Privacy notice
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Data Protection Act (1050/2018). This notice explains what data we process, why, for how long and what rights you have.
This is a translation of our Finnish privacy notice. If the versions differ, the Finnish version prevails.
Controller and contact details
The controller of personal data is Wellpack Oy. We handle data protection questions and requests at tietosuoja@wellpack.fi.
Wellpack Oy
- Vanha Talvitie 13-15, 00580 Helsinki, Finland
- Business ID 2545188-7
- Phone +358 40 626 8033
- Data protection: tietosuoja@wellpack.fi
Website visitors
When you use our website, our servers and service providers process the technical data needed to deliver the pages. We also collect visitor statistics, but only if you accept statistics cookies. We do not use marketing cookies.
What data
- IP address, browser details, the page requested and the time, in server logs.
- Videos are delivered from our video service (Mux) and job ad images from our recruitment system (Teamtailor), so your browser sends a request to their servers.
- Spam protection on forms (Cloudflare Turnstile) assesses browser data to tell a person from an automated submission.
Purpose, legal basis and retention
- Purpose: delivering the website, investigating errors and security.
- Legal basis: legitimate interest (GDPR Article 6(1)(f)).
- Retention: briefly, in line with the service providers' log practices.
Company enquiries and price requests
When a representative of your company contacts us through a website form, requests a price estimate, completes the fitness test or describes a staffing need to the AI assistant, we process the data provided to respond and to manage the customer relationship.
What data
- Name, email, phone number, company and message.
- Details of the need, such as roles, qualifications, headcount and schedule, and the fitness test answers.
- When the form is sent, the page address and title, campaign tags (UTM), the previous page and the time sent.
Legal basis and recipients
- Legal basis: legitimate interest in business-to-business communication (GDPR 6(1)(f)).
- Messages are forwarded to our internal messaging service (Slack), where our sales team handles them.
Retention
- In the messaging service: 24 months.
- Once we introduce a customer relationship management system (see Service providers): 5 years from the last relevant business interaction, after which the data is deleted or anonymised.
Job applicants and recruitment
Applications are made in our recruitment system at rekry.wellpack.fi (Teamtailor). Our website does not itself receive applications or CVs.
When you ask about a job using a website form or contact us as a job seeker, your message is forwarded to our internal messaging service (Slack), where our recruiters answer it.
What data
- Application: contact details, CV, work experience, education, qualifications and application processing details.
- Questions and enquiries: name (optional), email, phone number, message and the job the question concerns.
Principles
- We collect data primarily from you.
- We contact referees or other sources only with your consent.
- We do not search for information about you online or on social media without your consent.
- We use aptitude and other tests only with your consent, and you receive the results free of charge.
- We check credit information only for the selected applicant and only for roles where the law allows it.
- We do not make recruitment decisions solely by automated means.
Legal basis and recipients
- Legal basis: steps taken at your request before entering into a contract, and the contract (GDPR 6(1)(b)), and legal obligations (6(1)(c)). Talent pool, referees and tests: consent (6(1)(a)).
- When you apply for a role with one of our client companies, we may disclose your application data to that company to carry out the recruitment.
Retention
- Applications: 2 years from the end of the recruitment.
- Talent pool: for as long as your consent is valid.
- Questions and enquiries in the messaging service: 12 months.
Temporary agency workers and our own staff
We are the employer of our temporary agency workers. We process the data needed to manage the employment relationship.
What data
- Employment contract, pay, working time and tax details.
- Qualifications, cards and occupational safety details.
- Statutory reports to authorities and insurers.
Legal basis, recipients and retention
- Legal basis: the employment contract (GDPR 6(1)(b)) and legal obligations (6(1)(c)).
- Recipients: the user company to the extent needed to organise the work, and authorities as required by law, such as the Finnish Tax Administration, the earnings-related pension insurer and the Finnish Immigration Service.
- Retention: in line with statutory retention periods.
AI assistant and our use of AI
Our website may offer an AI assistant that you can ask about a job ad or your company's staffing needs, for example. The assistant tells you it is an AI. The messages you write and the page context of the conversation are processed in a language model service (Anthropic) to produce the answers.
We also use AI for text suggestions in recruitment ads. A person reviews every text before it is published.
What is stored
- Questions and answers in shortened form, with email addresses, phone numbers and personal identity codes masked before storage.
- A random conversation ID that is not linked to you. IP addresses are not stored.
- Your browser keeps the conversation for 24 hours so that you can continue it.
Legal basis and retention
- Legal basis: legitimate interest in the service working and being developed (GDPR 6(1)(f)).
- Retention: 90 days.
- Please do not write your personal identity code or other sensitive information in the conversation. If you leave a contact request in the conversation, it is handled like one left on a form.
Recruitment advertising
We advertise open jobs on Meta's services (Facebook and Instagram) in the special ad category for employment. We target the ads by location and by interest groups offered by Meta. Meta processes its users' data as a controller in its own right, and we only receive aggregated results from the ads.
We use images of people appearing in ads with their consent or on the basis of an agreement.
Images, videos and people in our content
Customer stories, employee stories, job ads, the blog and contact details may include people's names, quotes, images and videos.
Legal basis and retention
- Legal basis: the person's consent or an agreement. Contact details and author details of our own staff: legitimate interest.
- Publication ends when the purpose of the use ends. We keep material in our internal archive for up to 24 months, unless an agreement or consent supports longer use.
- You can withdraw your consent, and we will then remove the material from publication.
Service providers and transfers outside the EU
We use the service providers listed below, which process data on our behalf. We enter into data processing agreements with our service providers.
Some of the service providers are based in the United States, so data may be transferred outside the EU. Transfers are based on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
Being introduced
- HubSpot (customer relationship management, EU data centre).
- Resend (automatic confirmation emails to the person who sent a form).
- Cookiebot, Google Analytics 4, Meta Pixel and Meta Conversions API, and the HubSpot tracking code (see Cookies).
- We will update this notice when we introduce a service.
Authorities
- We disclose data to authorities only where the law requires it.
| In use now | What for |
|---|---|
| Vercel | Website servers |
| Cloudflare | Spam protection on forms (Turnstile) |
| Slack | Internal handling of messages sent through forms |
| Teamtailor | Recruitment system, applications and job ads |
| Mux | Video delivery |
| Anthropic | Language model service for the AI assistant and text suggestions |
| Supabase | Database for AI assistant events and internal tools |
| Sanity | Website content management |
| Google Workspace | |
| Meta | Recruitment advertising (see Recruitment advertising) |
Cookies and similar technologies
Some of the technologies we use are strictly necessary for the website to work or to provide a function you have requested, and they do not require consent. Technologies used for statistics load only if you accept them; before you choose, they are not executed. An up-to-date list of cookies and their durations is in the cookie declaration, which you can open from the Cookie settings link at the bottom of the page.
Not yet in use; introduced only with your consent
- Meta Pixel and Meta Conversions API: measuring recruitment advertising.
- HubSpot tracking code: marketing tracking.
- Storing campaign tags for the session: which campaign applicants come from. This is in use if you accept marketing cookies.
- You can accept or reject these in the first consent view and change your choice at any time from the Cookie settings link at the bottom of the page. When we introduce a technology that is not yet in use, we will update this notice at the same time.
| In use now | Purpose | Duration |
|---|---|---|
| Video playback (Mux) | Delivering video without tracking cookies | No cookie |
| Spam protection (Cloudflare Turnstile) | Protecting forms from automated submissions | No cookie on our domain |
| AI assistant conversation (browser local storage) | Continuing the conversation when you open the assistant | 24 hours |
| Staff login | Internal tools, for Wellpack staff only | 60 days |
| Consent management (Cookiebot) | Storing and respecting your choice | See the cookie declaration |
| Visitor statistics (Google Analytics 4), only with consent | Which pages are viewed and which contact links and tools are used. We do not identify you from this data | See the cookie declaration |
| Video viewing statistics (Mux Data), only with consent | Statistics on video performance and viewing | See the cookie declaration |
Your rights
You have the right to know what data we process about you and to receive a copy. You can request the correction of inaccurate data and the erasure of your data, restrict processing, object to processing based on legitimate interest and receive the data you have provided in a machine-readable format. You can always object to direct marketing. You can withdraw your consent at any time, which does not affect earlier processing.
How to exercise your rights
- Send your request to tietosuoja@wellpack.fi.
- We verify your identity before disclosing data.
- We respond within one month of receiving the request at the latest.
- We cannot erase data that we must keep by law before the retention period ends.
Right to lodge a complaint
- You can lodge a complaint with the Data Protection Ombudsman if you believe the processing of your data breaches the law (tietosuoja.fi).
Security
We protect data by technical and organisational means.
How we protect data
- The website and forms work over an encrypted connection (HTTPS).
- Internal tools require personal user accounts.
- Personal data from forms is not written to application logs.
- We enter into data processing agreements with our service providers.
- If a personal data breach poses a risk, we notify the Data Protection Ombudsman within 72 hours of becoming aware of it and, where the risk is high, also the people affected.
Whistleblowing reports
We maintain a statutory reporting channel for our employees, including temporary agency workers, and for our stakeholders at whistleblowing@wellpack.fi. Reports are received by Aaretti Niskanen. If a report concerns Wellpack's management, the reporting person can contact our external lawyer directly.
You can also report to the centralised external reporting channel of the Office of the Chancellor of Justice (oikeuskansleri.fi).
Handling
- We confirm receipt of a report within 7 days and tell you about the measures taken within 90 days.
- You can leave out your contact details. The sender details of an email are visible to the recipient, so use an address that does not identify you if needed.
- A reporting person must not be penalised or retaliated against (Whistleblower Act 1171/2022). Their identity is protected as required by law.
Personal data
- Legal basis: legal obligation (GDPR 6(1)(c)), Whistleblower Act 1171/2022.
- We keep reports for the period set by the Whistleblower Act.
- Channel description: /en/for-employees#whistleblowing
Changes and version history
We update this notice when our processing, service providers or the law change. The update date is shown at the top of the page.
Version history
- 22 September 2026: Notice revised to match the services in use. We now separate services in use from services being introduced, and have added retention periods, recruitment principles, recruitment advertising, images and videos, and the external reporting channel. The contact for data protection matters is tietosuoja@wellpack.fi.
- 8 September 2026: AI assistant section added.
- 21 May 2026: First notice for the Wellpack 2.0 website.
- 16 January 2025: Earlier version (archived internally).
On data protection matters
Send your request to tietosuoja@wellpack.fi. We respond within one month at the latest. You have the right to lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi).