Privacy Policy

In brief

People tell us things they don’t tell everyone, so our work depends on trust. That includes how we handle personal data.

We only process the data we need to deliver our services, manage customer relationships, communicate and recruit.
We report the results of coaching programmes and assessments to client organisations at group level by default. We share individual-level data only if this has been agreed and you have been told in advance.
We do not sell personal data or disclose it for marketing purposes.
Artificial intelligence supports our work, but it does not make decisions about people.
You can ask about your data, or request that it be corrected or deleted, at any time by writing to lifted@lifted.fi.

Who is responsible for your data

The controller is Lifted Oy (Business ID 2603736-2), Sofiankatu 4 C, 00170 Helsinki, Finland.

Send questions and requests about data protection to lifted@lifted.fi. Our Information Security Officer handles these messages.

What data we process and why

We only process the data that each purpose requires.

Whose data?	What data?	Why?	Legal basis	How long?
Contact persons at clients and prospective clients	Name, title, organisation, contact details, and information about our communications and proposals	Managing the customer relationship, sales and performing contracts	Contract, or our legitimate interest in managing the customer relationship and telling you about our services	For the duration of the customer relationship, and afterwards for as long as there is a justified reason to stay in contact. Billing data for the period required by law.
Participants in coaching programmes and assessments	Name, contact details, organisation and role, survey responses, assessment results, and information needed to deliver the coaching	Delivering coaching, assessment and development services to the client organisation	Contract with the client organisation, or our legitimate interest in delivering the agreed service. Consent, where processing is based on it.	For the period agreed with the client organisation after the programme ends
Newsletter subscribers and event registrants	Name, contact details, organisation, interests, and newsletter open and click data	Newsletters, events, webinars and other communications	Consent, or our legitimate interest in communicating about our activities	Until you unsubscribe or object to the communications
Website visitors	Data collected through cookies and similar technologies, such as IP address, browser, device and how you move around the site	Running and improving the website, information security and marketing	Strictly necessary cookies: legitimate interest. Other cookies: consent.	For the period set for each cookie; see the cookie settings
Job applicants	Basic details, contact details, education, work experience, skills and other information in the application	Recruitment, including for suitable future positions	Steps taken at the applicant’s request before entering into a contract	24 months from the end of the recruitment process

Job applicants must provide the information in their application so that we can process it. In all other cases, providing data is voluntary, but without it we may not be able to provide the service.

Where we get the data

We mostly get the data from you. We may also get data from:

your employer or another client organisation, such as participant lists and contact person details
other respondents, when you take part in an assessment where your colleagues give you feedback (e.g. a 360-degree assessment)
public sources, such as company websites and the Trade Register
contact data updating services and business information services
our website, through cookies and similar technologies

Coaching and assessments

Coaching and assessments involve confidential information, such as assessment results and feedback. This is how we handle it:

Group level is the default. We report results to the client organisation in a way that no individual respondent can be identified.
Individual-level data only by agreement. If individual-level data is shared with the client organisation, this is agreed in advance, and you are told what data will be shared and with whom.
Personal conversations stay confidential. We do not pass on the content of coaching conversations without your permission.
We do not ask for health information.

In these services we act either as a controller or as a processor on behalf of the client organisation. We agree the roles with each client. When we act as a processor, the client organisation is the controller, and its privacy notice gives more detail about the processing.

Who we disclose data to

We do not sell personal data. Only the following may process it:

Our coaches, who process data on Lifted’s behalf and are bound by confidentiality.
Our service providers, such as providers of IT systems, communications, survey, assessment and AI services. They process data only on our behalf and according to our instructions.
The client organisation, which receives the results of coaching and assessments to the extent described above.
Authorities, when required by law.

Some of our service providers may process data outside the EU or the EEA. In those cases, we make sure the transfer has a valid basis under the GDPR, such as the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

Artificial intelligence

We use AI tools to support our work, but only services that do not use the data entered into them to train AI models. A person always reviews AI-generated content and is responsible for it. We do not make automated decisions about individuals, and we do not use automated profiling.

Cookies

Cookies are small text files that are stored in your browser when you visit our website. We use them for four purposes:

Strictly necessary cookies keep the website working.
Preference cookies remember your choices, such as language or location.
Analytics cookies help us understand how the website is used so we can improve it.
Marketing cookies make it possible to target content and advertising.

Some cookies are set by third parties, such as our social media, advertising and analytics partners. We use preference, analytics and marketing cookies only with your consent. You can change your choices at any time in the cookie settings or in your browser settings.

How we protect your data

Only employees and coaches who need personal data for their work have access to it. Our staff and coaches are bound by confidentiality and by Lifted’s information security and data protection guidelines. We protect data with technical and organisational measures, such as access management, strong authentication and encryption.

Your rights

You have the right to:

find out what data we process about you and get a copy of it
request that inaccurate data be corrected
request that your data be deleted or its processing restricted
object to the processing of your data, particularly for direct marketing
transfer the data you have provided to another system, where processing is based on consent or a contract
withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Send your request to lifted@lifted.fi. We will reply within one month at the latest. If we process your data on behalf of a client organisation, you can also send your request to that organisation.

If you think we are processing your data unlawfully, we hope you will contact us first so we can look into it. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi/en).

Changes

We update this privacy policy when our operations or the law change. The current version is always available on this page.

Last updated 28 October 2026.