PRIVACY POLICY

At Algol Chemicals Oy (including its subsidiaries, hereinafter “Algol Chemicals”) we are committed to protecting the privacy of our service users. We process personal data appropriately and only to the extent necessary for our operations. Our data processing practices are based on the EU General Data Protection Regulation (2016/679) and the Finnish Data Protection Act (1050/2018).

Algol Chemicals Oy is part of the Algol Group. While Algol Oy is responsible for data protection administration at the group level, Algol Chemicals Oy and its respective subsidiaries each act as independent data controllers for their own customer and stakeholder registers.

This page and the privacy notices mentioned herein apply to the processing of personal data carried out by Algol Chemicals group of companies. We update our privacy notices as necessary and indicate the date of the latest changes within the document. We recommend that you visit our website regularly to stay informed of any updates.

If you have any questions regarding our processing of personal data after reading our privacy notices, please feel free to contact us:

Algol Chemicals Oy
Karapellontie 6
02610 Espoo, Suomi

E-mail: gdpr@algol.fi

Contact persons:

Tor Edgren, Group Corporate Responsibility Manager
Charlotta Horsma, Corporate Counsel

PRIVACY POLICY FOR ALGOL CHEMICALS OY’S CUSTOMER AND STAKEHOLDER REGISTER

1. Name of the Register

Algol Chemicals Group’s customer, stakeholder, supplier, and marketing register.

2. Data Controller and Contact Information

Algol Chemicals Oy and its subsidiaries (hereinafter “Algol Chemicals”). A list of our subsidiaries and their respective contact details can be found on our website.

Contact persons:

Tor Edgren, Group Corporate Responsibility Manager

Charlotta Horsma, Corporate Counsel

3. Data Content of the Register

• Identity and Contact Details: Name, email, phone number, title, job role or position in the company, organization, and its contact details.
• Customer and Contractual Data: Classification data provided by the Data Subject or publicly available, order, billing, and delivery information, details regarding products and services ordered or in the offer phase, expressed areas of interest, and other text-based data related to the customer relationship.
• Digital and Analytics Data: Data collected via cookies, the website, and the marketing platform. Specifically, from the newsletter/publishing system:
  • The time and indicative location (based on IP address) of opening messages.
  • The time when a person joined or was added to a mailing list.
  • Clicks on links and their timestamps.
  • Email program/client used to open the message.
  • Sharing of messages on social media.
  • IP address registered during subscription or link interaction.
• Events and Communication: Registration and participation data from events and surveys (identified responses including potential dietary information), and other transmitted information.
• Permissions and Device Data: Potential marketing authorizations or opt-outs, data collected from social media channels, and information about the device used (device type, browser, IP address).
• Any other information collected with the Data Subject's consent.

The personal data processed is necessary for its intended purposes. You are entitled to deny permission for the collection of the analytics and cookie data mentioned above.

4. Purpose and Legal Basis for Processing
We process personal data to manage customer and stakeholder relationships, provide services, and develop our business operations. The Data Controller processes personal data for the following purposes:

• Managing and administering business-related customer and stakeholder relationships and contracts.
• Sharing data within the Algol Chemicals group for internal administrative purposes and to provide localized customer service through our regional subsidiaries. 
• Maintaining and developing customer and stakeholder relationships.
• Customer communication and marketing.
• Fulfilling the rights and obligations of the Data Subject and the Data Controller.
• Purposes related to web services and analyzing the use of services and products, providing and developing services, identifying customers and data subjects, and generating statistics.
• Fulfilling the Data Controller's statutory obligations.

The legal bases for processing personal data under the EU General Data Protection Regulation are:

• Consent of the Data Subject
• Contracts related to the customer relationship
• Legitimate interest of the Data Controller
• Statutory requirements

The analytics of the publishing system we use for customer communication and marketing collect data to develop services. The information collected includes the time messages are opened and link clicks/timestamps.

You can cancel the receipt of marketing messages by notifying the controller or by clicking the unsubscribe link provided in every marketing message, after which your data will be removed from the electronic direct marketing subscriber list.

5. Regular Sources of Information

Personal data is collected from:

• The customer, potential customer, stakeholder representative, or other contacts themselves via telephone, the internet (websites, forms, newsletter subscriptions, event registrations, social media, trade register), email, or other similar means.
• Cookies or other similar technologies.
• Information collected during the contract process.
• Information obtained from customer meetings.
• Other possible situations where the Data Subject discloses data to the Data Controller.

Additionally, the Data Controller uses Google Ads and Analytics services to collect visitor data to analyze and improve the website and target relevant marketing. Data is automatically saved to the register when a user leaves information on the website or uses the newsletter service.

6. Regular Disclosure of Data

As a rule, the Data Controller does not disclose personal data to third parties outside of the Algol Chemicals group. However, personal data may be shared between Algol Chemicals Oy and its subsidiaries to the extent necessary to manage the customer relationship or provide services in a specific region. Data may be disclosed if required by a competent authority, to fulfill contractual obligations, or to the extent agreed upon with the Data Subject.

In some situations, data may be disclosed to subcontractors or partners of the Data Controller if necessary for service production (based on legitimate interest) or due to joint marketing measures (based on consent). These parties process personal data confidentially.

We aim to transfer data anonymously whenever possible. Our partners operate according to legal privacy requirements and the controller's documented instructions. We are responsible for the processing performed by service providers on our behalf as we are for our own actions.

7. Data Transfer Outside the EU or EEA

Data is not regularly disclosed outside the European Union or the European Economic Area. Data may be transferred outside the EU/EEA to our subsidiaries or partners located in third countries (such as India) or stored on a server located outside the EU or EEA. In such cases, we ensure a legal basis for the transfer, such as the European Commission’s Standard Contractual Clauses (SCCs), to ensure your data remains protected to EU standards. 

If data is transferred outside the EU/EEA, it always occurs on a legal basis:

• The European Commission has decided that the recipient country ensures an adequate level of data protection.
• The Data Controller has implemented appropriate safeguards using standard contractual clauses approved by the European Commission.
• The Data Subject has given explicit consent for the transfer.
• There is another legal basis for the transfer.

8. Data Retention Period

Personal data is stored only as long as necessary to fulfill the processing purposes defined in this statement. Data may also be stored as long as legislation, such as the Accounting Act, requires. The Data Controller regularly assesses the necessity of data retention according to internal practices.

9. Rights of the Data Subject

The Data Subject has the following rights. Requests to exercise these rights should be sent to the address mentioned in section 3. The Data Controller may ask the requester to prove their identity. The Controller will respond within the timeframe set by the GDPR.

The Data Subject has the right to inspect their stored data at any time and exercise their "right to be forgotten." Upon request, the Controller will correct, delete, or supplement inaccurate, unnecessary, incomplete, or outdated data.

Other rights include:

• Withdrawal of consent: Right to withdraw consent for data collected based on consent.
• Right to object: Right to object to processing based on public or legitimate interest unless there are compelling grounds for processing.
• Direct marketing ban: Right to prohibit processing for direct marketing, market research, or opinion polls.
• Right to restrict processing: Right to demand restriction of processing if data is inaccurate or processing is unlawful.
• Right to lodge a complaint: Right to bring the matter to the Data Protection Ombudsman.

Requests for inspection or correction must be submitted in writing and signed to: Algol Oy, Inspection Request, Karapellontie 6, 02610 Espoo or via email to gdpr@algol.fi.

Newsletter recipients have the right to opt out of receiving the newsletter from the controller. You can remove your email address from the mailing list by clicking the link at the end of the newsletter or by notifying the controller. 

10. Principles of Data Security

Personal data is kept confidential. The Data Controller’s network and hardware are protected by firewalls and other necessary technical measures. Access to data is restricted to employees whose job descriptions require it.

The Data Controller reserves the right to change this privacy statement as needed. This privacy statement was last updated on May 13, 2026.