This privacy notice (hereinafter the “Notice”) describes how the RTS Group processes the personal data of customers and potential customers. This privacy notice has been prepared in accordance with the requirements of the EU General Data Protection Regulation (2016/679) (“GDPR”). The RTS Group is committed to complying with the obligations set out in the GDPR and other applicable data protection legislation. In this Notice, the term “person” refers to all natural persons whose personal data is included in the RTS Group’s customer register.
When the RTS Group provides its services, it acts in two roles under the GDPR:
a) RTS Group as Data Controller in relation to its customers
The RTS Group acts as a Data Controller within the meaning of the GDPR when it processes customers’ personal data for its own purposes, where such personal data forms the RTS Group’s Customer Register.
b) RTS Group as Processor in relation to personal data added by the customer to the RTS Group’s service
The RTS Group acts as a Data Processor within the meaning of the GDPR when it processes personal data on behalf of the customer, i.e. personal data that the customer has added to the RTS Group’s service. In this processing context, the customer is the Data Controller under the GDPR.
The RTS Group’s processing activities in situations where it acts as a Processor are described in Section 8 of this Notice.
Data Controllers: RTS Group, including
hereinafter “RTS Group”
Address: Malminkatu 16 A, 00100 Helsinki, Finland
Telephone: +358 45 4900 747
Data Protection Officer: Kristina Hännikäinen, deputy Marjut Jensén
Email: tietosuojavastaava@rakennustieto.fi
Personal data is processed for the establishment and management of the customer relationship between individuals and the RTS Group. Personal data is used, for example, for:
Data is processed based on the data subject’s separate, explicit consent, the legitimate interests of the controller, legal obligations, or the preparation or performance of a contract between the customer and the RTS Group.
Where processing is based on legitimate interest, the RTS Group has carried out a balancing test and assessed that the interests, fundamental rights, and freedoms of the data subject requiring protection of personal data do not override the legitimate interests of the RTS Group. A legitimate interest may arise where there is an appropriate relationship between the individual or the organisation they represent and the RTS Group, for example based on a customer agreement.
The interests, fundamental rights, and freedoms of individuals are respected, no special categories of personal data are processed, and processing activities are foreseeable to the individuals concerned. Personal data is protected against unauthorised access or processing through the safeguards described in Section 5.
Personal data may be collected in various ways; however, we primarily collect personal data directly from the individual or from the company with which a customer agreement has been concluded.
The processing purposes covered by this Notice require that we collect and process at least the following personal data:
We may disclose personal data within the RTS Group. Another company or foundation belonging to the RTS Group may also process your personal data on our behalf. Such processing is based on our legitimate interest to transfer personal data for intra-group administrative purposes, such as reporting, and to operate efficiently, for example by using centralised payment systems. We may disclose certain necessary data to third parties that we use as service providers or subcontractors, for example to ensure delivery or for marketing, event organisation, and customer relationship management purposes.
We use trusted contractual partners with whom the requirements of the GDPR and other applicable data protection legislation have been taken into account in agreements. We also use customer data with third parties for analytics and personalisation purposes. We utilise purchasing and browsing data together with partners to better offer products and promotions that may be of interest to you.
Where necessary, we also disclose data to public authorities. We always inform customers of data requests where permitted by law.
We share data with the following third parties:
Third parties include, for example, the following entities and their subcontractors:
Third parties and their subcontractors may also transfer personal data outside the EU or the European Economic Area. In such cases, applicable legislation (such as the GDPR) is complied with, including requirements such as the use of European Commission-approved standard contractual clauses (SCCs).
We use Google Analytics, for example, for analysing website usage, popular products, trends, and sales. Google LLC processes personal data in accordance with its privacy policy: https://policies.google.com/privacy?hl=fi .
The RTS Group ensures a high level of security and data protection when transferring and processing data in accordance with the GDPR. We do not process the personal data covered by this Notice outside the EU or the European Economic Area.
We implement appropriate measures (including physical, technical, and administrative measures) to protect personal data against loss, destruction, misuse, and unauthorised access or disclosure. Access to personal data is granted only to persons who need it for their work duties. Access to systems containing personal data requires a personal user ID and password. Written materials are stored in locked cabinets, and archived materials are kept in archive storage.
The RTS Group stores customer data within the EU. Data centres and the technical security and processes of commercial systems are maintained at a very high level. Servers are protected against data breaches and denial-of-service attacks. All persons processing personal data are bound by confidentiality obligations.
Please note that even appropriate measures cannot prevent all possible data security breaches. In the event of a personal data breach, we will notify you in accordance with applicable law.
Personal data is retained only for as long as necessary for the purposes defined in this Notice. Personal data will be deleted when its retention is no longer required by law or for the fulfilment of the rights or obligations of either party.
You have the right to access your personal data and to obtain confirmation as to whether or not personal data concerning you is being processed. You may also at any time request the rectification, updating, or deletion of your personal data. However, please note that personal data that is necessary for the purposes defined in this Notice, or whose retention is required by law, cannot be deleted.
You have the right to object to or restrict the processing of your personal data to the extent required by applicable law. Restriction of processing means that personal data, with the exception of storage, may only be processed with your consent, for the establishment, exercise, or defence of legal claims, for the protection of the rights of another person, or for important public interest reasons. You have the right to request restriction of processing, for example, if you contest the accuracy of your personal data. In such cases, we will restrict processing for the period during which the accuracy of the data is verified.
You may object to the processing of your personal data on grounds relating to your particular situation where the data is processed for the performance of a task carried out in the public interest or for the purposes of the legitimate interests of the RTS Group or a third party. In such cases, we may only continue processing your personal data if there are compelling legitimate grounds that override your interests, rights, and freedoms, or if processing is necessary for the establishment, exercise, or defence of legal claims.
In certain cases, you have the right to data portability, meaning the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format and to transmit those data to another controller, in accordance with applicable law.
Where processing is based on consent, you have the right to withdraw your consent at any time. We will then cease processing your personal data unless there is another legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
You may exercise your rights by sending a request to tietosuojavastaava@rakennustieto.fi. If you believe that your personal data has not been processed appropriately, you have the right to lodge a complaint with the Data Protection Ombudsman. Contact details can be found here: https://tietosuoja.fi/en/home.
As a data controller, the customer determines the purposes and means of processing personal data added to the RTS Group service. The customer is responsible for ensuring that there is a lawful basis for processing personal data in accordance with the GDPR. The RTS Group processes personal data added by the customer only on the basis of the customer’s instructions and for no other purposes or in any other manner.
The customer may add the following personal data of individuals to the RTS Group service:
The RTS Group collects personal data relating to individuals added by the customer in the following situations:
The RTS Group processes personal data of individuals added by the customer only for as long as there is a valid agreement between the RTS Group and the customer for the use of the services. Upon termination of the agreement, the RTS Group will, at the customer’s choice, either permanently delete or return all personal data to the customer and delete existing copies, except where legislation requires retention of personal data for a specified period after termination of the agreement.
The rights and obligations of the Data Controller and Data Processor are further specified in the RTS Group Data Protection Addendum, which forms an integral part of the RTS Group’s general terms and conditions. The latest version of the Data Protection Addendum is available at https://www.rakennustieto.fi/yleiset-sopimusehdot
No automated decision-making, such as profiling, is currently used in the processing of personal data covered by this Notice within the RTS Group.
The RTS Group uses cookies and other similar technologies, such as browser local storage. Cookies are small text files exchanged between a device’s browser and a server. Cookies and other identifiers have a defined lifespan, after which the browser deletes them. These technologies are used for functionality, personalisation, analytics, and targeted marketing.
Functional cookies and local storage are used, for example, for user authentication, maintaining login sessions, delivery time estimates, and shopping cart functionality. The use of cookies and local storage for these purposes is mandatory. Functional cookies and local storage variables set by the server remain in the browser from 15 minutes up to 24 months unless manually deleted in browser settings. Visiting the site resets cookies and local storage variables where allowed by the browser.
We treat data as personal data insofar as identifiers include identifying information such as an IP address. Identifiers linked to a customer in any way are also treated as personal data. The retention period for analytics and marketing-related identifiers ranges from 30 seconds to 24 months.
We use Google Analytics for analysing website usage, popular products, trends, and sales. More information on Google Analytics data processing is available here: https://policies.google.com/technologies/partner-sites . You may opt out of analytics and marketing partner tracking by enabling your browser’s Do Not Track feature and setting your browser to reject third-party cookies.
CHANGES TO THIS NOTICE
We reserve the right to modify this Notice. Significant changes will be communicated to registered customers when the terms are updated. The latest version of this Notice is available at https://www.rakennustieto.fi/tietosuojaseloste .
Updated: 16 June 2026
Tietosuojaseloste työnhakijalle
Tietosuojaseloste alihankkijoille, yhteistyökumppaneille ja toimikuntatyöskentelyyn
Tietosuojaseloste hallituksen jäsenille, edustajistolle ja tilintarkastajalle
Tietosuojaseloste lausuntopyynnön vastaanottajalle
Tietosuojaseloste Rakennustiedon ympäristöluokituksen konsulteille
