Full version

Controller

Hubble Oy (business ID 2828213-4)
Eteläkauppatori 4 A, 5th floor, 28100 Pori, Finland
info@hubble.fi

Our CEO is responsible for data protection. We have not appointed a data protection officer. Please send questions and requests about data protection to info@hubble.fi.

Customer relationships and sales

• Who: contact persons of our customers, partners and prospective customers.
• Purpose: managing customer relationships, communication, offers and sales.
• Data: name, organisation, work email, phone number and business address, and records of our communication, such as meeting notes.
• Source: you or the organisation you represent. In the past we have purchased contact details from the Finder company directory. We do not currently purchase data.
• Legal basis: legitimate interest. Our interest is to manage customer relationships and to tell organisations that could benefit from our services about them.
• Retention: for the duration of the customer relationship and 2 years after it ends. If no customer relationship is formed, 2 years from our last contact.
• System: Pipedrive.

Newsletter and marketing messages

• Who: newsletter subscribers and contact persons of customers and prospective customers.
• Purpose: informing about our services, events and news.
• Data: name, work email and organisation, and whether messages were opened and links clicked.
• Legal basis: consent for subscribers. For others, legitimate interest: we send contact persons of organisations only messages related to their work, until they opt out.
• Opting out: every message contains a link to unsubscribe. Sending stops immediately. You can also opt out by emailing info@hubble.fi.
• Retention: we keep a record of your opt-out so that we do not send you messages again. Otherwise contact details are kept as described under Customer relationships and sales.
• Systems: Mailchimp and Pipedrive.

Meeting recordings

• Who: participants of our internal and customer meetings.
• Purpose: writing meeting notes and recording what was agreed.
• Data: audio recording, its transcript and notes, and participants’ names.
• How we do it: we tell participants about the recording in advance, and you can ask us not to record a meeting. The recording is transcribed and summarised into notes using AI.
• Legal basis: legitimate interest. Our interest is to record correctly what was agreed in the meeting.
• Retention: the recording is kept until the notes are written, for at most 12 months. Notes saved in Pipedrive are kept as described under Customer relationships and sales.
• Systems: Plaud (data in the EU) and Pipedrive.

Customer support

• Who: contact persons and users of our customers who submit support requests.
• Purpose: handling support and change requests.
• Data: name, email, phone number and organisation, and the content, attachments and handling history of the request.
• Legal basis: legitimate interest. Our interest is to provide the organisation you represent with the support agreed in our contract.
• Retention: for the duration of the customer relationship and 2 years after it ends.
• System: Freshdesk (palvelu.hubble.fi), data in the EU.

Job applicants

• Purpose: recruitment and assessing applicants’ suitability.
• Data: contact details, application, CV and certificates, interview notes and information from referees.
• Source: the applicant, typically by email or via LinkedIn. We contact referees only with the applicant’s consent.
• Legal basis: steps taken at the applicant’s request before entering into an employment contract, and legitimate interest.
• Retention: 2 years from the end of the recruitment process, so that we can respond to claims related to the recruitment.
• Systems: Microsoft 365 and LinkedIn.

Website visitors

• Websites: hubble.fi, joku.ai and silma.io.
• Purpose: operating the websites, visitor statistics and website development, targeting advertising and measuring its results, and identifying visiting organisations for sales.
• Data: IP address, browser and device information, pages visited and times, the referring page, and identifiers of cookies and similar technologies.
• Legal basis: necessary cookies on the basis of legitimate interest, because the website cannot work or store your consent without them. Analytics and marketing cookies and similar technologies only with your consent.
• Identifying organisations: Leadfeeder infers from the IP address which organisation’s network a visit comes from. We do not use it to identify individuals. If we have an open sales opportunity with the organisation, information about the visit is transferred to Pipedrive.
• Advertising: our websites may use the Meta pixel (Facebook and Instagram), LinkedIn Insight Tag and Google Ads conversion tracking. Meta and LinkedIn are joint controllers with us for collecting this data, and they also process it for their own purposes under their own privacy policies: Meta, LinkedIn.
• Retention: Google Analytics and Leadfeeder data for at most 14 months. Your consent is stored for at most 12 months. Cookie lifetimes are shown in the cookie list below.
• Systems: Google Analytics, Google Tag Manager, Google Ads, Leadfeeder, Meta, LinkedIn and Cookiebot.

Cookies

Cookies are small text files that a website stores in your browser. Below is a list of the cookies on our websites. You can change or withdraw your consent at any time using the links in the list or the cookie icon in the bottom corner of the page.

Who we share data with

We do not sell personal data. The following service providers process data on our behalf:

• Pipedrive OÜ, Estonia: customer relationship management
• The Rocket Science Group LLC (Mailchimp), United States: newsletters
• Google: website analytics, tag management and advertising
• Dealfront Group GmbH (Leadfeeder), Germany: identifying visiting organisations
• Usercentrics A/S (Cookiebot), Denmark: cookie consent
• Freshworks (Freshdesk): customer support, data in the EU
• Plaud: meeting recordings and notes, data in the EU
• Microsoft: email and files
• Louhos Digital: maintenance of the hubble.fi website

For advertising tracking, Meta and LinkedIn are joint controllers as described above. We also disclose data to authorities when required by law.

Transfers outside the EU and EEA

Mailchimp, Google, Meta and LinkedIn also process data in the United States. These transfers are based on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Subprocessors of service providers operating in the EU may also process data outside the EU. In that case, the transfers rely on the same safeguards.

How we protect data

Access is limited to those who need the data in their work. Multi-factor authentication is used in key services, and all our staff are bound by confidentiality. We are building our information security management system on the ISO/IEC 27001 standard.

Your rights

You have the right to:

• know what data we process about you and get a copy of it
• have inaccurate data corrected
• have your data erased
• restrict processing
• object to processing based on legitimate interest, and opt out of direct marketing at any time
• receive the data you have provided in a machine-readable format when processing is based on consent or a contract
• withdraw your consent at any time. Withdrawal does not affect the lawfulness of earlier processing.

Send your request to info@hubble.fi. We will respond within one month. We may ask for additional information to verify your identity.

If you believe we process your data unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi/en.

Automated decision-making and providing data

We do not make automated decisions about you that have legal effects. Advertising may be targeted based on cookies if you have given your consent.

Providing data is voluntary. Without contact details, however, we cannot, for example, respond to a support request or process a job application.

When we process data on behalf of our customers

In our application management service (Käyttöpalvelu) and in the Joku.ai and Silma.io services, we process our customers’ personal data on their behalf. This includes, for example, user accounts and documents and orders stored in the services. In these cases our customer is the controller, and the processing is described in the customer’s own privacy policy. To exercise your rights regarding this data, please contact the organisation through which you use the service. We assist our customers in handling such requests.

Employees

We inform our employees separately about the processing of their personal data.

Changes

We update this policy when our processing changes. This version was updated on 17 October 2026. The Finnish version is available at hubble.fi/tietosuoja.