BOWA Legal Oy and Solid Stream Oy Privacy Policy — Webinars

BOWA LEGAL OY AND SOLID STREAM OY PRIVACY POLICY — WEBINARS

This is a joint privacy notice from BOWA Legal Oy and Solid Stream Oy in accordance with the European Union’s General Data Protection(EU) 2016/679 and the Data Protection Act (1050/2018). This policy applies to personal data processed when you register for and participate in a BOWA Legal Oy webinar on the platform maintained by Solid Stream Oy.

BOWA Legal Oy acts as the data controller and determines the purposes and means of processing. Solid Stream Oy acts as the data processor and processes the data on behalf of BOWA Legal Oy and in accordance with its instructions. The processing between the parties is governed by a data processing agreement (Article 28 of the General Data Protection Regulation).

DATA CONTROLLER

BOWA Legal Oy (Business ID 3005519-2)

Energiakatu 4, 00180 Helsinki

https://www.bowa.fi 

Contact Person for Data Protection Matters and Requests from Data Subjects

Paula Bock — office[at]bowa.fi — 010 341 4400

DATA CONTROLLER AND SUB-PROCESSORS

Data Processor: Solid Stream Oy — webinar platform maintenance. For data protection matters related to the platform, please contact info[at]solidstream.fi. Requests regarding the rights of data subjects should be directed to the data controller (toimisto[at]bowa.fi).

Solid Stream Oy uses the following subprocessors for data processing:

• Supabase — Database Management (EU)
• Brevo — Sending Confirmation, Reminder, and Marketing Messages (EU)
• Vimeo Inc. — video streaming (United States)

NAME OF THE REGISTRY

BOWA Legal Oy's webinar and marketing registry.

PURPOSE OF THE PROCEEDINGS AND LEGAL BASIS

Personal data is processed for the following purposes and on the following legal grounds:

1. Conducting a webinar. Registration confirmation, reminder messages, and a personalized viewing link. Legal basis: performance of a contract and the data controller’s legitimate interest in providing the webinar you registered for (Article 6(1)(b) and (f) of the General Data Protection Regulation).
2. Analysis of participation and lead scoring. A score reflecting your engagement during the webinar is generated, which the data controller uses to assess the appeal of its webinars and prioritize outreach efforts. This constitutes profiling. Legal basis: the data controller’s legitimate interest (Article 6(1)(f) of the General Data Protection Regulation). You have the right to object to this processing (see the section “Legitimate Interest and Right to Object”).
3. Marketing Communications. Marketing communications from BOWA Legal Oy in all forms, such as newsletters, messages regarding services and events, and invitations to upcoming webinars, sent via email. Legal basis: consent (Article 6(1)(a) of the General Data Protection Regulation), which you provide separately by checking box B. Consent is voluntary, and you may withdraw it at any time.

CONSEQUENCES OF FAILURE TO OBTAIN INFORMATION

Registration information is required to sign up for the webinar, and participation in the webinar requires the processing of your participation information. The marketing consent checkbox (B) is optional, and whether or not you check it will not affect your registration or participation in the webinar.

PERSONAL DATA TO BE PROCESSED

The data controller processes the following categories of data:

• Registration information: name, email address, company, and job title, as provided on the form
• Registration source: the source channel of the registration link (UTM parameters)
• Participation data during the webinar: clicks on reaction buttons (with timestamps), viewing time, and chat messages
• Email engagement metrics: message opens and link clicks
• A score reflecting engagement, calculated based on participation data
• Consent information: the status of checkbox B, the timestamp, and the version number of the consent text displayed

DATA RETENTION PERIOD

Registration and participation data, as well as the score derived from them, are retained for 24 months following the webinar, after which they are deleted or anonymized.

If you check box B to give your marketing consent, your name and email address will be processed for BOWA Legal Oy’s marketing purposes for the duration of your consent. This processing is subject to the privacy policy for BOWA Legal Oy’s customer and marketing registry, and the data will be removed for marketing purposes once you withdraw your consent. If the data subject becomes a client of BOWA Legal Oy, the aforementioned privacy policy for the customer and marketing registry will also apply.

REGULAR SOURCES OF INFORMATION

Registration information is collected directly from the registrant via the registration form. Participation and event data are generated through the use of the webinar platform and the email system.

RECIPIENTS OF DATA AND TRANSFERS OUTSIDE THE EU OR THE EEA

The following processors process personal data on behalf of the data controller:

• Solid Stream Oy — Webinar Platform Maintenance
• Supabase — Database Management (EU)
• Brevo — Sending Confirmation, Reminder, and Marketing Messages (EU)
• Vimeo Inc. — video streaming (United States)

In the case of Vimeo Inc., personal data is transferred to the United States. The transfer is protected by Standard Contractual Clauses (SCCs) approved by the European Commission and by a level of protection based on the EU-U.S. Data Privacy Framework (Data Privacy Framework) (Articles 44–46 of the General Data Protection Regulation).

The information will not be disclosed for any other purposes. Information will be disclosed to authorities only when required by law.

PROFILING AND AUTOMATED DECISION-MAKING

A score reflecting your level of engagement during the webinar is calculated, which the data controller uses to prioritize whom to contact. This constitutes profiling as referred to in Article 4(4) of the General Data Protection Regulation, based on the data controller’s legitimate interest.

The data controller does not make decisions based solely on automated processing that would have legal effects on you or that would affect you in a similarly significant way (Article 22 of the General Data Protection Regulation). Any decision to contact you is always made by a person.

LEGITIMATE INTEREST AND RIGHT TO OBJECT

The analysis of participation and lead scoring are based on the data controller’s legitimate interest (Article 6(1)(f) of the General Data Protection Regulation). The data controller’s legitimate interest is to assess the appeal of its webinars and to target communications to those participants who have expressed interest. In a balancing test, the data controller has determined that the processing does not override the data subject’s interests, fundamental rights, or freedoms, taking into account the professional (B2B) context, its transparency, and the data subject’s right to object to the processing.

You have the right to object to this processing at any time on grounds relating to your particular personal situation (Article 21(1)). To the extent that the processing is carried out for direct marketing purposes, you have the unconditional right to object to the processing, after which your data will no longer be processed for this purpose (Article 21(2) and (3)). You may submit a request to object to this processing to toimisto[at]bowa.fi.

WITHDRAWAL OF CONSENT AND MANAGEMENT OF CONSENTS

You can revoke the marketing consent you provided by checking box B at any time just as easily as you gave it by sending an email to toimisto[at]bowa.fi or by clicking the unsubscribe link in any marketing message. Withdrawing your consent does not affect the lawfulness of processing carried out prior to the withdrawal (Article 7(3) of the General Data Protection Regulation).

For each registration, the consent status and timestamp for checkbox B, as well as the version of the consent text displayed, are recorded in order to demonstrate what the data subject has consented to (Article 7(1) of the General Data Protection Regulation).

REGISTRY SECURITY

Personal data is stored in the service’s databases, which are protected by technical and organizational measures, such as firewalls, passwords, and access controls. Access to the data is limited to those individuals at the data controller and data processor who need it to perform their duties. An agreement between the data controller and the data processor ensures that the processing complies with data protection laws.

RIGHTS OF THE DATA SUBJECT

You have the right to:

• to access your personal data
• request that your information be corrected or deleted
• request a restriction on processing
• to have the information you provided transferred from one system to another
• object to processing, including profiling
• withdraw the consent you have given at any time

You may submit a request using the contact information provided in this notice. You also have the right to file a complaint with the supervisory authority (in Finland, the Office of the Data Protection Ombudsman, tietosuoja.fi) if you believe that the processing of your personal data is not in compliance with the law.

COOKIES

The webinar platform and related services may use cookies and similar technologies to enable the operation of the service, the collection of statistics, and the tracking of email communications. More detailed information about the use of cookies and how to consent to them is provided on the registration site.

AMENDING THE PRIVACY POLICY

The data controller continuously improves its operations and may update this privacy policy as necessary. If the changes involve new purposes of processing or are otherwise significant, you will be notified in advance and, if necessary, asked for your consent.