1. Controller
GBC Networks Oy (Business ID 1733371-7)
Vänrikinkuja 2, 02600 Espoo, Finland
Privacy matters: tietosuoja@gbc.fi
Switchboard: +358 9 3478 3600
2. Our role in processing personal data
GBC acts as the controller for data about visitors to this website, people who contact us, and the contact persons at our customer and supplier companies.
When we provide a voice service to a customer, we act as a processor: the customer company is the controller of, for example, call data, recordings and transcripts, and we process that data on their behalf under our service agreement and a data processing agreement.
3. What we process, why, and on what legal basis
| Group | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | IP address and its domain name (reverse DNS), browser and device data, pages viewed and time spent on them, referring page | Running the site, security, measuring visitor numbers and separating automated traffic (bots) from visitors | Legitimate interest (operation, security and our own visitor measurement); consent for analytics |
| Visiting companies | Company name, domain, industry, size range, city, visit dates, pages read and an estimate of interest. No IP addresses. | Following which companies are interested in our services, and notifying our sales team of an interested company | Legitimate interest; consent for Leadfeeder company identification |
| People who contact us | Name, email, phone number, company, message content, email conversations, notes on calls and agreed meetings | Responding to enquiries, arranging meetings and preparing quotes | Steps prior to a contract, and legitimate interest |
| Customer contacts | Name, role, work email and phone, billing details | Managing the customer relationship, support, invoicing and service messages | Contract and legal obligation (accounting) |
| Service users | Username, phone number, group membership, sign-in logs | Delivering the service and preventing misuse | Contract; processed on the customer's behalf |
| Call data | Numbers, time, duration, routing and, where enabled, recordings and transcripts | Delivering the voice service, billing, fault investigation and the customer’s own reporting | Contract; for recordings, the basis determined by the customer |
| Form submissions | Name, company, email, phone number, service of interest, number of users, message content | Replying to the enquiry and preparing a quote | Consent and steps prior to a contract |
| AI-assisted reply drafts | Content of the enquiry and email conversation, and notes on calls and meetings | Drafting replies for our staff and improving the drafts with anonymised data | Legitimate interest (replying to enquiries quickly and consistently) |
| Marketing recipients (company contact persons) | Name, job title, work email and phone, company and business ID, source of the data, messages sent, and whether the recipient opened the price calculator, what they calculated, requested a quote or replied | Telling companies about our services by email (B2B direct marketing) and contacting those who are interested | Legitimate interest (business-to-business marketing related to the recipient’s work) |
| Price calculator users | Calculator selections (number of users, network, add-ons, estimated price) and visit data; for visitors arriving from an email link, linked to the recipient | Showing the price estimate and preparing a quote | Legitimate interest and steps prior to a contract |
| Marketing opt-out list | Email address or company domain, time and method of the opt-out | Making sure no marketing is sent to those who have opted out | Legal obligation and legitimate interest (honouring the opt-out) |
Use of AI. We use AI in accordance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), whose transparency obligations have applied since 2 August 2026. AI is used only as an aid: a person reviews and approves everything we send, and AI makes no decisions about you. None of our uses fall within the Act’s high-risk categories.
Assi, our AI assistant. When you contact us through the form or by email, our AI assistant Assi drafts a reply to your message. Our staff review every draft and approve, edit or reject it before it is sent. Assi makes no decisions about you, and nothing is sent without human approval. Messages from Assi are signed as coming from an AI assistant. Drafts are produced with Google Cloud's Vertex AI service, and processing takes place in the EU (Frankfurt). Under our agreement, Google does not use the data to train its own AI models.
To improve the drafts, we store a training example from each reply we send: the content of the enquiry, Assi’s draft and the final reply. Names, contact details and other identifiers are removed when the example is stored, and the example has no link to the original conversation. The company name may appear in examples. Assi is given examples as a model when writing new drafts. No AI model is trained on your data.
Marketing messages. Drafts of marketing emails may be written with the help of AI. Our staff review and approve every message before it is sent and are responsible for its content. If a message is written in the name of our AI assistant, the message says so.
Website visitors and visiting companies. Our own visitor measurement stores nothing on your device. The server records the IP address, browser details and pages viewed in a visit log kept for 30 days. The log lets us separate automated traffic and visits shorter than five seconds from visitor numbers. If you have consented to Leadfeeder, the company it identifies may be linked to your visit. If the IP address belongs to a company’s own address block, we also identify the company from the public RIPE address registry. Based on the visit, we estimate the company’s interest in our services (for example service pages read and use of the price calculator), and our sales team is notified of an interested company. The estimate does not lead to automated decisions. Only company-level information is kept in a permanent summary: which company or domain visited, on which days and which pages it read. Home broadband operators are not included, and the summary contains no IP addresses.
Business-to-business marketing. We send email only to company contact persons and only in connection with their work, never to consumers. Every message states the sender, where the recipient’s details were obtained, and a link that stops further messages with one click. You can also opt out using the contact form or by emailing tietosuoja@gbc.fi. An address that has opted out is added to our opt-out list, and no marketing is sent to it even if the address is later obtained again from another source.
Call recording is a feature each customer enables for themselves. The customer using it is responsible for informing the parties to a call that it is being recorded and for having a proper legal basis for doing so.
4. Where the data comes from
- From you, when you contact us or use the service.
- From the customer company, when it creates user accounts in the service.
- Automatically, from technical use of the service and the website.
- From public sources: the Finnish Patent and Registration Office’s open company data (company name, business ID, address and website) and companies’ own websites (contact details the company has published itself).
- From the Vainu company information service (companies and their contact persons).
- From our own customer and contact register, based on earlier contact.
5. Disclosures and processors
We do not sell personal data and we do not disclose it for marketing purposes. The following service providers process data on our behalf under data processing agreements:
- data centre and cloud providers hosting the service
- Google Cloud EMEA Limited (Google Cloud, Firebase and Google Workspace): the website, storage of enquiries and conversations, email, and AI-assisted reply drafts; data is stored and processed in the EU (Frankfurt)
- operator partners whose networks carry the voice traffic
- software vendors we use for support, invoicing and communication
- Google Ireland Limited for website analytics and advertising, if you have consented to it
- Dealfront Group GmbH (Leadfeeder) for identifying visiting companies, if you have consented to it
- Microsoft Ireland Operations Limited for measuring website advertising, if you have given your consent
Data may also be disclosed to authorities where the law requires it.
6. Transfers outside the EU and EEA
Our voice services and the associated data processing take place within the EU or EEA. Website enquiries, email conversations and AI-assisted processing are stored and processed in Google Cloud's Frankfurt region. Where an individual supporting function requires a transfer outside that area, it is made using the European Commission's standard contractual clauses or another safeguard permitted by the GDPR.
7. Retention periods
- Enquiries, email conversations and quotes: 12 months from the last contact, unless a customer relationship follows. After that, name, email address, phone number and IP and browser data are deleted, and identifying details are removed from message content.
- Assi training examples: personal data is removed when they are stored. The anonymised material is kept indefinitely to improve reply drafts.
- Customer data: for the duration of the relationship and afterwards for as long as needed for liabilities or claims.
- Invoicing and accounting records: for the periods required by the Finnish Accounting Act.
- Call data: for as long as delivering and billing the service requires.
- Recordings and transcripts: for the retention period agreed with the customer.
- Log data: typically 6–12 months, for security purposes.
- Website visit log (IP address and pages viewed): 30 days, after which the entries are deleted automatically.
- Visiting-company summary and monthly visitor numbers: contain no IP addresses or personal data and are kept indefinitely.
- Marketing recipients: as long as the data is up to date and relevant to the recipient’s work. We review the register at least once a year and delete outdated data.
- Opt-out list: for as long as we carry out marketing, so that the opt-out can be honoured.
Once the retention period ends, data is deleted or anonymised.
8. Your rights
You have the right to:
- find out whether we process personal data about you, and obtain a copy of it
- have inaccurate data corrected
- ask for your data to be erased, where there is no longer a basis for processing it
- ask us to restrict processing, and to object to processing based on legitimate interest
- receive the data you provided in a portable format, where processing is based on consent or a contract
- withdraw your consent at any time, for example for analytics
- object to direct marketing at any time and free of charge: using the unsubscribe link in a message, the contact form, or by email
Send requests by email to tietosuoja@gbc.fi. We respond within one month. We may ask you to verify your identity before acting on a request.
If your request concerns data we process on a customer's behalf, we will pass it to that customer company, which is the controller of that data.
9. Security
Traffic to the website and the service is encrypted. Voice traffic can be secured with TLS and SRTP. Access to our systems is limited to named individuals on the basis of their role and is monitored through logging. Our staff are bound by confidentiality obligations.
10. Cookies
Our website uses cookies. Analytics cookies are only enabled with your consent. See our cookie policy for details.
11. Changes to this notice
We update this notice as our services or the law change. The version in force is always the one on this page, and the date appears at the top.
12. Right to lodge a complaint
If you believe we are not processing your personal data lawfully, you may lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman, tietosuoja.fi. We would appreciate the chance to address it with you first.