1. General
This General Privacy Policy (“Privacy Policy”) describes what personal data of the data subject (“you” or “data subject”) Cactos Fleet Finland Ky (3297832-9) (“Cactos”, “we”, or “the controller”) processes as the controller, and how and for what purposes such personal data are processed. This Privacy Policy also describes how personal data is transferred to third parties and how you can exercise your rights related to the processing of personal data.
This Privacy Policy applies to the processing of personal data in connection with Cactos’ provision of services, marketing, and other business operations, as well as to personal data collected through online services such as websites and cookies.
Cactos complies with applicable data protection legislation, including the General Data Protection Regulation (EU 2016/679) and the Finnish Data Protection Act (1050/2018). Terms not defined in this Privacy Policy shall be interpreted in accordance with applicable data protection legislation.
2. Contact Details for Data Processing Matters
Cactos Fleet Finland Ky (3297832-9)
Kuortaneenkatu 2, 00510 Helsinki
Oskari Jaakkola, CEO
Email: oskari.jaakkola@cactos.fi
3. Groups of Data Subjects
The personal data processing described in this Privacy Notice concerns the following groups of data subjects:
- Cactos’ customers (including investor customers) and partners, as well as their representatives and other contact persons;
- Potential customers (including potential investor customers), their representatives, and other contact persons;
- Users of Cactos’ website; and
- Partners of the limited partnership and their representatives and other contact persons.
4. Types of Personal Data processed
4.1. Sales, Marketing and Partner Relations
When engaging with partners, and when selling and marketing services to customers or potential customers, Cactos processes the following personal data:
- Name;
- Contact details (email address, postal address, and phone number);
- Employment or service-related information (such as organization, position, and job title); and
- Other information related to the customer relationship (such as marketing prohibitions).
4.2. Provision of Services and Contractual Obligations
When providing services to customers and fulfilling contractual obligations, Cactos processes the following personal data of customers or their representatives:
- Name;
- Contact details (phone number, postal address, email);
- Employment or service-related information (such as organization, position, job title); and
- Information required by law for fulfilling know-your-customer obligations.
4.3. Website
When using Cactos’ website, the following personal data is processed by Cactos:
- Cookie data such as browser type, operating system, device model, IP address, location data, connection time, and duration (the cookie banner of the website provides more detailed information of the processing of cookie data); and
- Information provided through contact forms, such as name, email, phone number, company, and any other data you fill in.
5. Purpose and Legal Basis of Processing Personal Data
5.1. Sales, Marketing, and Partner Relations
When Cactos engages with its partners and when selling and marketing its services, Cactos processes the above-specified personal data for the following purposes:
- To initiate, enable, maintain, and develop potential customer or partner relationships;
- For direct marketing, such as sending newsletters;
- To develop the services offered by Cactos; and
- To fulfil our legal obligations.
Processing of the personal data for the purposes specified above is based on the data subject’s explicit consent, where specified in connection with the consent or otherwise on Cactos’ legitimate interest. The above-mentioned processing may also be based on a legal obligation.
5.2. Provision of Services and Contractual Obligations
When providing services to customers and fulfilling contractual obligations, Cactos processes the above-specified personal data for the following purposes:
- To maintain, manage, and develop customer and partner relationships;
- To process and deliver contract-based orders;
- For contract management and invoicing; and
- To fulfil our legal obligations.
The processing of personal data for the purposes specified above is based on Cactos’s legitimate interest or on a contract, if such a contract has been separately concluded with the data subject. The above-mentioned processing may also be based on a legal obligation.
5.3. Website
When you visit Cactos’ website, Cactos processes the above-specified personal data for the following purposes:
- To provide, maintain, and develop the website;
- To compile website usage statistics;
- For targeted advertising; and
- To process contact requests submitted through the website.
The processing of personal data for the purposes specified above is based on, in regard to necessary cookies, Cactos’s legitimate interest and otherwise on the data subject’s separate explicit consent. From Cactos’s website’s cookie banner you can manage consents concerning the use of cookies as well as get more detailed information about the cookies used on the website and about the personal data collected by them.
The personal data processing carried out by Cactos described in this Privacy Policy is not subject to automated decision-making. Insofar as the personal data processing described in sections 5.1 – 5.3 is based on legitimate interest, you have, as the data subject, the right to obtain additional information about the applicable legitimate interest through the contact details presented in section 2 of the Privacy Policy.
6. Regular Data Sources
Cactos collects personal data from the data subject themself as well as through the Cactos services used by the data subject. Cactos can receive personal data also from third parties in relation to the data subject, such as from our customer, from our cooperation partner, or from public sources, for example from the website of the organization you represent.
From Cactos’s website, personal data is collected by means of third-party cookie and similar technology tools, about which it is possible for you to get more information from Cactos’s website’s cookie banner.
7. Processors and Recipients of Data
Cactos uses external service providers in the processing of the personal data it collects, such as companies providing IT, consulting, and marketing services. These partners may act as processors of personal data in accordance with Cactos’s instructions, in which case Cactos binds the partners by contract to process your personal data in compliance with data protection legislation and Cactos’s more detailed instructions. In certain situations, these partners may also act as separate, independent controllers with regard to the personal data necessary for providing the service.
In connection with the provision of services, personal data may also be transferred or disclosed, when necessary, to electricity market participants, authorities, or other parties who must process personal data in order to fulfil a contract concluded with you or the organization you represent.
Cactos’s website may contain links to third-party services. This Privacy Policy does not apply to content provided or managed by third parties; instead, the privacy practices displayed on each service provider’s own platform apply to such content.
In exceptional circumstances, Cactos may also disclose or transfer personal data to other third parties if required by applicable law, regulation, another order of an authority, or for the purpose of maintaining website security. Cactos may also transfer personal data within its group companies, as well as in connection with a possible merger, acquisition, or business transfer in which Cactos or its business or part thereof is sold to the data recipient.
8. Transfers of Personal Data Outside the EU or EEA
Cactos transfers personal data outside the EU or EEA, if it is necessary for the implementation of the purposes of personal data processing or for the technical maintenance of the data. If personal data are processed outside the EU or EEA, Cactos takes care that the conditions for data transfer set in the EU’s Data Protection Regulation are fulfilled, and that the collected data are transferred only to such third countries or parties whose level of data protection the European Commission has found sufficient (for example, under the EU-U.S. Data Privacy Framework), or that the recipient of the personal data has committed to the European Commission’s standard contractual clauses concerning the processing of personal data, and, if necessary, has taken care of sufficient technical additional protective measures.
If the international data transfer is based on the Commission’s standard contractual clauses, you have, as the data subject, the right to obtain the applied standard contractual clauses for your review by contacting the address mentioned in section 2 of this Privacy Policy.
9. Data Retention Policies
Cactos stores the personal data it processes only as long as they are necessary for those purposes for which the personal data are processed.
Personal data concerning the customer and cooperation relationship are stored for the duration of the customer or cooperation relationship and thereafter at most seven (7) years from the end of the customer relationship.
Data concerning sales and marketing are stored as long as the consent given for marketing is valid, or otherwise as long as the relationship forming the basis of the processing with the data subject remains, in which case the data are stored at most seven (7) years.
Personal data may also be stored longer than mentioned, if the applicable legislation (such as the Accounting Act or the legislation applicable to alternative investment funds), an agreement binding Cactos, or processing a legal claim requires it. Cactos evaluates the necessity of data retention regularly, taking into account the applicable legislation.
Cookie data of Cactos’s website are stored according to the retention periods specified in the website’s cookie banner.
10. Policies of Personal Data Protection and Data Security
Cactos follows good information management practices, a high duty of care, and effective data security measures in the processing of personal data, in addition to which the information security of systems as well as the confidentiality, integrity, and availability of personal data are ensured by appropriate technical and organizational measures.
Access to the data is granted only to persons employed by Cactos or to its authorized parties whose performance of work tasks requires the processing of personal data. The personal data is protected with personal user IDs and passwords. Cactos requires from its personnel and partners a commitment to the careful processing and confidentiality of customer data.
11. Data Subject Rights
The data subject has the rights described in this section in accordance with applicable data protection legislation. Please note that the applicability of these rights in individual cases depends on the purpose and legal basis of the processing of personal data.
If the data subject wishes to exercise their rights, the data subject must submit a request concerning the exercise of these rights by email to the address indicated in Section 2 of this Privacy Policy. As a rule, Cactos does not charge any fee for handling such a request from the data subject. However, if the requests made by the data subject are manifestly unfounded or excessive, for example if they are made repeatedly, Cactos may, in accordance with applicable data protection legislation, charge a reasonable fee based on the administrative costs incurred in handling the request, or refuse to act on the request.
11.1. Right to Access and Receive a Copy of Personal Data
The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and the information required under applicable data protection legislation. The data subject also has the right to obtain a copy of the personal data undergoing processing.
11.2. Right to Examination and Rectification
The data subject shall have the right to access the personal data that is stored in the register. The data subject shall have the right to request the correction of inaccurate or imprecise personal data.
11.3. Right to Erasure
The data subject has the right, in situations provided for under data protection legislation, to have its personal data erased. This right applies, for example, in situations where the personal data are processed for the purposes of direct marketing. Exercising the right to erasure may, however, affect the extent to which Cactos is able to provide its services to you. The purposes of processing are described in the section of this Privacy Policy concerning the purposes of processing.
11.4. Right to Restriction of Processing
The data subject may request the controller to restrict the processing of their personal data. This right applies, for example, where the accuracy of the personal data is contested, or where the original purpose of the processing is no longer applicable.
11.5. Right to Object to the Processing
The data subject has the right to object, on grounds relating to their particular situation, to the processing of their personal data where such processing is based on the controller’s legitimate interests. In such a case, Cactos will cease processing the personal data unless the processing is permitted under an exception provided for in the General Data Protection Regulation. The data subject also has the right to object to the processing of personal data for direct marketing purposes at any time and without providing any specific reason.
11.6. Right to Data Portability
The data subject has the right, in situations provided for under data protection legislation, to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller where technically feasible.
11.7. Right to Withdraw Consent
Where the processing of personal data by Cactos is based on the data subject’s explicit consent, the data subject has the right to withdraw their consent. In relation to cookies, consent may be withdrawn through the cookie banner available on the website. The cookie banner can be accessed at any time via the cookie icon displayed on the website. If you withdraw the consent, it may limit Cactos’s ability to provide certain services to you.
11.8. Right to Lodge a Complaint with a Supervisory Authority
The data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes applicable data protection regulations.
12. Changes to Privacy Policy
Cactos may update this Privacy Policy from time to time due to changes in data processing practices or applicable legislation. The most recent version of this Privacy Policy is always available on Cactos’s website.
Version History
Version
1. First Privacy Policy published
Date
15.10.2025