Last updated: August 19, 2026

Kohtas Co. Finland Oy ("Kohtas", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share and otherwise process personal data in connection with our websites, digital services, business activities and communications that refer to this Privacy Policy (collectively, the "Services"). Kohtas generally acts as the data controller for the processing described in this Privacy Policy. Please see our Website Terms of Use for the terms and conditions governing the use of Kohtas' Website.

INFORMATION SECURITY

Kohtas attaches great importance to your right to privacy and takes the security of your personal information very seriously. We want you to feel secure that when you deal with Kohtas, your personal data are in good hands. The information is stored in a secure location and all connections accessing or modifying the information is secured with SSL connection. The information can be accessed only by authorized and authenticated users, who have the obligation of confidentiality. You are, however, aware and understand that you are fully liable for your own actions, including but not limited to the security measures related to your devices and connections. You are also responsible for any personal information you submit in using Kohtas' services. You are responsible for studying applicable third parties' privacy policies. We advise you to study such policies carefully.

COLLECTION AND SOURCES OF PERSONAL DATA

Depending on how you interact with Kohtas and which Services you use, we may process the following categories of personal data:

• Name
• Contact and business address
• Company name and other company information
• Job title and professional contact information
• Email address
• Phone number
• IP address, network information and other technical log information, such as device, browser, cookie, consent, session and date / time of access information
• Business ID, Tax ID, billing, invoicing or financial account information where applicable
• Date of birth or government-issued identification information where necessary for a service, transaction, identity verification or legal obligation
• Customer, partner, supplier, contract, order, subscription and service information
• Enquiries, meeting requests, communications, customer service information and business relationship records
• AI assistant questions, messages, conversation transcripts, generated responses and related technical conversation metadata
• Voice audio and transcripts where voice functionality is used, and consents and privacy preferences

We collect personal data directly from you when you use our Services, contact us, submit a request, request or book a meeting, become a customer, partner or supplier, interact with our personnel or AI assistant, or otherwise provide information to us. Technical and usage information may be collected automatically through cookies, similar browser technologies, analytics, consent-management technologies and server and security logs.

In addition, Kohtas may obtain additional information about you from third parties such as marketers, partners, researchers, and others. This includes demographic, professional and other information that is publicly available online, including information you choose to make public through social media platforms and other public online forums. We may combine information that we collect from you with information about you that we obtain from such third parties and information derived from any other subscription, product, or service we provide. We will always seek to confirm that the third party has provided transparent information about its use of this data, including its disclosure to third parties like Kohtas, in compliance with applicable law.

Non-essential cookies and similar technologies are used only with your consent where required by applicable law. You can change or withdraw your choices through the Manage Your Consent function available on the Website. We may also receive professional or business-related information from customers, business partners, service providers, publicly available company websites, professional directories and other public professional or business sources.

We use Google Analytics to measure Website traffic and understand how visitors find and use our Website. It may process page and Website interactions, device and browser information, approximate geographic information, referral, session, event, cookie and similar identifier information, where permitted. Non-essential Google Analytics technologies are used subject to consent where required by law; please see Google's privacy policy

We use Dealfront / Leadfeeder for Website visitor and business-to-business analytics. The service helps us understand how organisations reach and navigate our Website, which content generates business interest and Website usage patterns at an organisational level. It may use technical and network information and business information from Dealfront's sources. Where non-essential technologies are used, they are activated subject to consent where required by law; please see Dealfront's privacy notice

We use Pipedrive as our customer relationship management system. Pipedrive may process customer and prospect contact information, company information, enquiries, meeting requests, communications, sales and customer relationship information, notes and follow-up activities. Information submitted through Website functionality or our AI assistant may be transferred to Pipedrive when necessary to handle an enquiry, manage a business relationship or arrange requested follow-up; please see Pipedrive's privacy policy

Our Website includes an AI-powered conversational assistant that uses technology provided by ElevenLabs. When you interact with it, we may process text entered by you, AI-generated responses, conversation transcripts, technical conversation metadata, session identifiers, contact information voluntarily provided by you and information needed to process a meeting or contact request. Where voice functionality is used, this may also include voice audio and transcripts. The assistant is not intended to make solely automated decisions that produce legal or similarly significant effects on individuals; please see ElevenLabs' privacy policy

We use Cookiebot to provide cookie consent and preference management. We use Google Tag Manager as a technical tag-management tool for Website tags and integrations. We also use Microsoft Clarity to understand how visitors interact with our Website and to improve usability and performance. Clarity may process pages visited, clicks, scrolling, pointer movements, navigation, device and browser characteristics, session information and cookie or similar identifiers, and provides session recordings, heatmaps and aggregated interaction analytics. Non-essential technologies are activated subject to consent where required by law; please see Cookiebot's privacy policy

PROCESSING PERSONAL DATA

We process personal data to provide and operate our Services, respond to enquiries, provide customer support, arrange meetings and demonstrations, manage customer, partner and supplier relationships, process orders and subscriptions, negotiate and perform contracts, invoice customers, maintain Website security and prevent fraud. The legal basis is, depending on the circumstances, performance of a contract, steps taken at your request before a contract, compliance with a legal obligation or our legitimate interest in operating our business and managing professional relationships.

We may also use your information to fulfil your requests, evaluate and improve our Services, prevent fraud, enforce our Website Terms of Use, analyse Website performance and functioning, and maintain customer and business relationships. We may process business contact information to communicate about Kohtas and our Services where consent is required by law or, where permitted, on the basis of our legitimate interest in business-to-business marketing and professional relationship management.

We use analytics technologies to understand Website traffic, how visitors reach and use the Website, Website performance, usability issues and interest in our products and Services. Where analytics involves non-essential cookies, browser storage or similar technologies, we rely on consent where required by applicable law. Where permitted, aggregated or company-level business analytics may also be processed on the basis of our legitimate interest in developing our business and Services.

The legal justification for processing personal data is fulfilling the contract between the parties or the legitimate interest of the controller, which is based on the relationship between the parties. The legal justification may also be the data subject consent, if the applicable legislation so requires. If you have questions about this legal basis you can contact Kohtas' Data Protection Officer.

You are not required to provide the personal information that we have requested, but, not providing the requested personal information may in many cases mean that we will not be able to provide you with our products or services or respond to your queries.

TRANSFER OF PERSONAL DATA, INFORMATION AVAILABILITY

Personal data may be disclosed to purposes described in this Privacy Policy in accordance with applicable data protection legislation. No information is, however, given to any third party for direct marketing purposes without an explicit permission of the user, excluding legal reasons for giving the information for authorities.

Kohtas may also share information to safety, security, and legal compliance for the purposes such as to satisfy any applicable laws or regulations. Personal data may be shared or transferred, if Kohtas explores or undergoes a business transition, such as a merger, acquisition by another company, transfer of control, or sale of assets.

We use service providers where necessary to operate our Website and business. Our current providers and technology partners include ElevenLabs for the AI assistant, Microsoft Clarity for Website interaction analytics, Google Analytics for Website traffic analytics, Google Tag Manager for tag management, Dealfront / Leadfeeder for B2B Website visitor analytics, Pipedrive for customer relationship management and Cookiebot for cookie consent and preference management. Providers acting on our behalf process personal data subject to appropriate contractual and data protection safeguards.

Some service providers, their affiliates or subprocessors may process personal data outside Finland and the European Economic Area. Where an international transfer requires safeguards under applicable data protection law, we use an appropriate transfer mechanism, which may include an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission or another legally recognised transfer mechanism. Google, Microsoft Clarity, ElevenLabs and Pipedrive may involve international processing depending on their configuration and relevant subprocessors.

DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law. The applicable retention period depends on the nature of the information, the purpose of processing, the duration of the customer or business relationship, whether follow-up is reasonably expected, legal obligations, limitation periods for claims, security requirements and applicable service configuration.

Customer and contractual information is generally retained for the business relationship and afterwards as required for legal, accounting, record-keeping or claims purposes. Enquiries and business communications are retained for as long as necessary to handle the request and maintain the relevant relationship. AI assistant information is retained only for the interaction, follow-up, security and legitimate business record-keeping purposes; information transferred to Pipedrive after a contact or meeting request follows the retention period of that business record.

YOUR RIGHTS

You have the rights according to the personal data legislation applicable in Finland, including the EU General Data Protection Regulation (GDPR), to request access to the personal data that Kohtas has collected about you for the purposes of reviewing, modifying, or requesting deletion of the data. You may also have the right to request a copy of the personal data that Kohtas has collected about you and to have any inaccuracies in that data corrected. In certain circumstances, you may also request that we cease processing your personal data. Whether you make the request by electronic means and you have not requested it by any other means, the information shall be provided by electronic means.

You also have the right to receive confirmation from Kohtas as to whether or not personal data concerning you are being processed and the right to prohibit the processing of personal data for direct marketing purposes.. To help protect your privacy and security, we will take reasonable steps to verify your identity, such as requiring a password and user ID, before granting access to your personal data. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by applicable law. Different laws may prevent us from providing access to your personal data or otherwise fully complying with your request depending upon the circumstances and the request, such as for example, where producing your information may reveal the identity of someone else. We reserve the right to charge an appropriate fee for complying with your request where allowed by applicable law, and/or deny your requests where they may be manifestly unfounded, and/or excessive, or otherwise objectionable or unwarranted under applicable law.

If processing of personal data is based on consent, you have the right to withdraw your consent. The withdrawal of consent may, however, affect the usability and functionality of the service in question. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

In certain cases, the data subject has also the right to request from the controller restriction of processing of personal data or otherwise object to processing. Furthermore, you may require the transmission of the personal data, which you have provided to the controller in a machine-readable format based on the GDPR. All requests mentioned here shall be provided to contact person of Kohtas mentioned below. Whether you find the processing of your personal data unlawful, you have the right to lodge a complaint to the authorities responsible for personal data protection.

COOKIE POLICY

Our Website uses cookies and similar technologies. Some are necessary to provide the Website, maintain security, remember privacy preferences or provide functionality explicitly requested by you. Analytics and other non-essential technologies, including those relating to Google Analytics, Microsoft Clarity and Dealfront / Leadfeeder, are used subject to consent where required by applicable law. You can accept, reject or later change your optional technology preferences through the Manage Your Consent function. Withdrawing consent does not affect the lawfulness of processing before its withdrawal.

CHANGES TO THIS PRIVACY POLICY

Kohtas reserves the right to change our practices and this policy at any time. We encourage you to check this page regularly so that you know what our current practices are. This description of the personal data processing has been last updated August 19, 2026.

CONTACT US

If you have any questions about our Privacy Policy or if you would like to communicate with our Data Protection Officer, please contact us at:

Kohtas Co. Finland Oy
Legal Department
Erottajankatu 2
00120 Helsinki, Finland
dpo@kohtas.com