Skip to main content

PRIVACY NOTICE FREELANCERS AND STUDIOS

1. CONTROLLER

Name of the controller: Bou Oy
Business ID: 2896836-3
Address: Antinkatu 1, 00100 Helsinki, Finland
Email address: holla@bou.co

2. GENERAL

In this privacy notice, we tell you how we process data relating to freelancers and studios who create a profile or otherwise use our platform to be matched with customer assignments.


3. LEGAL BASIS AND PURPOSES OF PROCESSING

We process your personal data for the following purposes:
Account creation and management: to create your profile, manage your account, provide access to the platform, and matching with customers. Legal basis: contract.
AI-assisted matching with customer assignments: to identify potentially suitable customer assignments using AI-assisted tools. Legal basis: legitimate interest. AI assists but does not make decisions — all matching decisions are made by humans.
Communication: to communicate with you about assignments, opportunities, or updates. Legal basis: contract and legitimate interest.
Service improvement and analytics: to improve our platform, analyse usage and ensure technical functionality. Legal basis: legitimate interest.
Legal obligations: to comply with statutory requirements such as accounting or record-keeping. Legal basis: legal obligation.


4. PERSONAL DATA COLLECTED

We process the following categories of personal data when you create and maintain a freelancer and a studio profile:

  • Identification and contact data: name, email address, country or location, optional profile photo, billing information, AI scraped data from portfolio or website
  • Professional and skills data: skills, qualifications, experience, portfolio or work samples, past assignments, CV information (if provided)
  • Platform usage data: profile activity, project preferences, communication through the platform
  • AI-generated data: similarity scores or suggested matches with customer assignments (analysis of skills, experience, and assignment metadata), structured representations of your skills created by our AI tools. These are used only to assist our human staff in identifying suitable opportunities.
  • Technical data: IP address, browser and device information, log data relating to account security

We do not require or intend to process any special categories of personal data (Art. 9 GDPR, e.g. health, religion, political views). You must not upload or include such information in your profile.


5. RETENTION PERIOD OF PERSONAL DATA

We store your personal data as long as necessary for the purpose it was collected. We retain the data collected from you in your profile as long as your account is active. If your account remains inactive for an extended period, we may delete it after prior notice. You may request deletion at any time. We may however keep some data related to you even longer if required to do so by law, such as invoicing information in accordance with the Accounting Act.


6. DISCLOSE OR TRANSFER OF DATA

Processing tasks may be outsourced to the external service providers in accordance with and within the limits set by data protection legislation. Service providers (processors) include: cloud hosting and infrastructure, analytics tools, communication tools, CRM systems, accounting and administration. All service providers process personal data only on documented instructions and under GDPR-compliant data processing agreements.

Relevant parts of your profile may be shared with customers when evaluating potential assignments.


7. TRANSFER OF DATA OUTSIDE THE EU/EEA

Our service providers may be located outside the EU/EEA. Where personal data is transferred outside the EU/EEA, we ensure that an adequate level of protection is provided, for example by using European Commission adequacy decisions, or Standard Contractual Clauses (SCCs).


8. SECURITY

We apply appropriate technical and organisational measures to protect personal data, including access control, encryption, secure development processes and monitoring.


9. RIGHTS OF THE DATA SUBJECT

  • Right to access: You have the right to receive confirmation from us on whether or not we process personal data that concerns you. We provide you with a copy of the personal data being processed. As a rule, the exercise of rights is free of charge.
  • Right to rectification: You have the right to demand the rectification of inaccurate personal data concerning them and to have incomplete personal data completed.
  • Right to erasure: In certain cases, specified in Article 17 of the GDPR, you have the right to have us erase data concerning you. For example, when the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • Right to restriction of processing: In certain cases, specified in Article 18 of the GDPR, you can request us to restrict the processing of your personal data. The right to restriction exists for example, when you contest the accuracy of the personal data. In such cases, the processing will be restricted for a period enabling us to verify the accuracy of the personal data.
  • Right to object: In certain situations, you have the right to object to the processing of your personal data, that is, request us not to process it at all. If the data is processed for the performance of a task carried out for the purposes of the compelling legitimate interests pursued by us or a third party, you have the right to object to the processing on grounds relating to your particular situation. In such cases, the processing must be stopped unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.

    If the personal data is processed for direct marketing based on legitimate interest, you have the right to object at any time to the processing without any specific grounds, after which the data may no longer be processed for purposes of direct marketing (this includes profiling related to direct marketing).
  • Right to data portability: You have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format and, if desired, transmit that data to another controller.
  • Right to withdraw consent: If personal data is processed based on consent, you have the right to withdraw your consent by informing us. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to the withdrawal of consent.
  • Right to lodge a complaint with the supervisory authority: You have the right to lodge a complaint with the competent supervisory authority if you consider that we have not complied with the applicable data protection regulation. The supervisory authority in Finland is the Office of the Data Protection Ombudsman, www.tietosuoja.fi.


10. CONTACT INFORMATION AND THE USE OF DATA SUBJECT RIGHTS


In all matters relating to the processing of personal data and in situations involving the exercise of rights, you should contact us using the contact details provided at the beginning of this privacy notice.