This Privacy Policy explains how Elva Technologies Oy collects, uses, and protects your personal data when you use our website, platform, or services. It also outlines your rights and how to exercise them.

1. Introduction

1.1 Welcome to withelva.com's Privacy Policy. Your privacy is important to us, and this policy explains how we collect, use, and protect your personal data when you use our website, platform, or services. It also outlines your rights and how to exercise them.

1.2 At Elva Technologies Oy, we are committed to your privacy. Earning and maintaining your trust is of the utmost importance to us when you use our services. The privacy of our users is a high priority and underpins our technology and business decisions.

1.3 Our service provides end-to-end employee relocation and immigration support to companies and their assignees. We go to the best possible extent to protect your data and keep it private and secure. Data we collect is used for the purpose of providing the best possible relocation experience and to improve our services.

2. Who does this policy apply to?

2.1 This policy applies to anyone using our website, platform, or services, including customers purchasing our products, assignees whose personal data is provided to us by their employer or engaging entity, and accompanying family members whose data we may process in connection with relocation services.

2.2 This policy also applies to the collection, use, and disclosure of personal data in connection with our marketing and sales activities and the performance of customer agreements.

3. What data do we collect?

3.1 Depending on how you interact with Elva, we may collect the following categories of personal data directly from you:

[checkmark]

Account Information: Name, title, relation to the company you represent, email address, job title, and contact details when you register.

[checkmark]

[checkmark]

Profile Information: Username, password, user IDs, authentication credentials, and additional profile details.

[checkmark]

[checkmark]

Third-Party Login: Data from services like Google when using Single Sign-On (SSO).

[checkmark]

[checkmark]

Inquiries and Support: Name, email, and chat content from live chat interactions.

[checkmark]

[checkmark]

Marketing: Email addresses for newsletters, with an option to unsubscribe anytime.

[checkmark]

[checkmark]

Usage Information: Log data, device details, and location (if applicable).

[checkmark]

[checkmark]

Financial Data: Bank account details and purchase history.

[checkmark]

[checkmark]

Relationship Information: Services and order details, contract information, payment details, and billing information.

[checkmark]

[checkmark]

Other Data: Data collected on the basis of your consent, defined in detail on a case-by-case basis at the time of collection.

[checkmark]

3.2 When you are an assignee or a family member of an assignee in connection with our employee relocation and immigration services, we may collect the following categories of personal data:

[checkmark]

Identity data: name, date of birth, nationality, passport and identification document details.

[checkmark]

[checkmark]

Immigration data: visa and permit information, travel history, immigration status.

[checkmark]

[checkmark]

Employment data: employer details, job title, employment terms.

[checkmark]

[checkmark]

Family data: details of accompanying family members.

[checkmark]

[checkmark]

Financial data: bank account details (for banking setup support).

[checkmark]

[checkmark]

Biometric appointment details: coordinated with immigration authorities.

[checkmark]

3.3 Where we receive your personal data from your employer or the company that has engaged our services (the "Client"), we may process the following additional categories of personal data:

[checkmark]

Employment Agreement

[checkmark]

3.4 We also collect personal data when you fill out a form on our website to request more information about our services, including your name, email address, phone number, and company name.

3.5 We may collect and use for any purpose aggregated or anonymised data derived from our services, where no individual is identified. Such data may be used for analytics, product improvement, and reporting purposes.

4. Why do we collect your data?

4.1 We collect and process your personal data for the following purposes, linked to the specific categories of data collected:

[checkmark]

Providing Services: Account Information (name, email, job title), Profile Information, Identity Data, Immigration Data, Employment Data, and Family Data to create and manage your account, operate our platform, and fulfil customer and assignee service requests, including relocation and immigration services.

[checkmark]

[checkmark]

Improving Services: Usage Information (log data, device details) to gather feedback, analyse platform usage, and enhance functionality.

[checkmark]

[checkmark]

Security: Usage Information and Account Information to prevent fraud, detect unauthorised access, and ensure safe operations.

[checkmark]

[checkmark]

Marketing: Email addresses to send relevant content, newsletters, and service updates (with your consent).

[checkmark]

[checkmark]

Legal Compliance: All categories as necessary to meet legal obligations, respond to lawful requests, and enforce our terms.

[checkmark]

[checkmark]

Marketing and Sales: Email addresses and Relationship Information to contact you regarding your interest in our services and to carry out sales activities.

[checkmark]

[checkmark]

Identity Verification: Profile Information and authentication credentials to verify your identity for the purposes of signing into the platform and services.

[checkmark]

[checkmark]

Customer Relationship Management: Account Information and Financial Data to manage the customer relationship with you, including customer communications, user account management, and processing payments.

[checkmark]

[checkmark]

Feedback: Usage information to interact with you for feedback on our services.

[checkmark]

[checkmark]

Personalisation: Usage Information and Account Information to personalise our services, develop new services, and provide notifications of new features, changes, and improvements.

[checkmark]

[checkmark]

Customer Support: Enquiries and Support data to correspond with you, resolve issues, and provide customer support by phone or email.

[checkmark]

[checkmark]

New Services and Content: Email addresses to inform you of new services, features, and content we may offer.

[checkmark]

5. When can we use your data?

5.1 We process your personal data only where we have a valid legal basis under the GDPR. The legal basis applicable to each processing purpose is as follows:

[checkmark]

Providing Services where legal basis is performance of a contract with you or your employer.

[checkmark]

[checkmark]

Marketing communications where legal basis is your consent. You may withdraw consent at any time (see Your Rights below).

[checkmark]

[checkmark]

Security and fraud prevention and improving our services where legal basis is our legitimate interests.

[checkmark]

[checkmark]

Legal compliance where legal basis is compliance with a legal obligation to which we are subject.

[checkmark]

5.2 Where we rely on our legitimate interests as the legal basis for processing, those interests include: preventing and detecting fraud; maintaining the security and integrity of our platform; improving our products and services; and communicating with users about their accounts. We have assessed that these interests are not overridden by the rights and interests of our users, taking into account the reasonable expectations of users of a relocation and immigration services platform.

6. Marketing and analytics

6.1 We may market and inform you about Elva Technologies Oy services. We may combine data collected about you from publicly available sources and from our different interactions with you. Your personal data may also be used for market research and customer surveys. Processing for these purposes is based on our legitimate interest to collect and analyse relevant information to better understand our customers and develop relevant services.

6.2 Based on your consent, we may store and access information on your device to create a personalised content profile and deliver relevant content about Elva's services, as well as to measure the effectiveness of our communications. Your personal data may also be processed to develop and improve our website and platform.

6.3 We use analytics tools to collect and analyse information about how users interact with our website and platform. These tools may use cookies and similar technologies to gather data such as pages visited, session duration, and general usage patterns. The information collected is used to improve our services and enhance user experience. For further details on the cookies and tracking technologies we use, please refer to section 11 (Cookies) of this policy.

6.4 We may also process your personal data for specific purposes where you have provided your consent to such processing.

7. Sharing your data

7.1 We may share your personal data with the following categories of recipients:

[checkmark]

Immigration authorities and governmental bodies.

[checkmark]

[checkmark]

Housing agencies and landlords.

[checkmark]

[checkmark]

Tax advisers and coordinators.

[checkmark]

[checkmark]

Banking and financial service providers.

[checkmark]

[checkmark]

Destination service providers (e.g., school search, language training providers).

[checkmark]

[checkmark]

IT and platform sub-processors (for hosting, analytics, and support services).

[checkmark]

[checkmark]

Professional advisers (legal, financial, and relocation services).

[checkmark]

[checkmark]

Legal authorities, where required by law or to prevent fraud.

[checkmark]

[checkmark]

Acquirers or successors in the event of a merger, acquisition, or reorganisation.

[checkmark]

7.2 We may also share your personal data within our corporate family of companies that are related by common ownership or control, where necessary for the purposes set out in this Privacy Policy.

8. International data transfers

8.1 The personal data we collect is primarily processed by us within the European Union (EU) / European Economic Area (EEA) and in third-party data processing facilities within the EU/EEA.

8.2 Your data may be transferred to and stored in countries outside your region, including countries outside the European Economic Area (EEA). Given the cross-border nature of our relocation and immigration services, transfers to multiple non-EEA countries are likely. Where we transfer your personal data outside the EEA, we ensure that such transfers are subject to appropriate safeguards, such as: (i) transfers to countries that the European Commission has determined provide an adequate level of data protection; or (ii) Standard Contractual Clauses (SCCs) approved by the European Commission. A copy of the relevant safeguards can be obtained by contacting us at privacy@withelva.com.

8.3 Where Standard Contractual Clauses are used, we implement any necessary technical, organisational, or contractual supplementary measures to ensure that personal data transferred outside the EEA has the same level of protection as within the EU/EEA.

9. Data security

9.1 We take appropriate technical, physical, electronic, and procedural measures to protect your personal data from loss, destruction, unauthorised access, disclosure, or other misuse, in compliance with applicable legal requirements. We limit access to personal data to those authorised employees and service providers who need to know the information in the course of their duties. They will only process your personal data based on our instructions and are subject to a duty of confidentiality. We regularly test our systems to ensure they remain secure.

9.2 Personal data is stored in an encrypted database. Data is always encrypted at rest. Our databases are not directly accessible from the public internet and can only be reached via privileged application servers. Our application servers, database servers, and other infrastructure are located in a highly secured environment to prevent direct access from the outside world.

9.3 Although we make every effort to store your data in a secure operating environment, no data transmission or storage is 100% risk free. You provide your personal data at your own risk and we cannot guarantee the absolute security of your data. In the event of a security breach that endangers your privacy or personal data, we will inform you and the relevant supervisory authorities as required by law. We may also temporarily shut down services to protect personal data where necessary.

9.4 In case of a personal data breach, we will notify both the relevant supervisory authority and affected individuals where required by applicable law.

10. Data retention

10.1 Different categories of personal data are retained for different periods depending on the purpose for which they were collected and applicable legal requirements. We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Indicative retention periods are as follows:

[checkmark]

Account information: for the duration of your account plus 2 years;

[checkmark]

[checkmark]

Relocation case files and immigration documents: depending on the material for up to six (6) years from closure of the case, to comply with applicable immigration and employment law (including the Finnish Aliens Act (ulkomaalaislaki), which requires retention of foreign employee records for two (2) years from the end of the employment relationship) and the Finnish Accounting Act (kirjanpitolaki), which requires retention of accounting vouchers and related correspondence for a minimum of six (6) years and up to ten (10) years;

[checkmark]

[checkmark]

Financial records: six (6) years and up to ten (10) years in accordance with Finnish accounting Act;

[checkmark]

[checkmark]

Marketing communications: until consent is withdrawn or 2 years after last interaction;

[checkmark]

[checkmark]

Security and log data: Retained for a period of up to 2 years from the date of recording, or for as long as necessary to establish, exercise or defend legal claims, and in any event no longer than 10 years from the relevant event;

[checkmark]

[checkmark]

Agreement and contract records: up to three (3) years after the end of the customer relationship retained solely for the purpose of establishing, exercising or defending legal claims retained for as long as necessary for that purpose and in any event no longer than 10 years from the relevant contractual event, in accordance with the absolute limitation period under the Finnish Limitation Act (Laki velan vanhentumisesta 728/2003); and

[checkmark]

[checkmark]

Following termination of your employer's agreement with us, we will delete or anonymise your personal data within two (2) years from the date of termination, in line with the limitation period for wage claims under Finnish law, subject to longer retention periods required by applicable law. When your data is no longer needed, we will securely delete or anonymise it.

[checkmark]

11. Cookies

11.1 We use cookies and similar tracking technologies ('Cookies') to automatically collect information about your visit, including browser type and IP address. Information collected is detailed in our cookie consent banner. You can accept or refuse cookies through the cookie consent banner on our website. We use the following types of cookies: (i) Strictly necessary cookies: required for the platform to function; no consent is required; (ii) Analytical cookies: help us understand how users interact with our platform (Google Analytics, provided by Google: _ga and _ga_DGC1C46MCY, stored for up to 13 months); (iii) Marketing/tracking cookies: used to deliver relevant content (we do not currently use marketing cookies). We obtain your consent before placing non-essential cookies, through our cookie consent banner. You can withdraw consent at any time by adjusting your cookie preferences (Cookies Settings, at the bottom of every page).

11.2 The retention period for each cookie varies by type. Retention times for each cookie are set out in section 11.1 above and in our cookie consent banner.

11.3 You can also disable cookies or clear your cookie history for all visited websites from your browser settings at any time.

11.4 For a full list of cookies we use, including their purpose, provider, and duration, please see section 11.1 above and our cookie consent banner (Cookies Settings, at the bottom of every page). Please note that if you refuse or disable cookies, some aspects of our website or platform may not work on your device, and you may not be able to access all areas thereof.

12. Your rights

12.1 Under applicable data protection law, including the GDPR, you have the following rights in relation to your personal data:

[checkmark]

Right of access: to request a copy of the personal data we hold about you.

[checkmark]

[checkmark]

Right to rectification: to request correction of inaccurate or incomplete personal data.

[checkmark]

[checkmark]

Right to erasure: to request deletion of your personal data in certain circumstances.

[checkmark]

[checkmark]

Right to restriction of processing: to request that we restrict processing of your personal data in certain circumstances.

[checkmark]

[checkmark]

Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.

[checkmark]

[checkmark]

Right to object: to object to processing based on legitimate interests or for direct marketing purposes. The right to object to direct marketing is absolute.

[checkmark]

[checkmark]

Right to Give and Withdraw Consent: You have the right to give your consent to processing and to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. You may withdraw consent by contacting us at privacy@withelva.com or, for marketing communications, by using the unsubscribe link in any email.

[checkmark]

12.2 To exercise any of these rights, please contact us at: privacy@withelva.com. We will respond to your request without undue delay and in any event within one (1) month of receipt.

12.3 You have the right to lodge a complaint with the competent data protection supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto): PO Box 800, FI-00531 Helsinki; tietosuoja@om.fi; +358 29 566 6700; www.tietosuoja.fi. You may also lodge a complaint with the supervisory authority in your country of habitual residence or workplace.

13. Children's data

13.1 Our services are not generally intended for children under the age of 16. We do not knowingly collect personal data from children under 16, except where such data is provided to us by a parent, legal guardian, or the Client in connection with our employee relocation and immigration services for accompanying family members of an assignee. In such cases, we process the child's personal data solely for the purposes of providing the relevant relocation and immigration services, and only with the consent of the child's parent or legal guardian. If you believe we have inadvertently collected data from a child under 16 outside of the circumstances described above, please contact us immediately at privacy@withelva.com. Upon notification, we will take prompt steps to delete such data from our records.

14. Policy changes

14.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Significant changes will be communicated to you through our website or by email. The date of the most recent update is always indicated at the top of this policy. We encourage you to review this policy periodically.

15. Contact / Data Protection Officer

15.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

[checkmark]

Data Protection Officer: Mengyang Chen, Data Protection Officer, Elva Technologies Oy, Kampinkuja 2 C 7007, 00100 Helsinki, Finland. Email: mengyang@withelva.com.

[checkmark]

[checkmark]

Privacy Enquiries: privacy@withelva.com

[checkmark]

[checkmark]

Phone: +358 40 670 9464

[checkmark]

[checkmark]

Elva Technologies Oy, business ID: 3566463-2

[checkmark]

[checkmark]

Address: Kampinkuja 2 C 7007, 00100 Helsinki, Finland

[checkmark]

16. Do you have to provide your personal data?

Certain personal data is required by law or is necessary for the performance of our services. For example, providing identity documents and personal particulars is required by immigration law for visa and permit processing. If you do not provide this data, we may be unable to deliver the relevant services. Where provision of data is optional (e.g., for certain supplementary services), we will make this clear at the time of collection.

17. Automated decision-making

We do not make decisions about you based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you.

18. Where we obtain your personal data

We may receive your personal data from your employer or the company that has engaged our services (the "Client"), rather than directly from you. In such cases, the source of your personal data is your employer or the engaging entity. We may also collect personal data directly from you through the platform when you create an account, upload documents, or interact with our services. Where we receive your personal data from a third party, we will provide you with this Privacy Policy at the time of our first communication with you.

19. Changes to how we use your data

If we intend to process your personal data for a purpose other than that for which it was originally collected, we will provide you with prior notice of that new purpose before any such processing commences and, where required, seek your consent or confirm that a new legal basis applies.