01Who we are and what this policy covers
Zeal Sourcing Oy (Business ID 3128001-7, Helsinki, Finland; “Zeal”, “we”) is a procurement consulting firm serving business clients. This policy explains how we process personal data when we act as the data controller: data about visitors to our website, business contacts at current and prospective clients and partners, job applicants, and the contact details of client and supplier personnel that we handle in our own administration.
When we deliver consulting services, our clients’ data — which may include personal data such as supplier contact details — is processed on the client’s behalf and under their instructions. For that data the client is the controller and Zeal is a processor, and the processing is governed by the data processing agreement (DPA) in our client contracts, not by this policy. Questions about that data should be directed to the relevant client; we will assist them in responding.
02What we process, why, and on what legal basis
We collect personal data directly from you, from your employer in connection with a client relationship, or from public business sources. We do not collect more than we need, and we do not use your data for automated decision-making that produces legal or similarly significant effects.
| Purpose | Data | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Delivering our services & managing client relationships | Contact details of client personnel (name, role, email, phone), correspondence, contract and invoicing details | Performance of a contract; legitimate interest (managing B2B relationships) | Duration of the relationship + up to 3 years; invoicing records 6 years per Finnish accounting law |
| Sales & marketing to businesses | Business contact details of prospective clients, meeting notes, newsletter subscriptions | Legitimate interest (B2B marketing); consent for email newsletters | Until objection or withdrawal of consent; prospect data reviewed every 2 years |
| Website operation & analytics | IP address, device and browser information, usage data via cookies | Legitimate interest (essential operation); consent (analytics cookies) | Per cookie lifetimes stated in the cookie banner |
| Recruitment | Applications, CVs and related communication | Legitimate interest / pre-contractual measures | Deleted within 12 months of the process ending, unless you consent to longer |
| Legal obligations | Accounting records, data needed to establish or defend legal claims | Legal obligation; legitimate interest | As required by law (e.g. Accounting Act) |
03AI-assisted processing
We use AI tools to support our work, for example to draft documents and to process and route business correspondence in our internal workflows. Where these tools handle personal data, the following applies:
- AI processing of our business data takes place on enterprise services under data processing agreements, with processing located in the EU (currently Microsoft Azure, Sweden) or under appropriate transfer safeguards.
- Our AI service providers do not use our data to train their models.
- AI tools support our work; decisions affecting you are made by people. We do not use AI to evaluate, score or profile individuals.
04Who receives your data
We do not sell personal data, and we do not disclose it to third parties for their own marketing. We share personal data only with service providers that process it on our behalf under data processing agreements, and with authorities where the law requires. Our main processor categories are:
- IT and cloud services: Microsoft (Microsoft 365, Azure), Cloudflare, Amazon Web Services (email delivery)
- AI services: Anthropic / Microsoft Azure AI services (as described in Section 3)
- Financial administration: our accounting and payment service providers
- Website analytics providers, only with your cookie consent
05International transfers
We store and process personal data primarily within the EU/EEA. Two exceptions apply:
- Some of our service providers may process data outside the EU/EEA. Where this happens, the transfer is protected by an EU adequacy decision (including the EU–US Data Privacy Framework where applicable) or the European Commission’s Standard Contractual Clauses.
- Zeal’s group operations include Singapore, and personal data may be accessed from there for legitimate business administration. These transfers are protected by Standard Contractual Clauses within the group, and Singapore-side processing additionally complies with the Singapore PDPA.
06How we protect your data
We protect personal data with technical and organisational measures defined in our Information Security & AI Policy, including encryption in transit and at rest, enforced multi-factor authentication, least-privilege access, EU data residency for client data, and annual staff security training. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform you without undue delay, as required by the GDPR.
07Your rights
Under the GDPR you have the right to access your personal data; to have inaccurate data corrected; to have your data deleted; to restrict or object to processing (including objecting to direct marketing at any time, which we will always honour); to withdraw consent at any time; and to receive data you have provided to us in a structured, commonly used format.
To exercise your rights, contact us at info@zealsourcing.fi. We will verify your identity in a proportionate way — usually by responding to the email address we hold for you — and ask for further proof only where necessary. We respond within one month.
If you consider that our processing does not comply with data protection law, you may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.
08Cookies
Our website uses essential cookies needed for the site to function, and — only with your consent given through the cookie banner — analytics cookies that help us understand how the site is used. You can withdraw or change your consent at any time through the cookie settings on the site. Details of the cookies used and their lifetimes are listed in the cookie banner.
09Changes and contact
We may update this policy from time to time. The current version is always available on our website, and we will highlight significant changes there. This policy was last updated in June 2026.