following legal bases, depending on the purpose of the processing:

• Consent: Your consent to the processing of your personal data.
• Contract: When the processing of personal data is necessary for the performance of a service agreement or for taking steps prior to entering into a contract (e.g. customer relationships, use of the Suunta.ai service, recruitment).
• Legal obligation: When processing is necessary for compliance with our statutory obligations (e.g. accounting, employer obligations).
• Legitimate interest: Managing customer relationships, developing services, marketing to corporate customers, safeguarding our business operations, and preventing misuse.
• Publicly available data: Data that you have made publicly available.
  

Regular sources for personal data

We regularly gather personal data from the following sources:

• Directly from our data subjects
• From the Finnish Trade Register
• From the Digital and Population Data Services Agency
• From Vainu, Bisnode, Asiakastieto and other private service providers offering business entity data
• From public digital sources of our customers and potential business customers, and from analytic tools drawing data from these sources
• From the TE office, the ELY centers and other public sector partners as a part of service providing agreements and contracts

What data do we process?

We only collect and process personal data which is necessary for the purposes stated in this Privacy Statement.

We may process personal data under the following topics.

Basic information and data we need to maintain customer relations

Name, phone number, email address, company name, business ID, industry, KPI’s, business data from public record and contents of customer transactions.

From individual customers, we may also collect data regarding employment status and history. Collecting and processing personal ID’s is sometimes necessary to fulfill contractual obligations to provide services.

Other data necessary to maintain customer relations

In recruiting and recruiting assignments we may collect the applicants contact information, professional skills, work applications, CV’s, and other information provided by the applicant. We also collect and process necessary data to fulfill legal employer obligations.

Data used in marketing and sales

Data concerning status and position in business or public office, professional interests, other data you share, dat of marketing directed at you, participation in public events, direct marketing permissions, and expressions of consent including bans and limitations you have set.

User data in digital services

We develop our website and our other digital services using Google Analytics and Google Tag Manager. With these tools, we can analyze how our services are being used and develop them accordingly. To allow this, we use cookies. Your data in our digital services is never collected or processed in a way that allows your data to be associated to you personally. In certain situations, information collected via cookies may constitute personal data. We process this information in accordance with applicable data protection legislation. You can modify your cookie settings on our website or in your browser or device settings. If you deny all cookies, it is possible we are not able to provide you with the services you need.

In our digital service, we use third party community plugins. These help us manage marketing campaigns in social media, and follow how our digital services are used. Digital services offering these plugins can set cookies of their own and according to their own privacy statements. More information on the community plugins we use: Facebook, LinkedIn, YouTube and X.

Processing of Personal Data by Suunta.ai

During the use of the Suunta.ai service, we collect and process personal data in order to enable the use of the service and develop it to meet the needs of users. When using the service, we instruct users not to enter personal data or sensitive information into the service. The AI functionalities of the Suunta.ai service are designed to be used without processing personal data.

If personal data is processed, the data is treated confidentially and only for the purposes described in this privacy statement. The data is stored and the application is operated on Amazon Web Services (AWS) servers located in Stockholm, Sweden. Additionally, we use the OpenAI ChatGPT API, which complies with privacy policies ensuring the secure processing of personal data. You can read more about OpenAI’s privacy policies here.

Examples of user information in our digital services:

• Registering information required for service: user name or an alias, password, and other personal information
• Service use and browsing information, shown adds and clicking data
• Browsing information on the website from which you were directed to our website, device and browser model, cookie ID and mode of data accumulation
• Browser version, IP address (anonymisized in Google Analytics), session ID, session time and length, screen resolution, operating system and location data

Processing of personal data in the Tekoälypassi online course

Tekoälypassi is a Y4 Works online course available at tekoalypassi.y4works.fi. We process the personal data of purchasers and participants so that the course can be purchased and completed, the exam assessed, and diplomas issued and verified.

Personal data we process

For participants, we store their name, email address, access code used, scores for each module, exam result and completion date, diploma identifier, course material version, and any marketing consent given. For purchasers, we store their name, email address, number of course places purchased, access code and payment identifier. Payments are processed by Stripe. We do not receive the full payment card number or security code.

To prevent misuse, we create a hashed identifier from the IP address. The identifier is automatically deleted after 10 minutes. To allow participants to continue the course, their name, email address, access code and completed modules are stored in their browser. These details can be removed using the button in the course website’s footer or by clearing browser data. The Tekoälypassi website does not use tracking or marketing cookies.

Purposes and legal bases for processing

When a person purchases the course for themselves, the processing necessary for the purchase and completion of the course is based on a contract. When a participant uses an access code purchased by a company, the processing necessary to provide the course and verify its completion is based on the legitimate interests of Y4 Works and the company. We also rely on legitimate interests to share completion data with the company that purchased the access code, process company purchasers’ contact details and prevent misuse. We retain purchase records to comply with a legal obligation. We use personal data for marketing only if the person gives separate consent. Giving consent is optional, and it can be withdrawn at any time. A name, email address and access code are required to complete the course.

Disclosure of data and service providers

The company that purchased the access code can see the following details of exam attempts made using that code: the participant’s name and email address, scores for each module, exam result and completion date. We inform participants of this before they start the course. Anyone who knows a diploma identifier can use the verification page to check the participant’s name, completion date and course material version.
Our server and database are provided through Domainkeskus Oy’s Nettihotelli service, whose servers are located in Finland. Payments are processed by Stripe Payments Europe Ltd, and we use Google Workspace to send emails. Stripe may transfer data outside the EU and EEA using the transfer mechanisms described elsewhere in this privacy notice.

Automated assessment and retention periods

The exam is assessed automatically based on the answers given. A failed exam may be retaken without limit. Y4 Works does not make decisions concerning a participant’s employment based on the exam result. We retain exam attempt data and diploma verification data for five years from the exam attempt. The data is then deleted automatically, and the diploma can no longer be verified through the service. Accounting records relating to purchases are retained for at least six years from the end of the calendar year in which the financial year ended. Marketing data is retained for the period stated elsewhere in this privacy notice.

Disclosing personal data

By default, we do not disclose your personal data.

As a part of providing a service, we might disclose specific and limited information to a specific recipient, e.g. the TE office as a part of a legal obligation or a contractual obligation.

As we work under Finnish legislation, it is also possible we are obliged to disclose specific your personal information to Finnish or European legal authorities.

In some cases, we are required to share your personal data with third parties, e.g. a subcontractor. If we share your data with a third party, it is always limited to use for the same purposes the data was originally collected for, e.g. providing a service you have requested. This is always done in compliance with a written agreement on data protection with the third party, including at least the protocols and level of security set in this Privacy Statement.

If you’re applying for a job vacancy through us, we might share your information with your potential future employer. The employer is responsible for the methods they process this data, although it is always done according to a written agreement on data protection. If you have any questions how the employer, is processing your data, please contact them.

You can always contact us for more detailed information on how we process your personal data with third parties.

Data transfers outside EU/ETA area

As a rule, we process personal data within the EU and EEA. If we use service providers whose operations may involve transfers of data outside the EU or EEA, we ensure that such transfers are carried out in accordance with transfer mechanisms approved by the European Commission, such as the European Commission’s Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework.

Protecting your personal data

We process your data ensuring the safety of your personal data including protection from illegal processing, accidental deletion, loss, and corruption.

To ensure this goal is met, we use technical and organizational protection methods including fire walling, encryption, upholding the safety of our physical infrastructure, limitation and control of access to our premises, careful maintenance of login information and constant training of our people processing your data.

We as a company and every employee at Y4 Works who processes your data are, under threat of penalty, legally obliged and to process your data in compliance the Employment Contracts Act (55/2001).

Timeframe of storing data

We process your data according to the following time limits:

• Job applicant records: maximum of three years. If the applicant so wishes, we can delete the records earlier or store them for longer.
• Business customer records: maximum of ten years.
• Employment coaching records: maximum of two years.
• Records of employees of Y4 Works: full duration of employment, and maximum of ten years after the employment has ended.

We retain the personal data of data subjects in accordance with the law and as long as it is necessary for the purposes described in the privacy policy. We will delete or anonymize the personal data of data subjects when we no longer have a legal basis or need for processing.

Personal data in the marketing register is retained for the duration of the customer relationship and for a maximum of two (2) years after the last active contact, unless the data subject withdraws their consent earlier. Analytics data collected through our online services is retained for the period defined in our cookie settings, and in any case for no longer than 26 months.

We reserve the right to retain certain personal data in the register for longer than stated above in order to comply with legal or regulatory requirements.

Your rights as a data subject

Right of access to your personal data

As a data subject, you have the right to receive confirmation if your data is being processed by us. If so, you have the right to a copy of all your personal data.

Right to cancel your consent to data processing and direct marketing

As a data subject, you can cancel your consent to data processing and direct marketing at any time. You can also, at any time, deny the use of your data to direct marketing including profiling.

Right to rectify

As a data subject, you have the right to demand rectification of inaccurate or misleading personal data. You also have the right to receive a copy of your corrected personal data.

Right of deletion

As a data subject, you have the right to demand deletion of your personal data if:

• your data is no longer needed for the purposes it was originally collected; or
• you cancel your consent we have based our right to process your data on, and there is no other legal justification for processing your data; or
• your personal data has been processed illegally.

Right to limit data processing

As a data subject, you have the right to limit the processing of your personal data if:

• you dispute the accuracy of your personal data; or
• we process your data illegally, you oppose the deletion of your data and demand instead we limit the processing of your data; or
• we no longer need your data for the purposes the data was originally collected but you need the data in order to pursue a legal demand, or to defend yourself from one.

Right to object

As a data subject, you have the right to object partially or completely the processing of your personal data based on a particular personal reason. In this case, we are not allowed to process your data unless we can establish a particularly important and justifiable reason superseding your benefits, rights or liberties. Even in this case, we are still allowed to keep processing your data to pursue a legal demand, or to defend ourselves from one.

Right to transfer data between processing tools

As a data subject, you have the right to receive your personal data in a structured, commonly used and digitally readable form. You also have the right to transfer your data to another registrar.

Right to notify the supervising official

The public official supervising the data processing protocols stated in this Privacy Statement is the Data Protection Ombudsman working under the Ministry of Justice. As a data subject, you have the right to notify the Data Protection Ombudsman if you think your data is collected or processed wrongfully or illegally. You can read more on this subject on the Data Protection Ombudsman website.

User Rights in the Suunta.ai Service

Users have the right to receive information about the data collected about them, request correction or deletion of the data, and withdraw their consent for the processing of personal data at any stage.

Changing the data processing protocols

We develop our methods of data processing constantly. In order to get better, we may have to update and alter our data processing protocols stated in this Privacy Statement. We may also have to update our data processing protocols to oblige with new legislation.

If the alterations or updates contain new purposes for data processing or if the data processing protocols change otherwise significantly, we will notify all data subjects beforehand and, if necessary, ask for permission to keep processing the data under the new protocol.

Our privacy statement in Finnish here.