Privacy notice

1. Who is responsible for your data

The controller is Oy Sumu Logistics Ltd (Business ID 3566076-2), Ahotie 12 B, 02940 Espoo, Finland. For any question about this notice or your personal data, write to chartering@sumulogistics.com.

2. What data we collect

• Contact form: your name, email address and the message you send.
• Email and phone: your name, contact details, the content of our correspondence, and your company and role if you share them.
• Business relationships: contact details of people at clients, shipowners, operators, charterers and other partners we work with, and the information needed to carry out and document that work.

We collect this data from you directly, or from your employer or from public business sources when we work with your company.

3. Why we use it, and on what legal basis

• To answer your enquiry and discuss a possible assignment: our legitimate interest in responding to people who contact us, or steps you have asked for before entering into a contract (GDPR Article 6(1)(f) and (b)).
• To carry out and manage our services and business relationships: performance of a contract, or our legitimate interest in running our business (Article 6(1)(b) and (f)).
• To meet legal obligations, such as bookkeeping and tax rules (Article 6(1)(c)).

We do not use your data for automated decision-making or profiling, and we do not sell it. Providing data is voluntary, but without contact details we cannot reply to you.

4. Who we share it with

We use trusted service providers who process data on our behalf, under data processing agreements: our website hosting and form service (Netlify, Inc.) and our email and IT service providers. We may also share data with counterparties in a transaction when needed to carry out your assignment, and with authorities when the law requires it.

5. Transfers outside the EU

Some of our service providers are based in, or use subcontractors in, the United States. Where data is transferred outside the European Economic Area, we rely on the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep it

• Enquiries that do not lead to an assignment: up to 24 months after our last contact.
• Client and business relationship data: for the duration of the relationship and as long as needed afterwards to handle possible claims.
• Accounting records: as required by the Finnish Accounting Act, generally 6 to 10 years.

7. Your rights

You have the right to access your data, have it corrected or erased, restrict or object to its use, and receive it in a portable format where the GDPR provides for this. To use these rights, contact us at the address above. We will reply within one month.

If you believe we handle your data unlawfully, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

8. Cookies

This website does not use cookies, analytics or tracking tools.

9. Security

We protect personal data with access controls, encrypted connections and by limiting access to the people who need it for their work.

10. Changes

We may update this notice. The latest version is always on this page, with the date it was last updated.