Privacy Notice
Updated 29 September 2026
This notice explains how Mediatum Oy processes personal data in its research and business intelligence services, customer relationships and website. The processing depends on the service: Mediatum acts as controller for its own customer and contact data, and, depending on the engagement, either as a controller or as a processor acting on behalf of a customer.
1. Data controller and contact details
Mediatum Oy (Finnish Business ID 1944421-8)
Telephone: +358 50 586 6116
Email: taisto.lehikoinen@mediatum.fi
Postal address: Antennikatu 12, 40640 Jyväskylä, Finland
Requests concerning data protection may be sent to the email or postal address above.
2. Personal data we process and whose data it concerns
Depending on the service and situation, we may process the following information:
Contact and business details of customers, prospective customers and partners, including job titles, communications, quotations, agreements and notes relating to the customer relationship.
Contact details of people invited to or participating in research, such as name, email address, telephone number and respondent group specified by the customer. Research responses are kept separate from identifying details wherever possible.
In business intelligence and OSINT work, professional and role-related information about individuals, such as name, employer, role, publicly available professional contact details, public statements, decisions, participation and other information relevant to the engagement. Source references, observations and analysis may be linked to this information.
Technical information about website use, such as IP address, browser and device details, and information collected through cookies or similar technologies to the extent permitted by the website settings and cookie consent.
Mediatum does not normally seek to collect special categories of personal data or data relating to criminal convictions and offences. If such information is encountered incidentally in a source, it is not included unless there is a necessary and lawful basis relevant to the engagement; unnecessary information is removed or excluded from processing.
3. Purposes and legal bases for processing
Personal data is processed for the following purposes:
Managing customer relationships, responding to enquiries, preparing quotations, entering into agreements and providing services. The legal basis is a contract or steps taken before entering into a contract, and Mediatum’s legitimate interest in operating and developing its business.
Conducting surveys, interviews and other research commissioned by a customer. The legal basis and the parties’ roles are determined for each engagement. Usually, the processing is based on the agreement with the customer and the customer’s documented instructions. Mediatum may act as processor or, in a separately agreed research design, as controller.
Business intelligence concerning markets, competition, the operating environment and relevant actors, including OSINT, meaning information gathering and analysis from open sources. The legal basis is the legitimate interest of Mediatum or its customer in obtaining and producing information to support business planning and decision-making. This interest is assessed against the individual’s rights, the nature and source of the information, the purpose of processing and its effects.
Operating and securing the website, measuring its use, and providing content and contact forms requested by users. Non-essential cookies or similar technologies are used only where the required consent has been obtained.
Mediatum does not use personal data for automated decision-making about individuals or profiling that produces legal effects or similarly significant effects on an individual.
4. Sources used in OSINT and business intelligence
Information may be obtained from public and other lawfully accessible sources, such as websites of public authorities and companies, registers, decision documents, news, publications, professional online services and materials supplied by the customer. Information may be checked against multiple sources and combined into an overall picture relevant to the objectives of the engagement.
This notice does not mean that every possible source is used in every engagement. Information is collected only for a defined engagement and limited purpose. An engagement does not authorise bypassing logins or access controls, or otherwise obtaining information unlawfully.
5. Controller and processor roles in engagements
The parties’ roles are determined for each engagement according to who decides the purposes and essential means of processing personal data. Where Mediatum processes personal data on behalf of a customer, the customer is the controller and is responsible for informing data subjects. For this reason, Mediatum does not send a separate notice in its own name to every person included in a register compiled for a customer engagement. Mediatum provides the customer with relevant information and assists with transparency measures as agreed.
Where Mediatum itself decides the purposes and essential means of processing, for example in its own customer register, Mediatum acts as controller and is responsible for providing information about that processing.
6. Disclosures and recipients
Personal data may be disclosed to the customer to carry out the engagement and deliver the agreed report or other output. Research results are generally reported so that individual respondents cannot be identified. Identifiable interview content or contact details are provided to the customer only if this is part of the agreed research design and there is an appropriate legal basis.
Personal data may be processed by service providers supporting the services used by Mediatum, for example providers of information systems, survey, storage, communications and website services. Mediatum uses service providers under contractual terms and appropriate security measures. The current providers depend on the systems in use and the engagement.
Personal data is not sold. It may be disclosed to public authorities where required by law or a competent authority, and in connection with a corporate transaction to the extent permitted by law.
7. Transfers outside the EU or EEA
Mediatum seeks to use services in which personal data is processed within the EU or EEA. If a service provider used for an engagement transfers personal data outside the EU or EEA, the transfer will be made on a basis permitted by data protection law and with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and, where necessary, supplementary measures.
Contact requests, meeting bookings and newsletter subscriptions are handled in HubSpot, whose servers for this account are located in the United States. Personal data submitted through the contact form, the meeting booking calendar or the newsletter form is therefore transferred outside the EU and EEA. The transfer is based on the safeguards described above and is limited to the data needed to respond to the request.
8. Retention periods
Personal data is retained only for as long as necessary for the purposes described in this notice or as required by law. The retention period depends on the purpose and the engagement:
Customer, quotation and agreement information is retained during the customer relationship and thereafter as necessary to manage contractual responsibilities, claims and statutory obligations.
Research contact details are retained for the duration of the research and quality assurance. Identifiers are removed or separated from responses when no longer needed; the retention period for each engagement is agreed with the customer.
OSINT and intelligence material is retained for the period necessary for the engagement, any agreed monitoring period and the substantiation of results. Background material for work delivered to the customer is deleted or anonymised when it is no longer needed and no agreement or legal obligation requires its retention.
The retention period for website log and cookie information depends on the service and cookie used.
Specific retention periods and deletion procedures are set out in Mediatum’s internal practices, agreements and the settings of the services in use.
9. Data subject rights
Under applicable data protection law, individuals may have the right to:
receive information about and access their personal data;
request correction of inaccurate data or completion of incomplete data;
request erasure of data or restriction of processing where the legal requirements are met;
object, on grounds relating to their particular situation, to processing based on legitimate interests;
receive personal data they have provided in a portable format where applicable; and
withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Requests concerning these rights may be sent to the contact details in section 1. Mediatum may request information necessary to verify the requester’s identity. If Mediatum acts as processor on behalf of a customer, the request may be referred to the customer, and Mediatum will assist the customer as agreed. Individuals also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).
10. Information about data not obtained from the individual
Where Mediatum acts as controller and obtains personal data from a source other than the individual, the transparency requirements in Article 14 of the GDPR apply. Information is generally provided within a reasonable period, no later than one month, or earlier if the individual is contacted or the data is disclosed. Where Mediatum acts as the customer’s processor, the customer, as controller, is responsible for providing this information.
In large business intelligence datasets, it is not practical to send a separate message to every person included in a register. The exception in Article 14(5)(b) of the GDPR may apply where providing information individually is impossible, would involve disproportionate effort, or would make the processing objectives impossible or seriously impair them. The exception is not applied automatically because a dataset is large; the controller assesses and documents the circumstances for each engagement. The assessment may consider, among other things, the number of individuals, the nature and sources of the data, the effects of processing, the availability of contact details and the safeguards used.
Where the exception is used, the controller takes appropriate measures to protect individuals’ rights. Depending on the circumstances, these may include keeping this notice easily accessible, limiting data to professional information necessary for the task, recording sources, restricting access, checking accuracy and deleting data when no longer needed. Individual notice is provided where a person is contacted or where the circumstances otherwise make this appropriate. The fact that information is publicly available does not, by itself, remove the transparency obligation.
11. Data security
Mediatum protects personal data through technical and organisational measures proportionate to the nature of the data and the risks of processing. Access is limited according to work responsibilities, and people handling data are bound by confidentiality. Personal data breaches are handled in accordance with applicable law.
12. Cookies and website use
Mediatum’s website may use cookies that are necessary for the website to function and, subject to consent, analytics or marketing cookies. The cookies in use, their purposes and retention periods are described in the cookie notice or settings, where users can manage their consent. Information submitted through website forms is used to handle the enquiry or other service requested by the user.
13. Changes to this notice
This notice may be updated if Mediatum’s services, processing activities or applicable law change. The current version is published at mediatum.fi/tietosuoja.