PRIVACY NOTICE — CONTACT DATA
Pursuant to Articles 13 and 14, EU General Data Protection Regulation (GDPR)

This template is provided for convenience and is not legal advice. Review with qualified counsel before use.

Issued by:  [YOUR COMPANY NAME]
Address:    [YOUR BUSINESS ADDRESS]
Email:      [YOUR CONTACT EMAIL]
Date:       [DATE]

1. WHO WE ARE

[YOUR COMPANY NAME] is the data controller of the personal data described in this notice. This means we decide how and why your personal data is processed.

If you have any questions about this notice or how we handle your data, please contact us at [YOUR CONTACT EMAIL].

2. WHAT PERSONAL DATA WE HOLD

We hold the following personal data about you, collected from the business card you gave us:

- Your full name
- Job title
- Employer / company name
- Business email address
- Business telephone / mobile number
- Business postal address
- Website URL
- Any notes or tags we added at the point of scanning

3. WHY WE PROCESS YOUR DATA (PURPOSE)

We process your contact details for the following purpose(s):

[DESCRIBE YOUR PURPOSE, e.g. "To follow up on our conversation at [EVENT] and to maintain professional contact with a view to a potential business relationship."]

4. LEGAL BASIS FOR PROCESSING

We rely on the following lawful basis under Article 6 GDPR:

[SELECT AND COMPLETE ONE OF THE FOLLOWING:]

[ ] Legitimate interests (Article 6(1)(f)): Our legitimate interest is in maintaining and developing business relationships. We consider that this interest is not overridden by your rights and freedoms, given that: (i) the data was provided to us voluntarily in a professional context; (ii) the processing is limited to the contact details on the card you gave us; and (iii) you can withdraw at any time (see section 9).

[ ] Contract (Article 6(1)(b)): Processing is necessary for the performance of a contract with you or to take steps at your request prior to entering a contract.

[ ] Consent (Article 6(1)(a)): You gave us consent to process your data for the purpose described above. You may withdraw your consent at any time (see section 9).

5. HOW WE OBTAINED YOUR DATA

We captured your contact details by scanning the business card you gave us at [EVENT / MEETING / DATE].

We used a service called CardScan, operated by Nörtti Paikalle Oy (Finland), to extract the text from the card image. The image is processed in memory by the Anthropic API (United States) and is not stored on any server. Only the extracted text fields are retained.

6. WHO WE SHARE YOUR DATA WITH

We may share your contact details with the following recipients:

[LIST YOUR RECIPIENTS WITH THEIR LOCATION, e.g.:]
- [CRM PROVIDER NAME] ([COUNTRY]) — our customer relationship management system
- [EMAIL TOOL] ([COUNTRY]) — for follow-up correspondence
- [OTHER RECIPIENT] ([COUNTRY]) — [REASON]

We do not sell your personal data to any third party.

7. INTERNATIONAL TRANSFERS

Some of the recipients listed above may be based outside the EU/EEA. Where this is the case, we ensure that appropriate safeguards are in place:

[DESCRIBE SAFEGUARD FOR EACH TRANSFER, e.g.:]
- Nörtti Paikalle Oy (CardScan, Finland) — Finland is an EU Member State; no transfer outside the EEA.
- Anthropic, PBC (United States) — Standard Contractual Clauses pursuant to Anthropic's Data Processing Addendum.
- [OTHER RECIPIENT] — [MECHANISM]

8. HOW LONG WE KEEP YOUR DATA

We will retain your contact details for:

[DESCRIBE YOUR RETENTION PERIOD, e.g. "Up to [N] years from the date of our last contact, unless you ask us to delete your data sooner (see section 9)."]

After this period, or upon your request, your data will be deleted from our systems.

9. YOUR RIGHTS

Under the GDPR you have the right to:

- Access — request a copy of the personal data we hold about you;
- Rectification — ask us to correct any inaccurate data;
- Erasure — ask us to delete your data ("right to be forgotten");
- Restriction — ask us to restrict processing while a dispute is resolved;
- Data portability — receive your data in a machine-readable format;
- Object — object to processing based on legitimate interests or for direct marketing purposes;
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [YOUR EMAIL]. We will respond within one calendar month.

You also have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi). If you are based in another EU/EEA country, you may contact the authority in your country of residence.

10. AUTOMATED DECISION-MAKING

[SELECT ONE:]

We do not use automated decision-making or profiling in connection with your contact data.

OR

We use [DESCRIBE AUTOMATED PROCESSING] which produces [DESCRIBE EFFECT]. You have the right to request human review of any automated decision that significantly affects you.

11. CHANGES TO THIS NOTICE

We may update this notice from time to time. The most recent version will be available on request at [YOUR EMAIL].

This template is provided for convenience only and does not constitute legal advice. It should be reviewed and adapted by qualified legal counsel before use. Nörtti Paikalle Oy accepts no liability for its use.