Privacy notice | 7AM Corp Oy

1. Controller

7AM Corp Oy, Vantaa, Finland
service@7amcorp.com
Email info@7amcorp.com

Data protection matters are handled by the managing director, Jani Ketola. We have not appointed a separate data protection officer, because our activities do not require one under Article 37 of the Regulation.

2. What personal data we process

We process personal data in four contexts: client and supplier relationships, key and site access registers, recruitment, and the technical operation of this website. We do not collect personal data for marketing purposes and we neither buy nor sell contact lists.

Clients and suppliers

Contact person's name, job title, email address and telephone number
The organisation's name, address, business ID and invoicing details
Quotation, order, schedule and service records, and the correspondence attached to them
Complaints and the notes made while handling them

The data is normally provided by the person concerned or by their employer. Company information may be checked against public registers and a credit reference agency.

Key and site access registers

The name of the person who issued or received a key, access card or door code
The date of issue and return, and the signature confirming each
Site induction records showing who was inducted, by whom and when

These registers exist because we hold keys to other people's premises and have to be able to say who had which one. We do not operate camera systems on client premises. If a client shows us a recording from their own system while investigating an incident, we do not receive or retain a copy.

Job applicants

Name, contact details and the education and work history given in the application
Attachments such as a CV, certificates and copies of cards and qualifications
Interview notes, and information from referees where the applicant has supplied their contact details

Use of this website

This site has no analytics, no advertising networks, no social media plugins and no tracking pixels, and it sets no cookies. The pages load nothing from any other server.

The web server keeps an ordinary request log: IP address, timestamp, requested address, HTTP response code, the number of bytes transferred and the identifier the browser reports. The log is used only to keep the service working and to investigate misuse, and it is deleted after 30 days.

3. Purpose and legal basis

Legal basis by category of processing
Purpose	Legal basis
Preparing quotations, scheduling work and delivering the service	Performance of a contract (Art. 6(1)(b))
Invoicing, accounting and debt recovery	Legal obligation (Art. 6(1)(c)), Finnish Accounting Act 1336/1997
Maintaining the client relationship and day-to-day contact	Legitimate interest (Art. 6(1)(f))
Key, access and induction registers	Legitimate interest: accountability for premises we hold keys to
Quality inspections, work records and incident investigation	Legitimate interest, and the requirements of our ISO 9001 and ISO 45001 systems
Recruitment and handling of applications	Steps taken at the request of the data subject before entering a contract (Art. 6(1)(b))
Web server request logs	Legitimate interest: keeping the service technically sound

We do not make automated decisions and we do not carry out profiling on the basis of personal data.

4. Retention periods

Client and supplier data: for the duration of the relationship and three years after it ends.
Accounting material: vouchers for six years and accounting books for ten years from the end of the financial year, as required by the Accounting Act.
Work records and quality inspection results: six years. These contain personal data mainly in the form of the initials of the person who did the work and the person who checked it.
Key and access registers: for the duration of the contract and two years after the last key is returned.
Job applications: six months from the closing date, or from the date an open application arrives.
Web server logs: 30 days.
Email: archived after two years and deleted after five, unless the message is needed for a contract or for accounting.

5. Recipients of the data

Personal data is disclosed only where it is necessary in order to run the business:

The accounting firm that handles our bookkeeping and payroll
The supplier of our scheduling and invoicing system, whose servers are located in Finland
Clients, in respect of the names of the crew members inducted onto their site
The subcontractors named in our service list, in respect of the site contact details needed to carry out the work
Our auditor, and a debt collection agency where necessary
Authorities, where the law requires it

Processing agreements under Article 28 of the Regulation are in place with our system suppliers. Personal data is not transferred outside the EU or the EEA.

6. Protecting the data

Electronic material is held in systems protected by individual user accounts and passwords, with access limited according to the person's duties. The depot is locked and alarmed. Paper material, such as signed contracts, key registers and job applications, is kept in a locked cabinet in the office.

Backups are taken daily and kept in a separate locked room in the same building. Every employee is briefed on data protection as part of their induction, and again when they are issued with a key.

7. Your rights

You have the right to

find out whether we process personal data concerning you, and to obtain a copy of it;
have inaccurate data corrected;
have data erased where there is no longer a basis for processing it;
request that processing be restricted, or object to processing based on a legitimate interest;
receive the data you have given us in a machine-readable form, where processing is based on a contract or on consent;
withdraw consent, where processing is based on consent.

Requests can be made by email to info@7amcorp.com or by post to the address above. We verify the identity of the person making the request before releasing any data, and we reply within one month of receiving it.

8. Right to lodge a complaint

If you consider that the processing of your personal data breaches data protection law, you may lodge a complaint with the supervisory authority. In Finland this is the Office of the Office of the Data Protection Ombudsman.

9. Changes to this notice

We update this notice when our processing practices or our systems change. Clients are told directly about significant changes. This version is dated 12 January 2026 and replaces the version dated 4 March 2023.