Privacy Policy

1. Controller and contact person

Inventio Attorneys Ltd (Business ID: 2420286-2, “Inventio”, “we”)
Address: Bulevardi 7 A, 00120 Helsinki
Telephone: +358 9 348 9866
Contact person: Kati Jokinen (info@inventio.fi)

2. General

This privacy policy (“Privacy Policy”) sets out how Inventio processes the personal data of its current and former clients, prospective clients, and all other individuals whose personal data may be processed in connection with Inventio’s legal services, management of service and supplier agreements, events, trainings, communications and marketing activities, personnel recruitment, and the security monitoring of Inventio’s premises (“Data Subject”).

We will amend this Privacy Policy if necessary and recommend that you review its contents periodically. This Privacy Policy was last updated on 27 October 2026.

3. Categories and sources of personal data, as well as the purposes and legal bases for the processing of personal data

Personal data or categories of personal data processed	Purposes of processing	Sources of personal data	Legal bases for processing
Identification and identifying data of persons involved in assignments, and other information necessary for the performance of such assignments, such as details of clients, clients’ counterparties and the clients, employees, business partners and representatives of the foregoing, witnesses and experts, as well as representatives of public authorities, courts and insurance companies. Such data may include, for example, name, personal identification number, date of birth, gender, home address, telephone number, audio, image and video data, email address, nationality, employer, position within the organisation, and other details depending on the nature of each assignment. Depending on the assignment, the data may also include data belonging to special categories.	Management and performance of the assignment.	The Data Subject; documents between Inventio and the Data Subject; clients; counterparties; business partners; other persons involved in the assignment; public sources and social media platforms; public authorities; private and public registers; information services.	The legitimate interests of Inventio or a third party (carrying out assignments, safeguarding rights and property, securing interests relating to contractual arrangements, drafting legal claims, and engaging a representative in the protection of rights and interests, as well as in civil and criminal matters); Inventio’s statutory obligation (Attorneys Act (496/1958)). For data belonging to special categories, the applicable exemption is the establishment, exercise or defence of legal claims.
Information required for the prevention of money laundering and terrorist financing, and other identification-related information, such as political and ownership affiliations, information on sanctions, family relationships, employer details, and information relating to identity verification.	Client due diligence (KYC) and the prevention of money laundering.	The Data Subject; public authorities; private and public registers and in-formation services.	Inventio’s statutory obligation (Act on Preventing Money Laundering and Terrorist Financing (444/2017); Attor-neys Act (496/1958); Limited Liability Companies Act (624/2006); relevant EU regulations).
Invoicing details, such as the name, job title, organisation, email address, telephone number, invoicing address and client reference of the invoicing contact person, and other identification and specification details relating to invoicing, as defined in the applicable agreements.	Invoicing.	The Data Subject; clients; documents between Inventio and the Data Subject; private and public registers and information services.	Performance of a contract; Inventio’s legitimate interest (management and collection of receivables); Inventio’s legal obligation (Accounting Act (1336/1997)).
Data relating to marketing, events and business development, such as name, address, telephone number, email address, information available on social media platforms, organisation, audio, image and video data, job title and employment history, educational background, marketing opt-outs, event attendances, consents, feedback, areas of interest, and other identification and identifying data of our different stakeholders and potential clients. Data relating to marketing, events and business development, such as name, address, telephone number, email address, information available on social media platforms, organisation, audio, image and video data, job title and employment history, educational background, marketing opt-outs, event attendances, consents, feedback, areas of interest, and other identification and identifying data of our different stakeholders and potential clients.	Organising and inviting persons to events and training sessions; marketing; compiling participant lists; sending newsletters and other marketing communications; and maintaining and developing client relationships and services.	The Data Subject; clients; public sources and social media platforms; registration forms; email correspondence; business partners; public authorities; private and public registers and information services.	Inventio’s legitimate interests (maintaining and developing client relationships and services, organising events, and marketing communications); the Data Subject’s consent regarding the use of audio, image and video data for marketing purposes; the Data Subject’s consent regarding electronic direct marketing directed at private individuals, except where the exemption under Section 200 (3) of the Act on Electronic Communications Services (917/2014) applies or where the individual holds a role within an organisation to which the services offered through the direct marketing are materially related.
Information regarding dietary requirements and allergies in connection with catering at events.	Organising catering for events and functions, taking into account the Data Subject’s dietary requirements and allergies, and ensuring the Data Subject’s health and safety.	The Data Subject.	The Data Subject’s explicit consent; protection of the Data Subject’s vital interests.
Data relating to website visitors, such as IP addresses, cookie identifiers, consents, analytics data and other information observed in connection with the use of the website. Our website uses essential cookies to enable its basic functions. In addition, with the visitor’s consent, cookies may be used for content targeting, analysing web traffic and providing social media functions. Cookies may also be set by third parties, who may combine data collected on the website with other data in their possession.	Website development; marketing; statistics; ensuring the proper and secure functioning of the website.	Systems and services related to the website; business partners.	Consent; Inventio’s legitimate interest (ensuring the security and proper operation of the website).
Recruitment data, such as name, address, telephone number, email address, job applications, CVs, interview details, referee details, audio, image and video data, consents, information available on social media platforms, employment history, educational background, certificates, suitability assessments, information regarding nationality and residence or work permits, as well as other recruitment-related identification and identifying details.	Recruitment of new employees and recruitment procedures.	The Data Subject; documents between Inventio and the Data Subject; recruitment partners; official registers; social media platforms; referees provided by the Data Subject; service providers conducting suitability assessments; other sources, with the Data Subject’s consent or pursuant to applicable legislation.	Performance of a contract (e.g. an employment contract and preparatory measures); Inventio’s legal obligation (Non-Discrimination Act (1325/2014); the Act on Equality between Women and Men (609/1986)); Inventio’s legitimate interests (e.g. recruitment and the support and exercise of Inventio’s operations and rights); the Data Subject’s consent (e.g. in relation to suita-bility assessments and referee information).
Data relating to security monitoring of premises, such as audio, image and video recordings from video surveillance, identification and identifying details generated by access control systems (name, time of access, identification number and location of access), and other identification and identifying details.	Ensuring the security of the premises and the safety of persons present there; protecting property; access control; identifying persons moving in the premises; investigating cases of misuse, damage and false alarms; and installation and maintenance work on the premises.	Inventio’s video surveillance system and access control equipment; business partners.	Inventio’s legitimate interest (ensuring the safety of the premises and the persons present there, as well as their legal protection).
Information relating to service and supplier agreements, such as the name, address, telephone number, email address and billing details of the contractual partner’s contact persons, as well as other identification and identifying data necessary for the administration of the agreements or otherwise related thereto.	Entering into service and supplier agreements, as well as the related administration, implementation, invoicing, payments, monitoring, compliance with obligations, and communication.	The Data Subject; documents between Inventio and the Data Subject; private and public registers and information services.	Performance of a contract (service or supplier agreement and preparatory measures); Inventio’s statutory obligation (Accounting Act (1336/1997)); Inventio’s legitimate interests (the support and exercise of Inventio’s operations and rights).

Further information on the balancing tests relating to the legitimate interests can be obtained from the contact person named in Section 1.

Personal data will not be used for profiling or such automated decision-making that would produce legal or other significant effects for the Data Subject.

The provision of personal data is voluntary insofar as the Data Subject may decide whether to participate in Inventio’s recruitment process or to enter into an assignment or other similar relationship with Inventio. However, the provision of certain data is necessary for entering into or continuing a contractual relationship or is required by applicable law. Without such data, Inventio may be unable to enter into or continue a contract with the Data Subject or unable to fulfil its statutory obligations (for example, entering into an assignment agreement, identifying the client, issuing invoices, as well as collecting an applicant’s identification and contact details and assessing their suitability all require the provision of certain information).

4. Recipients and categories of recipients of personal data, and the transfer of personal data to third countries

We process personal data primarily within our own internal operations. Personal data is or may also be disclosed to Inventio’s service providers, such as providers of marketing, recruitment, insurance, travel, client relationship management, IT, artificial intelligence, website maintenance, invoicing, security, telecoms, communications, consultancy and other services, as well as to other parties involved in each respective assignment, some of whom act as processors and some as independent controllers. The Data Subject’s personal data may also be disclosed to third parties in the following circumstances:

• With the Data Subject’s consent
• To protect the rights of Inventio, its stakeholders, or the Data Subject
• To comply with statutory obligations or regulatory orders or requests

Third parties process personal data only to the extent required for each specific purpose. Inventio enters into a data processing agreement with all processors that handle personal data on its behalf.

As a general rule, personal data is not transferred outside the EU/EEA. However, where such transfers do occur, for example, due to the nature of the assignment or the location of our service providers’ sub-processors or parent companies,  we ensure that they are carried out in accordance with and within the limits set by data protection legislation, such as on the basis of adequacy decisions adopted by the European Commission or, where necessary, by using standard contractual clauses approved by the European Commission, supplemented by additional safeguards.

5. Retention period for personal data

We retain personal data only for as long as is necessary to fulfil the purpose of each processing operation or for the period required by mandatory legislation. Retention periods may vary significantly depending on the type of processing and the personal data concerned, but are generally determined as follows:

• Data relating to assignments: Retained for a minimum of ten years following the conclusion of the assignment, unless a justified reason warrants longer retention. Personal data of prospective clients is retained for no more than two years.
• Data relating to marketing, events, client feedback, and the development of business operations and client relationships: Retained for the duration of the client relationship and for no more than two years after its conclusion. Data relating to the development of business operations and client relationships is retained for as long as the relevant development measures require, but for no more than two years from the most recent client contact or development measure. Data relating to prospective clients, event attendees, and other similar categories is retained for no more than two years from the most recent contact, event attendance, or receipt of marketing communications.
• Data relating to the prevention of money laundering and terrorist financing: Retained for a minimum of five years from the end of the client relationship or the completion of an individual business transaction.
• Invoicing data: Retained for six or ten years from the end of the financial year in which it was recorded, depending on the nature of the data.
• Recruitment-related data: Retained for the duration of the recruitment process and for no more than six months following the recruitment decision.
• Website visit data: Cookie-specific data is retained for the period specified in the website’s cookie pop-up window.
• Data relating to the security of premises: Access control data containing personal data is retained for the duration of the relevant person’s employment or service relationship, or until their access rights expire. Other access control data and CCTV recordings are retained for no more than 30 days from the date of recording.
• Data relating to service and supplier agreements: Retained for the duration of the contractual relationship and thereafter for the applicable limitation period (generally three years from the end of the contractual relationship). Data required under the Accounting Act is retained for six or ten years from the end of the financial year in which it was recorded, depending on the nature of the data.
• Data belonging to special categories: Deleted without delay once there is no longer any legal basis for processing and the data is no longer necessary for compliance with the obligations or specific rights of Inventio or the Data Subject, or for the establishment, exercise or defense of legal claims.

In addition to the data-specific retention periods set out above, Inventio applies the following general retention principles based on the applicable legal basis for processing:

• Data processed based on a contract: Retained for the duration of the contract or service and thereafter for as long as necessary to pursue claims or to resolve any outstanding matters (e.g. until the expiry of the general statute of limitations).
• Data processed based on Inventio’s or a third party’s legitimate interests: Retained for as long as the legitimate interest subsists, unless the Data Subject has objected to the processing on reasonable and valid grounds.
• Data processed based on Inventio’s legal obligations: Retained for the period prescribed by the applicable legislation.
• Data processed based on consent: Retained for the period necessary to fulfil the purpose of the processing and in accordance with the scope and validity of the consent. Once consent is withdrawn, processing on that legal basis will cease.

Personal data will be retained beyond the periods described above where required by applicable legislation or by an order or request of a public authority, or where the data is needed to investigate a case of misuse or damage, or to establish, exercise or defend legal claims. In such cases, the data will be retained for as long as is necessary to handle the matter. Further information on retention periods is available from the contact person named in Section 1.

6. Security of processing and principles of personal data protection

The adequacy of measures relating to the security of processing and the protection of personal data is determined on the basis of a risk assessment that takes into account the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of Data Subjects. These measures are assessed and updated on a regular basis.

Inventio’s technical and organizational security measures include, among other things, firewalls, physical protection of servers, internal guidelines on information security and data protection, audit and risk assessment processes, non-disclosure agreements, business continuity and disaster recovery plans, access controls and restricted user rights, as well as regular updates to systems. Workstations are protected by security software, and hard drives and data are encrypted. Premises are kept locked, and the buildings are fitted with alarm and CCTV systems. Personal data is stored in secure electronic directories or in locked cabinets and filing systems.

Personal data is processed only by those Inventio employees and representatives whose duties require such processing, and only to the extent necessary for the performance of those duties. All employees and representatives who process personal data are bound by a confidentiality obligation and receive regular data protection training.

Inventio has entered into agreements with all business partners and sub-processors that process personal data to ensure that such data is processed appropriately and in compliance with data protection legislation. Inventio has also designated personnel responsible for the development, implementation and maintenance of data protection and data security.

7. The Data Subject’s rights

Data Subjects have the following rights under applicable data protection legislation:

The right to access data	Subject to certain conditions, the Data Subject has the right to obtain confirmation from Inventio as to whether personal data concerning them is being processed and, where that is the case, to access such personal data.
The right to erasure of data	Subject to certain conditions, the Data Subject has the right to request that their personal data be erased.
The right to rectification of data	The Data Subject has the right to request that Inventio rectify any inaccurate personal data and supplement any incomplete personal data. Please notify us without delay of any changes to or inaccuracies in your personal data.
The right to restrict processing	Subject to certain conditions, the Data Subject has the right to request that the processing of their personal data be restricted.
The right to object to processing	Subject to certain conditions, the Data Subject has the right to object to the processing of their personal data. This right applies, among other things, to the processing of personal data for direct marketing purposes.
The right to data portability	The Data Subject has the right to receive certain personal data concerning them that they have provided to Inventio in a structured, commonly used and machine-readable format, and to request the transmission of such data to another controller.
The right to withdraw consent	Where processing is based on the Data Subject’s consent, the Data Subject has the right to withdraw that consent at any time by informally contacting the contact person named in Section 1. The withdrawal of consent does not affect the lawfulness of any processing carried out on the basis of consent prior to the withdrawal.

Inventio will also, on its own initiative and without undue delay, erase, rectify and supplement any personal data that it identifies as inaccurate, unnecessary, incomplete or outdated relative to the purposes for which they are processed.

Requests and notifications shall be submitted informally to the contact person named in Section 1. In connection with a request, the Data Subject may be asked to verify their identity or to answer certain questions. Further information on the Data Subject’s rights and the conditions for their exercise is available on the website of the Office of the Data Protection Ombudsman (tietosuoja.fi).

The Data Subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes applicable data protection legislation. A complaint may be lodged, for example, in the EU Member State in which the Data Subject has their habitual residence or place of work, or in which the alleged infringement occurred. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi):

Office of the Data Protection Ombudsman
P.O. Box 800, 00531 Helsinki
Telephone: +358 29 566 6700
Email: tietosuoja@om.fi