1. Controller
GBC Networks Oy (Business ID 1733371-7)
Vänrikinkuja 2, 02600 Espoo, Finland
Privacy matters: tietosuoja@gbc.fi
Switchboard: +358 9 3478 3600
2. Our role in processing personal data
GBC acts as the controller for data about visitors to this website, people who contact us, and the contact persons at our customer and supplier companies.
When we provide a voice service to a customer, we act as a processor: the customer company is the controller of, for example, call data, recordings and transcripts, and we process that data on their behalf under our service agreement and a data processing agreement.
3. What we process, why, and on what legal basis
| Group | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | IP address, browser and device data, pages viewed, referring page | Running the site, security, and measuring visitor numbers | Legitimate interest (operation and security); consent for analytics |
| People who contact us | Name, email, phone number, company, message content | Responding to enquiries and preparing quotes | Steps prior to a contract, and legitimate interest |
| Customer contacts | Name, role, work email and phone, billing details | Managing the customer relationship, support, invoicing and service messages | Contract and legal obligation (accounting) |
| Service users | Username, phone number, group membership, sign-in logs | Delivering the service and preventing misuse | Contract; processed on the customer's behalf |
| Call data | Numbers, time, duration, routing and, where enabled, recordings and transcripts | Delivering the voice service, billing, fault investigation and the customer’s own reporting | Contract; for recordings, the basis determined by the customer |
| Form submissions | Name, company, email, phone number, service of interest, number of users, message content | Replying to the enquiry and preparing a quote | Consent and steps prior to a contract |
Call recording is a feature each customer enables for themselves. The customer using it is responsible for informing the parties to a call that it is being recorded and for having a proper legal basis for doing so.
4. Where the data comes from
- From you, when you contact us or use the service.
- From the customer company, when it creates user accounts in the service.
- Automatically, from technical use of the service and the website.
- From public sources such as the Finnish Trade Register, to verify company details.
5. Disclosures and processors
We do not sell personal data and we do not disclose it for marketing purposes. The following service providers process data on our behalf under data processing agreements:
- data centre and cloud providers hosting the service
- operator partners whose networks carry the voice traffic
- software vendors we use for support, invoicing and communication
- Google Ireland Limited for website analytics, if you have consented to it
- Dealfront Group GmbH (Leadfeeder) for identifying visiting companies, if you have consented to it
Data may also be disclosed to authorities where the law requires it.
6. Transfers outside the EU and EEA
Our voice services and the associated data processing take place within the EU or EEA. Where an individual supporting function requires a transfer outside that area, it is made using the European Commission's standard contractual clauses or another safeguard permitted by the GDPR.
7. Retention periods
- Enquiries: up to 24 months from your last contact, unless a customer relationship follows.
- Customer data: for the duration of the relationship and afterwards for as long as needed for liabilities or claims.
- Invoicing and accounting records: for the periods required by the Finnish Accounting Act.
- Call data: for as long as delivering and billing the service requires.
- Recordings and transcripts: for the retention period agreed with the customer.
- Contact form submissions: up to 24 months, unless a customer relationship follows.
- Log data: typically 6–12 months, for security purposes.
Once the retention period ends, data is deleted or anonymised.
8. Your rights
You have the right to:
- find out whether we process personal data about you, and obtain a copy of it
- have inaccurate data corrected
- ask for your data to be erased, where there is no longer a basis for processing it
- ask us to restrict processing, and to object to processing based on legitimate interest
- receive the data you provided in a portable format, where processing is based on consent or a contract
- withdraw your consent at any time, for example for analytics
Send requests by email to tietosuoja@gbc.fi. We respond within one month. We may ask you to verify your identity before acting on a request.
If your request concerns data we process on a customer's behalf, we will pass it to that customer company, which is the controller of that data.
9. Security
Traffic to the website and the service is encrypted. Voice traffic can be secured with TLS and SRTP. Access to our systems is limited to named individuals on the basis of their role and is monitored through logging. Our staff are bound by confidentiality obligations.
10. Cookies
Our website uses cookies. Analytics cookies are only enabled with your consent. See our cookie policy for details.
11. Changes to this notice
We update this notice as our services or the law change. The version in force is always the one on this page, and the date appears at the top.
12. Right to lodge a complaint
If you believe we are not processing your personal data lawfully, you may lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman, tietosuoja.fi. We would appreciate the chance to address it with you first.