In customer acquisition projects, the data controller is the client company of Strongest Group Oy on whose behalf contacts are made. In this context, Strongest Group Oy acts as a data processor following the instructions of the client company.
tietosuoja@strongest.fi
Processing of Personal Data in Customer Acquisition Services
2026-09-28
Legitimate Interest
Personal data is processed to implement Strongest Group Oy’s customer acquisition and meeting booking services on behalf of clients. Data is used to support business-to-business (B2B) sales, to make contacts, and to schedule meetings with potential clients.
Strongest Group Oy processes personal data on behalf of its clients and in accordance with their instructions, within the limits permitted and required by the GDPR.
The legal basis for processing is determined by the client company acting as the data controller. Typically, processing is based on the client company’s legitimate interest in conducting B2B customer acquisition.
The legitimate interest is grounded in the company’s business operations and the need to reach business contacts for B2B sales. Processing generally targets company representatives in connection with their professional roles.
The register contains personal data concerning business contacts, such as company decision-makers, specialists and other business contacts. These include contacts at potential customers of Strongest Group Oy’s client companies.
Personal data is accessed by:
- Strongest Group Oy employees and subcontractors in accordance with their duties
- The client company on whose behalf the contact is made
- Technical service providers (e.g., CRM systems and cloud services)
Personal data is not disclosed to external parties without a lawful basis.
The personal data register contains the following information:
- Name
- Job title or position in the organisation
- Company name
- Email address
- Phone number
- Information related to the company’s industry
- Contact and communication history
- Notes related to the sales process
- Information about scheduled meetings
Personal data may be obtained from:
- prospect lists and other contact details provided by client companies for their assignments;
- publicly available business and contact information, such as company websites and public registers;
- professional networking services, such as LinkedIn;
- commercial business and contact data providers, and services used to find, enrich and verify contact details;
- subcontractors involved in delivering customer acquisition assignments, including those who prepare prospect lists or enrich contact details; and
- the data subject directly, for example during meetings, telephone calls and email correspondence.
The sources used depend on the client company’s assignment and the services used to deliver it.
Personal data is retained in accordance with the client company’s instructions. Data is kept for the period defined by the data controller or as long as necessary to carry out customer acquisition. Data is deleted or anonymised when no longer needed for the purpose of processing.
Personal data is processed to deliver the client company’s assignment. Data may be provided to the client company and to subcontractors and service providers used by Strongest Group Oy to deliver the service, including providers of prospecting, contact lookup and verification, CRM, calling, messaging and cloud services. Data may also be disclosed to authorities where required by law.
Prospects’ personal data may be processed outside the EU or EEA through the services we use. Such transfers are based on an applicable transfer mechanism under the GDPR, such as a European Commission adequacy decision (including for a recipient certified under the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses. Further information about the transfer mechanisms and safeguards used is available from tietosuoja@strongest.fi.
Prospects’ personal data is primarily processed electronically. If information is processed on paper, documents are kept out of the reach of unauthorised persons and access is limited to those who need it for their duties. Documents that are no longer needed are securely destroyed.
Access to personal data is limited to those who need it for their duties. Access requires user authentication. Appropriate technical and organisational security measures are used to protect the systems and devices in which the data is processed.
Automated tools may be used to find, enrich and verify information, select relevant contacts and personalise communications to a limited extent. Data subjects are not subject to decisions based solely on automated processing that produce legal effects or similarly significant effects concerning them.
Data subjects have the right to obtain confirmation of whether their personal data is being processed and to access and receive a copy of that data. Requests may be sent to tietosuoja@strongest.fi. Strongest Group Oy forwards the request to the relevant client company acting as data controller and assists in handling it. If there are reasonable doubts about the requester’s identity, additional information necessary to confirm identity may be requested.
Data subjects may have the right to have personal data they provided transferred from one system to another if the processing is based on consent or a contract and is carried out by automated means. Requests may be sent to tietosuoja@strongest.fi. Strongest Group Oy forwards the request to the relevant client company acting as data controller and assists in handling it.
Data subjects have the right to request the correction of inaccurate personal data and the completion of incomplete data. Requests may be sent to tietosuoja@strongest.fi. Strongest Group Oy forwards the request to the relevant client company acting as data controller and assists with the correction in accordance with its instructions.
Data subjects have the right to request restriction of the processing of their personal data in the circumstances set out in the GDPR, for example while the accuracy of contested data is being verified. Requests may be sent to tietosuoja@strongest.fi. Strongest Group Oy forwards the request to the relevant client company acting as data controller and assists in implementing it in accordance with the controller’s instructions.
Data subjects have the right to object to the processing of their personal data for direct marketing at any time. Following an objection, their data will no longer be processed for direct marketing. Data subjects may also object to processing based on legitimate interests on grounds relating to their particular situation. Requests may be sent to tietosuoja@strongest.fi. Strongest Group Oy forwards the request to the relevant client company acting as data controller and takes the necessary steps concerning its own processing.
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority.
You may also lodge a complaint in the Member State where you have your habitual residence or place of work.
The contact details of the national supervisory authority are:
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PO Box 800, 00531 Helsinki
Switchboard: +358 29 566 6700
Registry: +358 29 566 6768
tietosuoja@om.fi
www.tietosuoja.fi
Data subjects have the right to request the erasure of their personal data where the conditions laid down in the GDPR are met. Requests may be sent to tietosuoja@strongest.fi. Strongest Group Oy forwards the request to the relevant client company acting as data controller and assists with erasure in accordance with its instructions. Following an objection to direct marketing, the minimum information necessary to prevent further contact may nevertheless be retained on a suppression list. Data may also be retained where there is another lawful basis for doing so.