Privacy Notice
Puro.earth Oy Last updated: 20 March 2026
| What we collect | Why | Legal basis | How long |
| Contact details, professional details | Service delivery and customer service, sales, marketing and stakeholder communications, product and service development | Legitimate interest / Consent | See retention table |
| Agreement and transaction data | Service delivery, invoicing, product and service development | Legitimate interest | See retention table |
| Online data and identifiers | Website analytics, online advertising, product and service development | Legitimate interest / Consent | See Cookie Policy |
| Security data | Security, fraud prevention, product and service development | Legitimate interest | See retention table |
| Data required by law | Legal obligations | Legal obligation | As required by law |
For full details, see the sections below.
1. Controller and Contact Details
The data controller for the personal data described in this notice is:
Puro.earth Oy Business ID: FI31144162 Tammasaarenkatu 1, 00180 Helsinki, Finland
For data protection enquiries and to exercise your rights, please contact: Email: contact@puro.earth
2. Scope of This Notice
This privacy notice (“Notice”) describes how Puro.earth Oy (“Puro.earth”) processes your personal data. The Notice applies when you use our products and services, visit our website, or otherwise interact with us, including as a business customer or stakeholder. This Notice also applies to marketing our services to potential customers and processing personal data for such purposes.
Please note that we have a separate privacy notice for job applicants and employees.
3. What Data We Collect and Process
Puro.earth collects and processes the following categories of personal data where applicable:
Personal details including identity data (such as name, company and position), contact details (address, phone number, email address), information on whether the company represented by the data subject is our customer and identity verification data where required by law.
Agreement and transaction data including information about agreements, orders, payment status, invoices, subscriptions, service requests, and communications with our customer service.
Online data and identifiers including data collected via cookies or similar technologies, such as browsing activity, IP address, cookie ID, device and browser details, and location data. See our Cookie Policy for details.
Security data including login credentials, access logs, and security event data used to protect our services and users.
Data required by law including invoicing records, transaction data, contact details and other personal data required to be processed and stored under applicable laws.
4. From Where Do We Collect Personal Data
Personal data is collected from the following sources:
Directly from you when you use our services, create an account, fill in a form, participate in a survey, or otherwise interact with us.
Third parties such as public registers, business information providers, and partners, where permitted by applicable law.
5. Purposes and Legal Bases for Processing
We process personal data for the following purposes. Each purpose is linked to a specific legal basis under GDPR Article 6(1).
5.1 Service delivery and customer service
We process personal data to deliver our services, manage contracts and transactions, handle customer requests, and communicate with you about your account or service.
Legal basis: Legitimate interest (Art. 6(1)(f)) for providing our services and customer service, managing the contractual or business relationship, exercising our rights, fulfilling our obligations.
5.2 Sales, marketing and stakeholder communications
We may contact existing business customers and stakeholders with relevant information about our products, services, and events. We will ask for your consent where required by applicable law.
Legal basis: Legitimate interest (Art. 6(1)(f)) for business-to-business communications and stakeholder relations; consent (Art. 6(1)(a)) for any consent-based electronic marketing.
Our legitimate interest in contacting business customers and stakeholders is to maintain and develop business relationships. We have assessed that this interest is not overridden by the interests or rights of the individuals concerned, given the professional context and the relevance of the communications.
5.3 Online advertising
We may use cookies and similar technologies to show relevant advertising to visitors of our website. For details on how this works and how to manage your preferences, see our Cookie Policy.
Legal basis: Consent (Art. 6(1)(a)).
5.4 Product and service development
We process data to improve our services, conduct analytics, and gather feedback through surveys, interviews, and usage analysis. Where possible, this is done using anonymised data.
Legal basis: Legitimate interest (Art. 6(1)(f)). Our legitimate interest is to develop and improve our services for the benefit of our customers. We use anonymised data wherever possible to minimise privacy impact.
5.5 Legal obligations
We process personal data to comply with applicable legal requirements, including accounting, tax, and anti-money laundering regulations.
Legal basis: Legal obligation (Art. 6(1)(c)).
5.6 Security and defence of legal rights
We process personal data to protect our services and users from fraud, misuse, and security threats, and to establish, exercise, or defend legal claims.
Legal basis: Legitimate interest (Art. 6(1)(f)).
6. Automated Decision-Making and Profiling
Where we use automated decision-making that produces legal or similarly significant effects, we will inform you in advance and, where required, obtain your consent.
You have the right to request human review of any automated decision, to express your view, and to contest the decision. To do so, please contact us at contact@puro.earth.
7. How Long We Store Personal Data
Puro.earth retains personal data only for as long as necessary for the purposes described in this notice, or as required by law. Specific retention periods are set out in our Retention Schedule.
8. Who Can Access Your Personal Data
Puro.earth group companies may access personal data for the purposes described in this notice, based on legitimate interest and to the extent permitted by applicable law.
Commercial partners include partners where necessary to deliver services (e.g. where a service has been purchased through a partner) or to support our operations, such as online advertising partners described in our Cookie Policy.
Subcontractors and service providers include third-party providers (e.g. IT, payment, and communications providers) who process data on our behalf. All subcontractors are bound by data processing agreements and are not permitted to use personal data for any purpose other than delivering the agreed service.
Mergers and acquisitions: in the event of a sale, merger, or restructuring, personal data may be disclosed to prospective or actual purchasers and their advisers. Authorities and legal proceedings: we will disclose personal data to competent authorities where required by law, court order, or legal proceedings.
9. International Transfers of Personal Data
Some of our service providers and group companies operate outside the European Economic Area (EEA). When transferring personal data internationally, we ensure appropriate safeguards are in place, including:
- Transfers to countries with an adequacy decision from the European Commission.
- Use of Standard Contractual Clauses (SCCs) approved by the European Commission, accompanied by a Transfer Impact Assessment (TIA) where required.
- Transfers to the United States conducted in accordance with the EU-U.S. Data Privacy Framework (adequacy decision adopted July 2023), or based on SCCs with additional safeguards where applicable.
You may request further information about the safeguards in place for international transfers by contacting us at contact@puro.earth.
10. How We Protect Your Personal Data
Puro.earth implements appropriate technical and organisational security measures to protect your personal data against loss, misuse, and unauthorised access. All third-party service providers with access to personal data are required by contract to maintain equivalent security controls.
11. Cookies
When you visit our website, Puro.earth and third parties may collect data using cookies and similar technologies. For full information on how cookies are used and how to manage your preferences, see our Cookie Policy.
12. Your Rights
Under GDPR, you have the following rights regarding your personal data. We will respond to requests within one month. In complex cases, this may be extended by up to two additional months, in which case we will notify you.
Right of access — you may request a copy of the personal data we hold about you.
Right to rectification — you may request correction of inaccurate or incomplete data.
Right to data portability — you may request your data in a machine-readable format where processing is based on contract or consent.
Right to erasure — you may request deletion of your data where it is no longer needed for the purposes for which it was collected.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to object — you may object to processing based on legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds. You have right to object to processing of your personal data for direct marketing purposes at any time.
Right to restrict processing — in certain circumstances, you may request that we restrict the processing of your data.
Right not to be subject to automated decision-making — you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. For more information, see Section 6 above.
Right to lodge a complaint — you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes applicable data protection law. For details, see Section 13 below.
Opting out of marketing — you may opt out of electronic marketing at any time by clicking the unsubscribe link in any marketing message, or by contacting us. You may also manage your preferences through www.asml.fi/kieltopalvelut (in Finnish) for telephone and postal marketing.
Please note that you may receive marketing messages for a short period after opting out while we update our systems.
To manage cookies — see our Cookie Policy.
To exercise any of the above rights, please contact: contact@puro.earth
13. How to Lodge a Complaint
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with the competent supervisory authority.
In Finland, the supervisory authority is:
Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) Website: tietosuoja.fi Email: tietosuoja@om.fi
A list of supervisory authorities in other EU member states is available at: edpb.europa.eu
14. Changes to This Notice
Puro.earth reserves the right to update this Notice. Material changes will be communicated on our website or directly to you. The date of the most recent update is shown at the top of this Notice.
15. Contact
Puro.earth Oy Business ID: FI31144162 Tammasaarenkatu 1, 00180 Helsinki, Finland Email: contact@puro.earth
This Legal Notice was last updated on 20 March 2026.