Privacy Policy

Last updated: 14 August 2026

Spoken Oy respects your privacy and processes personal data carefully, transparently and in accordance with applicable data protection legislation.

This Privacy Policy explains how we process personal data in connection with our website, customer relationships, marketing and other business activities.

1. Data Controller

Spoken Oy
Business ID 2628663-3
Viipurinkatu 12 L 285
00510 Helsinki
Finland

Email: asiakaspalvelu@spoken.fi
Telephone: +358 50 339 2407

Contact person for data protection matters:
Jukka Ihatsu, CEO
jukka.ihatsu@spoken.fi
+358 50 359 8330

2. When is Spoken a controller and when is Spoken a processor?

Spoken acts as a data controller when processing, for example, contact information relating to customers and prospective customers, website user data, billing information and personal data used for marketing purposes.

Materials submitted to us by our customers for transcription, subtitling, translation or other language services may contain personal data. In relation to such personal data, the customer is normally the data controller and Spoken acts as a data processor on the customer’s behalf.

In these situations, we process personal data only in accordance with the customer’s instructions, the agreed service and any applicable data processing agreement. This Privacy Policy does not replace the customer’s own privacy notice or a customer-specific data processing agreement.

3. What personal data do we process?

We may process, for example:

  • name and contact details, such as email address and telephone number

  • organisation, job title and other information relating to a professional role

  • customer account and user account information

  • information relating to requests for quotation, orders, contracts and customer service

  • billing and payment information

  • communications with us

  • marketing permissions, objections and information relating to marketing communications

  • technical and cookie-related information generated through the use of our website

  • application and CV information submitted to us in connection with recruitment.

Project materials submitted by customers may also contain audio, video, names, conversations or other personal data and, depending on the content, special categories of personal data. Where Spoken acts as a data processor, such information is processed only for the purpose of carrying out the customer’s assignment and in accordance with the customer’s instructions.

4. Why do we process personal data and on what legal basis?

Providing services and managing customer relationships

We process personal data to respond to enquiries and requests for quotation, fulfil orders, administer user accounts, provide customer service, invoice customers and manage customer relationships.

Processing is based on the performance of a contract, steps taken prior to entering into a contract and, where applicable, Spoken’s legitimate interest in managing customer relationships.

Compliance with legal obligations

We process information for purposes such as accounting, taxation and compliance with other statutory obligations.

The legal basis for this processing is compliance with a legal obligation.

Security and development of our services

We may process information that is necessary for ensuring the operation and security of our services, preventing misuse and developing our services.

This processing is based on our legitimate interest in maintaining secure and functional services.

Marketing and customer communications

We may use contact information to communicate about our services, news and other matters relevant to customers and prospective customers.

Processing is based on consent where consent is required and, in other applicable situations, on Spoken’s legitimate interest in carrying out appropriate B2B marketing.

You may object to marketing communications at any time.

Website analytics and marketing measurement

We use cookies and similar technologies to understand how our website is used and to measure the effectiveness of our marketing.

Cookies and tracking technologies that are not necessary for the operation of the website are used in accordance with the user’s cookie choices.

5. Where do we obtain personal data?

We primarily obtain personal data:

  • directly from the individual

  • from the organisation represented by the individual

  • from a customer in connection with an assignment

  • through the use of our website and services

  • where applicable, from publicly available business and contact information sources.

6. Who receives personal data?

We do not sell personal data.

We use trusted service providers that may process personal data on our behalf. These may include:

  • website hosting providers

  • cloud and storage service providers

  • customer and user management systems

  • email and communications providers

  • analytics and marketing service providers

  • accounting and invoicing service providers

  • employees, freelancers and other subcontractors involved in providing our services.

Service providers may process personal data only to the extent necessary to perform their tasks and in accordance with applicable data protection legislation.

We may also disclose information to public authorities where required by law or by a lawful request from an authority.

7. Transfers of personal data outside the EU and EEA

We aim to process customer project materials primarily within the European Union or European Economic Area, or in another location permitted under applicable data protection legislation.

Some of our technical service providers may process personal data outside the EU or EEA.

Where personal data is transferred outside the EU or EEA, we ensure that there is a lawful basis and appropriate safeguards for the transfer. These may include an adequacy decision adopted by the European Commission or the European Commission’s Standard Contractual Clauses together with any necessary supplementary safeguards.

8. Security of customer project materials

Confidential handling of customer materials is an essential part of our service.

Customer projects are managed through Spoken’s own Spoken TOOL system. Project materials are stored in the Google Cloud environment within the EU.

Access to project materials is restricted to persons who require access in order to carry out the assignment or manage the project. System users authenticate using individual user credentials, and persons involved in providing our services are subject to confidentiality obligations.

Materials relating to transcription services are processed within Spoken’s controlled environment and are not transferred to external cloud-based AI or language technology services.

For subtitling and translation services, we may use trusted third-party technical services where appropriate for providing the service. In such cases, we require the materials to be processed only for the purpose of providing the service and in accordance with applicable data protection legislation.

Customer materials are not used to train third-party AI models or other third-party systems.

Where necessary, we can agree with customers on project-specific data protection and information security requirements.

9. How long do we retain personal data?

We retain personal data only for as long as necessary for the purposes for which it is processed or as required by law.

Customer project materials are deleted from our systems no later than three months after the individual material has been completed, unless a different retention period has been agreed with the customer.

Customer, contractual and billing information is retained for the duration of the customer relationship and thereafter for as long as necessary to comply with statutory obligations, establish or defend legal claims, or meet other justified requirements.

Accounting records are retained for the periods required under Finnish law.

Personal data used for marketing purposes is retained for as long as it remains relevant for that purpose or until the individual objects to the use of their personal data for marketing or withdraws their consent.

10. Cookies

Our website uses cookies and similar technologies.

Cookies necessary for the operation of the website may be used where they are required to provide a service requested by the user.

Cookies relating to analytics, marketing measurement and advertising are used in accordance with the user’s cookie choices.

Cookie preferences can be changed through the cookie settings available on our website.

Where a user consents to marketing-related tracking, we may use measurement and audience features provided by advertising platforms to measure the effectiveness of our marketing. This may involve the processing of website usage information and, where applicable, identifiers based on contact information.

11. Automated decision-making and artificial intelligence

We do not use personal data for solely automated decision-making that produces legal effects concerning an individual or similarly significantly affects an individual.

We may use artificial intelligence and automated speech recognition as part of the production of our language services in accordance with our service-specific practices. The use of AI for purposes such as speech recognition does not constitute automated decision-making about individuals.

12. Your rights

Depending on the legal basis for the processing and the circumstances, you may have the right to:

  • receive information about the processing of your personal data

  • access personal data relating to you

  • request correction of inaccurate or incomplete information

  • request deletion of personal data

  • request restriction of processing

  • object to the processing of your personal data

  • receive certain personal data in a portable format

  • withdraw your consent at any time.

Not all rights apply in all circumstances.

If you wish to exercise your rights, please contact our contact person for data protection matters.

If you believe that your personal data has been processed in breach of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

13. Information security

We protect personal data using appropriate technical and organisational measures, taking into account the nature of the data and the risks associated with its processing.

Our safeguards include measures such as access restrictions, user authentication, confidentiality obligations and controlled information systems designed to protect personal data against unauthorised access, alteration, loss or disclosure.

Any personal data breaches are handled in accordance with applicable data protection legislation and reported to the relevant authorities and affected individuals where required by law.

14. Changes to this Privacy Policy

We may update this Privacy Policy when our operations, the services we use or applicable legislation change.

The current version will be published on our website and the date of the latest update will be shown at the top of this page.

Send request