På svenska


Last updated: 09/09/2021

This Privacy Statement describes how Otava handles the personal data of its customers, potential customers, consumers, stakeholders, users of Otava products, and participants in events.
User of Otava’s digital learning material: you can find more detailed information on data processing and the controller here.


1 Controller

Otava Publishing Company Ltd (Business ID 1564596-0) and the companies belonging to the same Group at any given time (hereinafter referred to as ”Otava”) act as the controller of your data. Otava and the companies belonging to the same group act as joint controllers, and personal data can be processed within the Group across company boundaries.

Address:         Uudenmaankatu 10, 00120 Helsinki, Finland

Telephone:     +358 (09) 15661

Email:             tietosuoja@otava.fi

2 Definitions

A data subject refers to a person whose personal data Otava processes.

Personal data refers to information related to a data subject, such as name, address, email, telephone number and contact history.

 Customer refers in this context to consumers and representatives of companies and other entities (hereinafter jointly referred to as “the company”) with whom Otava has a customer relationship.

Potential customers refer to consumers and company representatives with whom Otava seeks to establish a customer relationship.

A stakeholder representative refers to contact persons of companies and other entities with whom Otava has a co-operation relationship (e.g. representatives of companies and other entities as well as authors providing services for Otava) or other connection (e.g. representatives of the media as parties to information activities and public decision-makers related to public relations activities).

A data subject refers to a person whose personal data Otava processes in its activities. The data subject can be, for example, a customer, potential customer or stakeholder representative.

3 For what purposes and on what grounds do we process your personal data?

Otava processes personal data for the following purposes (one or several at a time):

• Management and analysis of customer and stakeholder relationships

Otava can utilise your personal data to manage, analyse and improve a customer or stakeholder relationship that was either created directly with you or with a company or other entity you represent.

• Delivery of products and services

Otava can use your personal data to provide products and services, provided that you or the company / other entity you represent have, for example, purchased a product from us, used our digital services, subscribed to our newsletter, or participated in our training or other events. The personal data is used to implement rights and obligations based on a contract or other commitment between Otava and the customer.

• Customer communications

Otava can use your personal data in its customer communications, for example, to send you notifications about products and services, inform you about changes made to services, and request feedback on products and services.

• Marketing

Otava can contact you about new products, services or benefits. Otava can use personal data to tailor its line of products and provide relevant content. This means, for example, that we make recommendations or show tailored content and tailored advertisements in our own and third-party services, such as in digital products and on websites.

• Development of products and services

Otava can use your personal data to develop its products and services: for example, to develop the selection and content of products and services based on the age of our customers and their interests.

•  Ordering products, services ordered by Otava and acting as an author for Otava

Otava can use your personal data if you or the company you represent provide Otava with services or products. Otava also processes your personal data when you submit manuscripts or other material to Otava or when you act as an author for Otava.

Bases for processing

The legal basis for processing personal data can be one of the following:

•  Contract

Otava can process your personal data on the basis of a contract when the processing is necessary to implement a contract to which you are a party, or for the implementation of pre-contractual measures at your request. Otava processes your information to implement a contract with you or the company you represent (for example, the implementation of an online purchase or the implementation of a digital service). After the contract relationship has ended, the processing of your information may in some cases be continued,based on either a statutory obligation of Otava or a legitimate interest of Otava in commercial activities.

•  Statutory obligation

Otava can process your personal data when the processing is necessary to comply with Otava’s statutory obligation. Such obligations include, for example, information related to the order you have placed or the service you have provided, which must be stored on the basis of the Accounting Act.

•  Legitimate interest

Otava can also process your data when the processing is necessary to achieve the legitimate interests pursued by Otava or a third party, except when such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. Otava has legitimate interests related to its business activities, such as the right to promote the sale of its products and services through marketing and sales. On the basis of a legitimate interest, Otava may conduct direct marketing and sales using your contact information, including the processing of personal data for profiling. For more information about profiling, see section 6 of this Privacy Statement.

Other legitimate interests respective to Otava based on which your personal data can be processed, include advice and other customer service for non-customers, further business development, and investigation of possible abuses.

•  Consent

Otava may also process your personal data if you have consented to the processing of your personal data for one or more specific purposes. If the processing of data is not based on a need for a contract or a legitimate interest, Otava may request your consent for other types of personal data processing. Consent is also the basis for processing, for example, the use of non-essential cookies. For more information about cookies, see section 14 in this Privacy Statement.


4 What type of data can we process?

The personal data collected by Otava may include the following types of data and changes made to them. All data types are not collected from all data subjects, i.e. the collected and processed data from the data subject depends on the role of the person in relation to Otava. For example, we need less personal data from stakeholder representatives than from the users of our products.

4.1 Basic information of all the data subjects

·       first and last name

·       contact information (postal address, email address, telephone numbers)

·       gender

·       date of birth

·       service language

·       title and/or job description of current and previous positions related to Otava’s activities

·       direct marketing options

·       information on how a product is purchased

·       information on the use of Otava’s digital services and digital content created for the user

·       information on cookies and other similar technologies sent by Otava to the user’s digital devices (such as computers and mobile devices)

·       communication to the data subject and the related activities

·       customer service call recordings, emails and online discussions

·       areas of interest reported by the data subject

4.2 Information of data subjects who have purchased, used, provided feedback and/or complained about the products or services of Otava

·       name of Otava’s corporate customer, i.e. the name of the company or other entity connected with Otava’s customer relationship in which the data subject currently works or has worked in the past

·       date and manner of the starting and ending of a customer or similar relationship

·       campaigns and offers targeted at the customer and their use

·       interests and other information reported by the customer

·       content, correspondence and follow-up of feedback and complaints

·       photo and/or video of the data subject if the data subject uploads a photo or video to Otava’s service, for example, when using digital learning materials

4.3 Information of data subjects who participated in Otava’s events

·       event in which the person participates

·       dietary information (specific categories of information based on the user’s consent. This information will be deleted immediately after the event.)

·       date of birth and the name and date of birth of the travel companion if required by, for example, the tour operator

·       essential information on the organisation represented and participation in the event

4.4 Identification information of the customers of Otava’s online services

·       logging identifiers of the data subject

·       activities and actions in the online service after logging in, such as clicks, roaming and activities in Otava’s services

4.5 Information about the data subjects who are Otava’s stakeholders

·       information on personal identity code, salaries, fees, expenses paid and other possible financial contributions

·       occupation or education

·       information on being in the VAT register and preliminary tax withholding register

·       information on the products or services supplied

5  From which sources do we collect your personal data?

As a rule, we collect your personal data directly from you and only when necessary. Most of the information we process comes from you at the beginning of and during a customer and stakeholder relationship. We may also collect information through the products or services you use, such as Otava’s digital content.

Otava also receives personal data and updates to it from authorities, organisations and companies that provide credit and personal data acquisition and updating services, as well as from public directories and other public sources, such as community websites and social media channels.

Otava may also collect information on the representatives of companies and other entities through recommendations, in which case the main contact person of the company or other entity may also share personal data with Otava about other persons as related to the use of Otava’s products and services.

Otava only processes your credit information in specific situations permitted by law, such as billing or collection.

6 Do we use your personal data for profiling?

We may use your personal data for profiling, i.e. to automatically process your personal data and evaluate certain personal characteristics. Otava does not make automated individual decisions that have legal or significant consequences.

We can, for example, combine information about your orders and target marketing to you as based on your orders. As a rule, we receive the information through cookies. Otava uses Google and Facebook’s analytic services to help us learn about your online activities. For more information about how to use cookies in Otava, see section 14.

User of Otava’s digital learning material: please refer to the Do we use your data for profiling? section in the digital learning material section for more details.

7 Who can we share your personal data with?

Otava does not provide, sell or otherwise disclose your personal data to third parties outside the Otava Group, except in the following situations:

·       Otava shares your personal data with third parties providing services on behalf of and for Otava. These services may include, for example, customer service, software services, technical management and analysis of personal data, research activities, marketing and various campaigns.

·       Otava may share your personal data to collect payments for products and services and can, for example, transfer or sell unpaid invoices to third parties providing collection services.

·       Otava shares your personal data with partners with whom Otava manages and implements projects.

·       Otava shares your personal data with carefully considered third parties for common or independent direct marketing purposes. The data can be shared for those purposes only when the intended use of the third party does not conflict with the uses defined in this Privacy Statement of Otava.

·       Otava can share personal data of participants in Otava’s events with other participants and organisers of the event in question.

·       Otava may share your personal data in connection with a business transfer or other business arrangement or when a service is transferred to another service provider. Otava may share your personal data upon the order of a court or similar.

Protecting your personal data is important to Otava, and therefore, it does not allow the parties concerned to use the data for any purpose other than the provision of the services in question, and requires the parties to protect the user’s personal data in accordance with this Privacy Statement and applicable laws.

8 Do we transfer your personal data outside the EU

All Otava Group companies are Finnish and are companies based in Finland. As a rule, we process personal data within the EU area.

However, in some cases, Otava may use resources and servers around the world when offering and designing services. In such cases, Otava may transfer your personal data outside the country in which the services are used, and possibly also to countries outside the EU where the data protection legislation is different. In these cases, Otava ensures that there is a legal basis for the transfer of data in accordance with European data protection law and that the user’s personal data is protected, for example by transferring data on the basis of an equivalence decision, by using standard contractual clauses, and/or by requiring appropriate technical and other data protection measures.

9 How long do we process your personal data?

Otava shall process your personal data as long as Otava has one of the bases for processing data presented in section 3 of this Privacy Statement in force.

The identification information of customers and users of Otava’s online services will be stored for a maximum of six (6) years after the end of the customer relationship. Customer data is also stored to the extent required by the accounting legislation for six (6) years from the purchase.

The personal data of representatives of corporate and community customers (e.g. teacher, contact persons for companies) is processed for a maximum of six (6) years after the person’s role in the entity has changed and they no longer, for example, exercise their profession related to Otava’s business activities, or act as a representative of Otava’s community customer.

Necessary information for the accounting of royalty payments shall be retained for a maximum of 70 years from the death of the author or after the copyright has lapsed for any other reason.

We will delete information about attending events no later than two (2) years after the event, with the exception of contact information.

User of Otava’s digital learning material: please refer to the How long do we store your data? section in the digital learning material section for more details.

For more information about how we process information collected through cookies, see section 14.

In individual cases, we can also store data for a longer period if the processing of the data is necessary to establish, submit or defend against a legal claim. This may apply to complaints, among other things.

10 How can you exercise your rights to your personal data?

If you wish to exercise your rights, you can contact the party named in section 1 in this Privacy Statement. If necessary, we may request additional information from you, for example, if we cannot sufficiently identify you based on your request.

As a data subject, you have various possibilities to influence the processing of your personal data. As a rule, we will implement your request within one month. Your rights are:

a)     Right to access the personal data collected about you. Once we receive a request for verification from you from which you can be identified, we will provide you with a copy of the personal data that is being processed about you.

b)     Right to request the rectification of personal data collected about you. If you notice any errors or omissions in your data, you may submit a request for rectification.

c)     Right to request the deletion of personal data collected about you. We have the obligation to delete your data if one of the following criteria is met and no other legislation or official regulation imposes an obligation to store the data:

1.     The personal data is no longer needed for the purposes for which they were processed;

2.     You withdraw your consent and there is no other legal basis for the processing;

3.     You object to the processing in connection with your specific personal situation and there is no justified reason for the processing, or you object to the processing of your personal data for direct marketing purposes;

4.     Your personal data has been unlawfully processed;

5.     Your personal data must be deleted in order to comply with a legal obligation applicable to Otava under European Union or Finnish law; or

6.     Your personal data has been collected in connection with the provision of information society services, such as ordering Otava’s digital information services.

d)     Right to request that the processing of your personal data be restricted. You may request Otava to restrict the processing of your personal data. You may request the restriction of the processing of your personal data, and the processing will be restricted when:

1.     you deny the accuracy of your personal data stored by Otava and we confirm the accuracy of it;

2.     the processing is unlawful and you ask to restrict the use of the data instead of deleting it;

3.     Otava no longer needs such personal data for the processing purposes, but you need it to establish, present or defend a legal claim;

4.     you have objected to the processing of your personal data pending verification of whether Otava’s legitimate grounds override your grounds.

e)     Right to object to the processing of your personal data. If Otava processes your data based on a legitimate interest, you have the right to object to the processing of personal data about you on the basis of your specific personal situation. In addition, you always have the right to object to the processing of your personal data for direct marketing purposes.

f)      Right to transfer the data you have submitted from one system to another. If your personal data is processed automatically and the processing is based on consent or a contract, you have the right to receive the personal data you have submitted to Otava in a structured, commonly used and machine-readable format and, if technically possible, to transfer that data to another controller.

g)     Right to withdraw consent. If all or some of your personal data is processed on the basis of your consent here, you have the right to withdraw your consent.

h)     Right to lodge a complaint with a supervisory authority. If any disagreement regarding the processing of your personal data cannot be settled in an amicable manner between you and Otava, you have the right to submit the matter to a data protection authority for resolution. In Finland, the data protection authority is the Office of the Data Protection Ombudsman.

11 Are you obligated to provide your personal data to us?

In order for Otava to fulfil its contractual obligations related to a product or service you have purchased or ordered, Otava must receive and process your personal data. Without the necessary personal data, we cannot offer you the products and services that require the processing of your personal data.

12 Which country’s legislation applies to the processing of your personal data?

We are a Finnish Group operating in Finland. Finnish legislation and EU legislation directly applicable in Finland, such as the EU Data Protection Regulation and the Data Protection Act, apply to the processing of personal data by Otava.

13 How do we update this Privacy Statement?

We are constantly developing our business, which may cause changes to the processing of personal data. If necessary, we will update the Privacy Statement to reflect our changing practices. The changes can also be based on changes in legislation. We recommend that you review the content of the Privacy Statement regularly.

14 Cookies

The Otava website uses cookies. Cookies are small text files that your browser stores on a terminal device, such as a computer or mobile device, when you visit websites. In this cookie policy, cookies refer to all tags that are stored on the user’s terminal device. Our site uses essential cookies, functional cookies, analytical cookies and marketing cookies.

We use cookies to ensure that we offer as user-friendly and high-quality services as possible. In addition, we use cookies and other analytical tools to collect anonymous statistics on the use of the site to improve its content. The services store information about the page you visit, the duration of your stay on the site, the links you click, and the site you came from, among other things. Cookies can also be used to target our own advertising on third-party websites. These cookies allow us to target our advertisements to users who are most likely to be interested in Otava’s services.

In addition to the cookies set by Otava, the site may also contain third-party cookies, which are often set by the site’s partners. Third parties may use information collected through cookies for their own purposes. Our website uses our partners’ cookies, which may track the user outside Otava’s website and combine the information they collect from other websites about the user.

Necessary cookies are always turned on, as the site will not work properly without them. For all other cookies, such as functional, analytical and marketing cookies, we request the user’s active consent with the so-called cookie banner. The user can always withdraw or change their consent at any time from the settings below. The settings can also be accessed by clicking the link in the cookie banner. Cookies that are used for the handling purpose in question are not placed on the user’s terminal without consent. Depending on the cookie, this may prevent the user from seeing all of the content on our website and the website to operate in the most user-friendly way possible. Declining marketing and targeting cookies prevents targeted marketing from appearing.

In addition to the Otava website, you can manage cookies with most browsers. You can delete cookies stored on your device through your browser settings. You can read about the properties of different browsers on each service provider’s website. You can find more information about cookies and ways to protect privacy on the internet at www.youronlinechoices.eu.

You can give or withdraw your consent to cookies at the beginning of your visit to the website, or later through the Cookie policy link at the bottom of the Otava website.