Privacy Policy

These are the privacy policy principles of Genero Oy Ab:

Genero’s customers and potential customers

Genero’s employees and job applicants

We value your privacy

Every person values privacy, also our customers and employees. However, it would not be possible to operate a digital marketing services business without collecting some amount of personal data. As a data controller, we collect and process personal data especially relating to our employees and our customers’ contacts and project team members. Same goes for potential customers and job applicants. Personal data is all data relating to and identified or identifiable person, such as name, email, social security id and a photo.

Genero processes personal data relating to its customers, potential customers, employees and job candidates in accordance with this privacy statement and applicable laws, so please read this carefully. We may also make changes to this statement due to changes in our operations or applicable laws.

As a company offering marketing services, we may also operate as a data processor for the corporations and other organizations we have as customers. The data processing principles regarding this is described in our customers’ privacy policies, so you may need to familiarize yourself with them as well. With each of these customers we also conclude an agreement with minimum data processing provisions, which also limits what we can do with our customers’ personal data.

Data controller

The data controller relating to processing of personal data pursuant to this privacy policy is Genero Oy Ab (hereinafter also “Genero”, “us” or “we”):

Genero Oy Ab

Business ID: 2387598-5
Risto Rytin tie 33
00570 Helsinki
FINLAND
www.genero.fi
Email: [email protected]

For what purposes does Genero collect personal data? What is the legal basis for processing personal data?

We collect, store and process personal data relating to customers and employees only for predefined purposes. We also always make sure that there is at least one legal basis for processing personal data. The main purposes and the applicable legal basis for processing personal data are:

Offering and providing marketing services. We collect and process personal data for concluding and executing the marketing services contracts we make with businesses and organizations. During the customer relationship, we process personal data especially for managing and executing projects, invoicing, debt collection, customer complaints and handling other customer feedback. The legal basis for this processing is especially a contract between Genero and the customer, but also our legitimate interest.

Marketing and customer communications. We may perform digital marketing, email marketing and communications, personalized marketing content and social media advertising targeted to potential and existing customers. For these purposes we need to collect and process personal data. Marketing may also be based on automated decisions and profiles created for social media campaigns, search engine marketing and website content. The legal basis for this processing is mainly our legitimate interest. A person has however a right to object direct marketing at any point. It is also possible that some direct marketing is based on consent (e.g. newsletters).

Handling enquiries. When you send a form on our website, your enquiry is saved in our own customer system. An AI model summarises it and assesses how well it matches our services, so that the right person can respond quickly. A person always decides how we respond, and no decision with legal or similarly significant effects is made automatically. The legal basis for this processing is our legitimate interest in answering enquiries and developing customer relationships.

Developing our business. We may also use personal data for developing our business relating to development of marketing services. The legal basis for this processing is our legitimate interest.

Fulfilling legal obligations. We may also use personal data for fulfilling legal obligations (e.g. bookkeeping, employment contracts act, tax laws).

Human resources management. Personal data relating to employees are mainly collected and used for human resources management purposes, payment of salaries, fulfilling other rights and obligations relating to employment contracts and meeting legal requirements relating to employment. The legal basis for this processing may be fulfilling a contract between Genero and the employee, consent as well as fulfilling legal obligations relating to employment.

Recruiting and job applicants. In recruitment situations we process personal data mainly for preparing and concluding an employment contract and based on the job applicants consent. Based on consent we may receive job applicant data also from other sources than from the person itself.

What personal data does Genero collect? From which sources?

We collect, store and use personal data mainly relating to our customer contacts (including potential customers), employees and job candidates.

Customers and potential customers

We collect personal data relating to customers and potential customers mainly from the person itself. Relating to potential customers we also collect prospecting data, mainly from LinkedIn and corporate websites. An important source of data is our website and its forms. With your consent, we also collect data about how our website is used with Google Analytics and the advertising tags of Meta and LinkedIn (see the section on cookies below). Data is also collected and generated during the customer relationship, but mainly concerning the companies and organisations. Data about potential customers may also be received through seminars organised with business partners.

Typically we collect and process the following personal data relating to customers:

  • First name
  • Last name
  • Email address
  • Title
  • Contact details
  • Work phone
  • Employer, its contact details and business ID
  • Contact person at Genero
  • Customer level and lifecycle phase
  • The “buyer persona” related to the person
  • Language
  • Legal basis for processing personal data (contract, consent, legitimate interest)
  • Genero tasks (call / email / references / meeting)
  • Notes (call / meeting / other Genero tasks)
  • Call details (when and about what)
  • Meeting details (when and about what)
  • Sales history
  • Email correspondence
  • Website form submissions: the answers, the page the form was sent from and the time it was sent
  • Campaign parameters (UTM), ad click identifiers and the referring website, saved with form submissions to attribute leads to marketing channels. With your marketing cookie consent, the gg_attribution cookie remembers them across visits for 90 days.
  • Data about how you use our website, collected with your cookie consent
  • Our assessment of an enquiry (summary, fit with our services and priority)
  • Marketing opt-in’s / opt-out’s

Similar, but more limited data may also be received from prospecting potential customers through LinkedIn or corporate websites.

Employees

Personal data relating to employees is received primarily from the employee and with her consent also from other sources. We may also process data that is generated during the employment relationship.

Typically we collect and process the following personal data relating to employees:

  • Name
  • Data required for withholding taxes
  • Social security ID
  • Salary data
  • Work time tracking
  • Contact details
  • Data relating to sick leaves
  • Employment contract

Job applicants

Personal data relating to job applicants is received primarily from the applicant and with her consent also from other sources.  (such as LinkedIn, references and possible suitability tests).

Typically we collect and process the following personal data relating to job applicants:

  • Name and basic contact details
  • Education, experience, skills and work history
  • Application and cv
  • References (with consent)
  • LinkedIn profile (with consent)
  • Possible suitability test results (with consent)

Who processes personal data at Genero and is it transferred to anyone?

People within our organization have access to the personal data for the purposes of performing their work tasks. Access to HR data is more limited than customer data, as most of our staff perform customer work but only limited group of people have HR responsibilities.

We may also subcontract some personal data processing, and many of the systems we use to store and process personal data are cloud services. Most of the data we store is in electronic form only. Our main service providers are Google (Google Cloud and the Gemini AI model for our customer system, Google Workspace and Google Chat for internal communication, Google Analytics and Google Tag Manager for website analytics), Postmark (sending email), Kinsta (website hosting), Cookiebot by Usercentrics (cookie consent) and Visma Severa (sales cases and project management), as well as our accounting and payroll service providers.

In these situations, we make sure we have a written contract with the services provider with minimum data processing provisions and also otherwise that the confidentiality of personal data is secured and data is processed and transferred lawfully.

We may also provide personal data to a third party for fulfilling contractual obligations or due to a legal obligation or requirement by an authority. We may also provide personal data to a third party if we are involved in a business sale or restructuring.

Does Genero transfer personal data outside the EU?

Personal data is primarily processed inside the EU: our customer system stores its data in Google Cloud in Finland. Some of the service providers we use may however process personal data outside the EU, such as Google, Meta and Postmark in the United States. If personal data is transferred outside the EU, we make sure that the transfer is protected as the law requires: (1) the recipient is located in a country that the European Commission has found to provide an adequate level of data protection, (2) the recipient is certified under the EU–US Data Privacy Framework, or (3) the transfer uses the standard contractual clauses approved by the European Commission.

How long is personal data stored?

We will not store personal data for a longer period than is necessary for its purpose or required by contract or law. The retention periods for personal data may vary based on its purpose, legal basis for processing data and the situation. The retention periods may also be based on laws (e.g. accounting, tax laws, employment contracts act). If consent was the only basis for processing personal data, the data may be deleted after a person withdraws her consent. We may also delete the data based on a person’s request, if we do not have a legal basis for processing personal data that would override the request. We may also update data from time to time and delete outdated and incorrect data.

How does Genero store and secure the data?

Personal data is stored primarily in electronic form and it is secured in accordance with general industry standards and practices. We consider and keep personal data confidential. We use only such services providers for data storage and processing that have a good reputation in terms of data security. Access to personal data is also protected with user-specific logins, passwords and user rights. We do not sell or rent personal data for marketing purposes. Our premises are also safe and secure.

Is it mandatory to provide personal data to Genero? What happens if you don’t provide it?

In many situations it not mandatory to provide us personal data. This concerns especially personal data relating to potential customers and job applicants. However, we need some amount of personal data especially in customer relationships to conclude and fulfill contracts. Potential customers provide us usually their basic contact details (email address) and other data, that we need for responding to a contact request. Relating to employment we also need to process at least the minimum personal data required to fulfill employment contracts and legal obligations relating to employment.

Does our website use cookies and what are they?

Cookies are small text files that a website stores on your device. We use them to make our website work, to understand how it is used, and to target and measure our marketing. When you first visit our website, we ask for your consent in a cookie banner (Cookiebot). Necessary cookies are always on. Preference, statistics and marketing cookies, such as Google Analytics and the advertising tags of Meta and LinkedIn, are only loaded after you have consented to them. You can change or withdraw your consent at any time in the cookie settings.

What rights do you have regarding personal data relating to you?

Withdraw your consent

If we process personal data based on your consent, you can at anytime withdraw your consent by notifying us, for instance by contacting us using the contact details provided above.

Access to data

You have the right to be confirmed if we are processing your personal data and also to know what data we have about you. In addition, you have right to some supplemental information described in the law about the processing activities.

Right to have errors corrected

You have the right to request that we correct any inaccurate or outdated personal data we have about you.

Right to erasure

You have the right to request that we erase your personal data, for example when we no longer need it for the purpose it was collected for, or when you withdraw your consent. We may keep data that the law requires us to keep, such as accounting records.

Right to prohibit direct marketing

You have the right to request that your personal data is not processed for direct marketing purposes by contacting us using the contact details provided above.

Right to object processing

If we process your personal data based on public interest or our legitimate interest, you have the right to object processing of your data, to the extent that there is no such significant other reason that would override your rights or the processing is not necessary for handling legal claims. Please notice that in this situation we may not be able to serve you anymore.

Right to restrict processing

In certain situations you have the right to require that we restrict processing of your personal data.

Right to data portability

If we process your personal data based on your consent or fulfilling of a contract, you have the right to require transfer of the data you have provided us to another services provider in a commonly used electronic format.

How can you use your rights?

You can execute and use your rights by contacting us, for instance by using the contact details provided above. Remember also that we need to verify your identity. If you consider that the processing of your personal data is not lawful, you can always also make a notification to the supervising authority (the Office of the Data Protection Ombudsman, tietosuoja.fi).

Can this privacy statement be updated?

We may make updates to this privacy policy when our operations change or develop. Also changes in law may make it necessary to update this privacy policy. The changes become valid once we have published them in the form of an updated privacy policy. Therefore, please visit this page and read this privacy policy from time to time.

This privacy policy was last updated on 10.11.2026.

Who can you contact in regard to privacy matters?

Genero Oy Ab

Business ID: 2387598-5
Risto Rytin tie 33
00570 Helsinki
www.genero.fi
Email: [email protected]