1. This notice in brief
1.1 What this notice covers
Rahoo Oy ("Rahoo", "we") processes personal data on its website, in enquiries and in its partner cooperation. This notice explains what data we process, for what purposes and on what legal basis, to whom we disclose data, and what rights you have. It is an information document under Articles 13 and 14 GDPR.
This notice applies when you:
- visit Rahoo’s website;
- contact us via a form, by email or by telephone;
- book a demonstration or a meeting;
- subscribe to our newsletter or other marketing communications;
- register as a Rahoo distribution partner; or
- act as a contact person for a partner or a financing partner.
1.2 What this notice does not cover
Applying for financing. If you apply for financing for your company through Rahoo, that processing is described in a separate document, "Privacy Notice — how we process personal data in the financing application service". It covers all application channels: Rahoo’s own application form, a Rahoo form embedded in a partner’s service, a partner-specific landing page (for example partner.rahoo.fi), and an application collected with the partner’s own solution.
Processing by others. Partners and financing partners each have their own privacy notices for their own processing. This notice describes only Rahoo’s processing.
1.3 Rahoo’s role in brief
Rahoo brokers business financing. Rahoo is not a credit institution or a financial institution, does not grant credit for its own account, does not make credit decisions and is not a party to the financing agreement. This delimitation matters in this notice too, because it determines what data we need and to whom we disclose it.
1.4 Using the website is not consent
Using the website or reading this notice does not in itself constitute consent to the processing of personal data within the meaning of the GDPR. We process personal data on the legal bases described in section 4. Where processing is based on consent — in practice non-essential cookies and part of our marketing communications — we ask for consent separately, and you may withdraw it at any time.
2. Controller and contact details
Data protection enquiries and data subject requests: asiakaspalvelu@rahoo.fi.
Rahoo has not appointed a data protection officer under Article 37 GDPR. An appointment is not mandatory, because Rahoo’s core activities do not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of personal data.
3. Whose personal data we process
| Category of person | Who this includes |
|---|---|
| Website visitors | Everyone who visits Rahoo’s website, whether or not they contact us |
| People who contact us | Anyone who completes a contact or booking form or contacts us by email, telephone or another channel |
| Recipients of marketing communications | Newsletter subscribers and other recipients of marketing communications |
| Partner registrants | The contact person acting on behalf of a company registering as a distribution partner, and a sole trader registering in their own name |
| Contact persons of partners and financing partners | Commercial, technical and billing contacts during the contractual relationship |
Sole traders. If a partner or an enquirer is a sole trader, information about the business is at the same time personal data, because the business and the individual are legally the same person. In other company forms, company information is not personal data, but information about the contact person is.
4. What we process, for what purpose and on what basis
Every processing operation has a legal basis under Article 6 GDPR. The bases are not alternatives to one another: the same data may rest on a different basis for a different purpose. We collect personal data only to the extent necessary (data minimisation, Article 5(1)(c)).
4.1 Website visitors
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, approximate location, device, operating system and browser | Operation and security of the website, detection of malfunctions and misuse | Legitimate interest (Art. 6(1)(f)): ensuring the functioning and security of the website |
| Essential cookies | Core website functions and remembering your cookie choice | Legitimate interest (Art. 6(1)(f)). Essential cookies do not require consent (section 205 of the Act on Electronic Communications Services) |
| Analytics and marketing cookies and the browsing data collected with them | Analysing and developing use of the website, targeting and measuring marketing | Consent (Art. 6(1)(a) and section 205 of the Act on Electronic Communications Services). See section 13 |
4.2 Enquiries, bookings and customer service
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, telephone number, company and role, and the content of your message | Responding to the enquiry and handling the matter | Legitimate interest (Art. 6(1)(f)): responding to an enquiry. If you are yourself a contracting party or we are negotiating an agreement with you: contract or pre-contractual steps (Art. 6(1)(b)) |
| Booking details: the time selected, subject of the meeting and participants | Booking and arranging a demonstration or meeting | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Communication history and notes from sales discussions | Continuing the discussion, making proposals and managing the customer relationship | Legitimate interest (Art. 6(1)(f)): acquiring and serving business customers |
| Calls and emails | Clarifying the matter and evidencing it afterwards | Legitimate interest (Art. 6(1)(f)). We do not record calls |
4.3 Newsletter and marketing communications
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, company and role | Sending the newsletter and other marketing communications | See the explanation below |
| Message opens and clicks | Targeting communications and measuring their effectiveness | Consent (Art. 6(1)(a)) where measurement relies on an identifier stored on your terminal device (section 205 of the Act on Electronic Communications Services); otherwise legitimate interest (Art. 6(1)(f)) |
| Marketing opt-outs and withdrawals | Giving effect to the opt-out and demonstrating it | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
When we ask for consent. The conditions for electronic direct marketing are set out in the Finnish Act on Electronic Communications Services (917/2014):
- Direct marketing may be addressed to a legal person unless it has expressly refused it (section 202). This covers, for example, a company’s general addresses.
- Electronic direct marketing addressed to a natural person requires prior consent as a rule (section 200). Marketing addressed to a named individual may nevertheless be carried out without prior consent where that person holds a position in an organisation to which the marketed service is materially related.
- Where that condition is not met, we send marketing messages only with your consent (Art. 6(1)(a)).
In every case you can opt out of marketing easily and free of charge using the link in each message or by writing to asiakaspalvelu@rahoo.fi. Opting out does not affect any other dealings with us. Objection to direct marketing is absolute: we always stop, without asking for reasons (Art. 21(3)).
Messages about handling your matter are not direct marketing. Messages concerning the handling of a registration, an agreement, the operation of the service or information security are sent to you even if you have opted out of marketing.
4.4 Partner registrants
Registration as a distribution partner is done through a multi-step form. Registration is free of charge and does not bind either party; its purpose is to give us the information we need in order to assess the basis for cooperation and to contact you.
| Data | Purpose | Legal basis |
|---|---|---|
| Contact person’s name, email address and telephone number | Handling the registration and contacting you | Pre-contractual steps (Art. 6(1)(b)) where the registrant is itself the prospective contracting party. Otherwise legitimate interest (Art. 6(1)(f)): processing the contact details of a company representative in contract negotiations |
| Company name, business ID or equivalent company identifier, website and country | Identifying the company and verifying that it exists and is operational | Pre-contractual steps (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)). For a sole trader, this is personal data |
| Choices made during registration: financing products, choice of financing partners, distribution method and any domain name | Preliminary mapping of the content of the cooperation and preparation of a proposal | Pre-contractual steps (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Evidence of acceptance of the terms: timestamp, version of the terms accepted and technical identifier | Demonstrating that the terms of use were accepted and the privacy notice made available | Legitimate interest (Art. 6(1)(f)): establishment and defence of legal claims, and accountability (Art. 5(2)) |
| Confirmation of authority to represent | Establishing who we are dealing with | Legitimate interest (Art. 6(1)(f)) |
We do not obtain personal credit data on the registering contact person. We do not make a credit enquiry about you as a private individual. If we check the background of the registering company in public registers or a credit information service, we say so in section 5.
4.5 Contact persons of partners and financing partners
| Data | Purpose | Legal basis |
|---|---|---|
| Name, role, work email address and telephone number | Managing the contractual relationship, technical cooperation and communication | Legitimate interest (Art. 6(1)(f)): processing the contact details of a contracting party’s representatives in order to perform the agreement |
| Communications and correspondence concerning the agreement | Performing the agreement and evidencing performance | Legitimate interest (Art. 6(1)(f)) |
| Billing and payment data to the extent it constitutes personal data | Invoicing and paying fees, and accounting | Legal obligation (Art. 6(1)(c)), Finnish Accounting Act (1336/1997) |
5. Where the data comes from
- From you, when you complete a form, contact us or otherwise deal with us.
- From the website’s technical logs and cookies, when you visit the website.
- From the company you represent or from a colleague, when you are named as a contact person.
- From public authority registers: the Finnish Business Information System (YTJ) and the Finnish Patent and Registration Office. We check the company’s official details there, such as name, business ID, industry and persons in responsible positions. For a sole trader, this is personal data.
6. Processing based on legitimate interests
A large part of the processing described in this notice is based on legitimate interests (Article 6(1)(f) GDPR). This is business-to-business dealing, in which we process personal data mainly because the individual acts as a representative of a company. We have assessed the balance between our interests and your rights and have taken into account that:
- the processing is to be expected in the context in which the data was provided;
- the data consists of professional contact details rather than information about private life;
- we do not process special categories of personal data; and
- you always have the right to object to the processing (Art. 21).
You may request the outcome of the balancing test from asiakaspalvelu@rahoo.fi.
7. Special categories of data and automated decision-making
In the processing described in this notice we do not collect or request special categories of personal data under Article 9 GDPR or criminal offence data under Article 10. If you submit such data on your own initiative, for example as an attachment to a message, we delete it as soon as reasonably practicable.
The processing described in this notice does not involve decisions based solely on automated processing within the meaning of Article 22 GDPR. Partner registrations are reviewed by a human being. The routing of financing applications and the rights relating to it are described in the privacy notice for the financing application service.
8. To whom we disclose data
We use external service providers who process personal data on our behalf as processors. A data processing agreement under Article 28 GDPR has been concluded with each of them, and they may process the data only on our instructions.
| Recipient | Used for | Location and notes |
|---|---|---|
| Framer B.V. | Technical implementation and hosting of the website | Netherlands, EU. Framer’s hosting environment runs on Amazon Web Services |
| Vercel Inc. | Hosting of the partner registration form and its backend service | United States, see section 9 |
| Amazon Web Services | Hosting environment for Rahoo’s own system. A partner contact person’s data is held here only once a partner agreement has been concluded and the partner has been onboarded into Rahoo’s system | Stockholm, EU |
| Google Ireland Limited and Google LLC | Email, calendar and files (Google Workspace) and booking of demonstrations and meetings | EU and United States, see section 9 |
| Attio | Customer relationship management: enquiries, sales discussions and partner information | United Kingdom. Data is stored in a Google Cloud environment in Ireland, within the EU |
| Astrodon Corporation (Loops) | Sending marketing communications and managing subscriptions | United States, see section 9 |
| Slack (Salesforce group) | Internal notification of new partner registrations | United States, unless EU data residency has been enabled. See section 9 |
| Twilio SendGrid | Sending service-related emails | United States, see section 9 |
| Telavox | Telephone and communication service | Sweden |
| Accounting, audit and legal advisers | Meeting statutory obligations and handling legal claims | Finland |
| Authorities and courts | Only what the law or an official decision requires | Finland and the EU |
We do not sell personal data. Nor do we disclose the data described in this notice to financing partners. Disclosures of financing applications are described in the privacy notice for the financing application service.
9. Transfers outside the EU and the EEA
Data is stored primarily within the EU. Some of the services we use are, however, provided by United States companies, in which case personal data may be transferred outside the EU and the EEA.
| Recipient | What is transferred | Transfer basis |
|---|---|---|
| Vercel Inc. | Contact and company details provided during partner registration and the form’s technical log data | EU–US Data Privacy Framework adequacy decision (EU) 2023/1795 |
| Google LLC (Google Workspace and booking) | Email, calendar and files and booking details that may contain contact information | EU–US Data Privacy Framework adequacy decision (EU) 2023/1795 |
| Google Ireland Limited and Google LLC (analytics) | Browsing data, IP address and browser information | EU–US Data Privacy Framework adequacy decision (EU) 2023/1795. The transfer takes place only if you have accepted analytics cookies |
| Attio | Contact details, notes and communication history stored in the CRM | United Kingdom: Commission adequacy decision (Art. 45), renewed on 19 December 2025 and valid until 27 December 2031. Data is stored in Ireland, within the EU. If Attio’s AI-assisted features are used, data may also be transferred to Attio’s sub-processors in the United States under standard contractual clauses (Art. 46(2)(c)) |
| Astrodon Corporation (Loops) | Newsletter recipient details and message open and click data | Standard contractual clauses (Art. 46(2)(c)) and a transfer impact assessment |
| Slack (Salesforce group) | Contact details contained in the notification | EU–US Data Privacy Framework adequacy decision (EU) 2023/1795 and standard contractual clauses (Art. 46(2)(c)) |
| Twilio SendGrid | Email recipient details and message content | Standard contractual clauses (Art. 46(2)(c)) and a transfer impact assessment |
| Framer B.V. | Website log data | No routine transfer: the contracting party is established in the EU. Standard contractual clauses are used for transfers by Framer’s subprocessors |
| Amazon Web Services | No routine transfer: the hosting environment is in Stockholm | No transfer. Support access from outside the EU is restricted in the data processing agreement |
We rely on the following safeguards: an adequacy decision (Art. 45) where the recipient is certified under the EU–US Data Privacy Framework; standard contractual clauses (Art. 46(2)(c)) where an adequacy decision cannot be relied on; and supplementary measures such as encryption in transit and at rest and access control. You may request a copy of the safeguards used from asiakaspalvelu@rahoo.fi.
10. How long we retain data
We retain personal data only for as long as it is necessary for the purpose for which it was collected, or for as long as the law requires.
| Data | Maximum retention period | Basis |
|---|---|---|
| Website logs and IP address | 30 days | Information security and prevention of misuse (legitimate interest) |
| An enquiry that does not lead to further discussion | 12 months from the last contact | Handling the enquiry and any follow-up questions. Data minimisation (Art. 5(1)(e)) |
| A sales discussion or booking that does not lead to an agreement | 24 months from the last contact | Legitimate interest: the ordinary length of a business sales cycle. If you do not want us to retain the data, we delete it on request |
| A partner registration that does not lead to an agreement | 12 months from registration | Handling the registration and contacting you. Data minimisation |
| A partner registration that leads to an agreement, and communications during the contractual relationship | For the term of the agreement and 3 years after it ends. In exceptional cases up to 10 years | Finnish Act on the Limitations Period for Debts (728/2003), sections 4 and 7: establishment, exercise and defence of legal claims |
| Evidence of acceptance of the terms | As long as the registration or agreement to which the acceptance relates | Accountability (Art. 5(2)) and legal claims |
| Newsletter subscription and marketing consent | For the term of the subscription and 2 years after it ends or consent is withdrawn | Accountability (Art. 5(2)) |
| Marketing opt-out | Until further notice | An opt-out cannot be given effect unless it is retained. We retain only the data needed to give effect to it |
| Accounting vouchers and correspondence concerning business transactions | 6 years from the end of the year in which the financial period ended | Finnish Accounting Act (1336/1997), Chapter 2, section 10(2) |
| Financial statements and accounting records | 10 years from the end of the financial period | Finnish Accounting Act, Chapter 2, section 10(1) |
| Cookies and the data collected with them | Cookie-specific, at most 13 months | Consent. Cookie-specific periods are listed in the cookie notice |
Deletion means deletion. When a retention period ends, the data is either deleted or irreversibly rendered unidentifiable. Flagging a record as deleted is not deletion.
Backups. When data is deleted from a live system, it may remain in backups until the backup is replaced according to the established schedule. We do not use data in a backup for any other purpose, and if a backup is restored, the deletions are repeated.
11. Information security
We protect personal data with the technical and organisational measures required by Article 32 GDPR:
- encrypted data traffic and encryption of data at rest;
- hosting environment within the EU;
- role-based access control and the principle of least privilege;
- logging and monitoring of anomalies;
- confidentiality undertakings by personnel; and
- assessment of subcontractors and data processing agreements under Article 28.
If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay (Art. 34). We notify the supervisory authority of a breach within 72 hours (Art. 33).
12. Your rights
| Right | What it means |
|---|---|
| Access (Art. 15) | You may ask whether we process your data and obtain a copy of it |
| Rectification (Art. 16) | You may ask us to correct or complete inaccurate or incomplete data |
| Erasure (Art. 17) | You may ask us to erase your data if there is no longer a basis for the processing. The right does not extend to data we are required by law to retain |
| Restriction of processing (Art. 18) | You may ask us to restrict processing, for example while you contest the accuracy of the data |
| Data portability (Art. 20) | You may receive the data you have provided in a structured, commonly used and machine-readable format. The right covers automated processing based on consent or a contract |
| Objection (Art. 21) | You may object to processing based on legitimate interests on grounds relating to your particular situation. Objection to direct marketing is absolute: we always stop, without asking for reasons |
| Withdrawal of consent (Art. 7(3)) | You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it |
| Lodging a complaint with the supervisory authority (Art. 77) | See below |
12.1 How to exercise your rights
Send your request to asiakaspalvelu@rahoo.fi. We may ask you to verify your identity if we cannot otherwise reliably identify you. We respond within one month at the latest; in complex cases we may extend that period by up to two further months and will inform you within one month (Art. 12(3)). Handling requests is free of charge unless a request is manifestly unfounded or excessive.
12.2 Complaint to the Data Protection Ombudsman
If you consider that we process your personal data unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman. We hope you will contact us first.
The storing of cookies and similar technologies on terminal devices is supervised by the Finnish Transport and Communications Agency Traficom.
13. Cookies and web tracking
A cookie is a small file stored on your terminal device when you use the website. The use of cookies is governed by section 205 of the Finnish Act on Electronic Communications Services (917/2014).
Consent. Storing and using cookies other than essential ones requires your consent. Consent is requested through a cookie banner in which you can accept or reject cookie categories separately. Non-essential cookies are not set before you have given your consent. You can change your choice at any time in the cookie settings, and rejecting is as easy as accepting.
Cookie-by-cookie list. The cookies used on the website, who sets them, their purposes and their lifetimes are listed in a separate cookie notice available on the website and from the cookie settings. The list is updated whenever the cookies in use change.
14. Changes to this notice
We develop our service continuously, so we may update this notice. The current version is always available on our website. We will inform you of material changes by email or on the website before the change takes effect.
| Version | Date | Main changes |
|---|---|---|
| 1.1 | 18 September 2026 | The customer relationship management system changed. The recipient, location and transfer basis in sections 8 and 9 updated to correspond to the service in use |
| 1.0 | 26 August 2026 | First version. Separated into its own document from the privacy notice for the financing application service. Covers website visitors, enquiries and bookings, marketing communications, partner registration, and the contact persons of partners and financing partners. Replaces the privacy-related part of the previous English "Terms and conditions" page |
15. Contact
Questions about this notice, data protection and data subject rights: asiakaspalvelu@rahoo.fi.