Privacy at Imaction —
Your trust matters to us

Imaction aims to process as little personal data as possible. We collect only the information necessary to provide our services.

Find the privacy information relevant to you:

I’m participating in a training session
— how my information is processed in connection with training

I use this website
— privacy, cookies, and digital environmental responsibility

I need detailed information
— Imaction’s full Privacy Notice

Trust is an essential part of our training services.

Imaction processes personal data in connection with inquiries, client and partner relationships, proposals, assignments, the planning and delivery of training, billing, and service development.

Data minimization is the foundation of our approach to privacy.

Imaction processes only the personal data necessary for a defined purpose. Therefore:

we do not use cookies on our website for advertising or user profiling
in pre-training surveys, we intentionally do not collect the participant’s name, email address, or other information that could identify the participant.

Contents of this page

Privacy at Imaction — Your trust matters to us

Privacy Notice

Updated: October 18, 2026

This is Imaction’s full Privacy Notice. It is supplemented by shorter privacy pages tailored to specific groups:

1. Data controller and contact information

Imaction
Business ID 1388371-1
Kivivuorentie 12 B 16
FI-01620 Vantaa
Finland

Privacy contact: Jari Vuorenmaa
Email: jari.vuorenmaa@imaction.fi
Phone: +358 (0)40 503 0117

Imaction acts as the data controller when it determines the purposes and means of processing personal data.

For some client assignments, Imaction may process participant data on behalf of the client organization as a data processor. Where necessary, such processing is agreed separately with the client organization.

Questions about privacy and requests concerning data subject rights should preferably be submitted by email.

Imaction has not appointed a separate Data Protection Officer.

2. Whose personal data do we process?

This Privacy Notice may apply, for example, to:

contact persons of current and prospective clients
individuals submitting requests for proposals or other inquiries
individuals commissioning training and those responsible for training arrangements
training participants
partners and their contact persons
respondents to pre-training and feedback surveys
participants in behavioral and personality assessments.

The same person may belong to more than one group.

3. What information do we process and where do we obtain it?

Imaction may process, for example:

name and organization
job responsibilities, job title, or role
email address and phone number
postal and billing address
an organization’s Business ID and other company information related to orders
proposal, order, and contract information
training and development needs described by the client
information related to assignments and their practical arrangements
relevant matters agreed in meetings, phone calls, and email communications
written transcripts of Microsoft Teams remote training sessions and summaries created from them
client feedback
agreed follow-up actions.

Information may be obtained:

from the individual
from the organization represented by the individual
from the client organization commissioning the training
from requests for proposals, orders, and contracts
during the client or partner relationship
where applicable, from public sources such as the website of the organization represented by the individual.

As a general rule, Imaction does not make audio recordings of client phone calls. However, information agreed during a phone call that is necessary for the client relationship or assignment may be documented.

Emails may be retained for as long as they are needed in connection with an inquiry, client relationship, assignment, legal obligation, or potential legal claim.

4. For what purposes and on what legal bases do we process personal data?

Information may be used, for example, to:

respond to inquiries
understand client needs
prepare proposals
manage contracts and orders
plan and deliver assignments and training
compile key points and agreed follow-up actions from remote training sessions and prepare participant summaries
communicate with participants and manage practical arrangements
manage client and partner relationships
handle billing and accounting
develop the quality and effectiveness of services
maintain information security
establish, exercise, or defend legal claims.

Imaction does not conduct direct marketing or sell personal data.

Legal bases for processing personal data

Contract or steps taken prior to entering into a contract

Personal data may be processed, for example, to respond to a request for a proposal, enter into a contract, and provide the ordered service.

Legal obligation

Personal data is processed, for example, to fulfill accounting, taxation, and other legal obligations.

Imaction’s legitimate interests

Processing may be based on legitimate interests, for example, in managing client or partner relationships, communicating with contact persons, carrying out an agreed assignment, developing services, maintaining information security, and handling legal claims.

When processing is based on legitimate interests, Imaction takes into account the necessity of the processing as well as the rights, interests, and reasonable expectations of the data subject.

Consent

In some situations, processing may be based on freely given consent. Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Financial administration and billing

Imaction’s accounting and other primary financial administration are managed using software controlled by the company.

Billing is handled electronically through Nordea Business.

Financial administration may involve processing information such as:

company information about clients and suppliers
contact information
billing addresses and other billing information
payment and transaction information
information related to contracts and assignments
accounting records.

Billing and accounting records are retained for the period required by applicable law.

6. Information about training participants

The client organization may provide Imaction with the following information about participants, for example, in order to organize the training:

names
email addresses
job titles
organization or business unit information
other information necessary for the practical delivery of the training.

As a general rule, we ask only for participants’ names and email addresses. The information is used only to the extent necessary for participant communications, organizing the training, and delivering the agreed service.

Providing the contact information required to organize the training is necessary, for example, for participant communications and practical arrangements. Responding to pre-training surveys and personal assessments, however, is voluntary.

If Imaction receives a participant’s information from the client organization rather than directly from the participant, the participant will be provided with information about the processing of personal data no later than when Imaction sends its first training-related communication to the participant.

7. Pre-training surveys and Microsoft 365 Copilot

Imaction may use Microsoft Forms pre-training surveys to help plan training. The surveys are used to better understand the participant group’s work, work-related challenges, learning needs, and goals so that the content and areas of emphasis of the training can be planned accordingly.

The surveys are intentionally designed not to collect the respondent’s name, email address, phone number, or other information that could identify the respondent.

Participants are asked not to include the following in their responses:

unnecessary personal data
other people’s names or other identifying information
health information or other sensitive personal data
trade secrets
other confidential information that is unnecessary for planning the training.

If a response nevertheless contains information that makes it possible to identify an individual, that information will be treated as personal data.

Responding to the pre-training survey is voluntary. Choosing not to respond does not prevent you from participating in the training.

Pre-training survey responses are accessed only by the trainer responsible for the training in question.

Responses may be processed in Microsoft Excel and analyzed using Microsoft 365 Copilot. The material may be used to create a non-identifying group-level summary in Microsoft Word or PowerPoint for use in planning and delivering the training.

Microsoft 365 Copilot is used to assist with organizing and analyzing the material. The trainer reviews the results and is responsible for how they are used.

Imaction does not use pre-training surveys or Microsoft 365 Copilot to evaluate individual participants’ job performance, personality, or suitability, or to facilitate employment-related decisions about participants.

Retention of pre-training surveys

Original Microsoft Forms pre-training survey responses are normally retained for no more than one year after the training has been delivered.

If the same client organization receives recurring training sessions that are identical or related to one another, group-level summary material created from the surveys may be retained for the duration of the active training engagement if the material is still needed for planning, developing, or comparing the training sessions.

Original open-ended responses are deleted after the one-year retention period, even if the group-level summary is retained for a longer period.

8. Remote training via Microsoft Teams

Imaction may deliver remote training sessions as Microsoft Teams meetings.

Remote training sessions are not audio- or video-recorded. However, the Teams transcription feature may be used to create a written transcript of participants’ spoken contributions. Participants are informed at the beginning of the training session when transcription and Microsoft 365 Copilot will be used. A participant may decline the use of transcription. If a participant declines, Imaction will not use transcription during that training session.

Imaction may use Microsoft 365 Copilot with the transcript to organize the key points and any potential follow-up actions from the training and to prepare a written summary.

The trainer always reviews a summary produced by Copilot before it is used or shared. The summary may be shared only with participants in the training session.

The Teams meeting transcript is retained in Imaction’s Microsoft 365 environment only for as long as it is needed to prepare the training summary or carry out agreed follow-up actions. After that, the transcript is deleted.

Imaction does not use the meeting transcript or Microsoft 365 Copilot to evaluate individual participants’ job performance, personality, emotions, attitudes, or suitability, or to make employment-related decisions about participants.

9. Training feedback

Imaction may collect numerical ratings and written feedback about training sessions in order to evaluate and improve their quality, usefulness, and effectiveness.

Feedback surveys are intentionally designed not to collect the respondent’s name, email address, or other information that could identify the respondent.

Feedback may be used to:

evaluate the quality of training
develop content and methods
evaluate client-specific training programs
improve the effectiveness of training
compare results over the long term.

Numerical ratings and written feedback from which an individual cannot reasonably be identified may be retained indefinitely.

If open-ended feedback contains information that makes it possible to identify an individual, the information will be treated as personal data. Such information will be deleted or anonymized when there is no longer a basis for retaining it.

10. Behavioral and personality assessments

When specifically commissioned by the client organization, Imaction may use Everything DiSC and WorkPlace Big Five Profile assessments to support learning, self-awareness, and discussions during training.

Completing an assessment is voluntary. Choosing not to complete an assessment does not prevent you from participating in Imaction’s training.

Participants review and accept the assessment service’s terms of use and privacy terms when using the service.

The personal assessment report is provided to the participant, who decides how the report is used. Imaction’s trainer may process the report only to the extent necessary to plan and deliver the training.

Imaction does not provide the personal assessment report to the client organization, the participant’s manager, or HR.

Imaction does not use assessment results for automated or other employment-related decisions.

Everything DiSC

Wiley, the publisher of Everything DiSC, states that learner data for the service is hosted in AWS cloud services in Northern Virginia, United States, and states that it is certified under the EU-US Data Privacy Framework.

The service may process information such as the participant’s name, email address, assessment responses, and the resulting personal report.

Participants may request deletion of their assessment data or report by contacting Imaction.

WorkPlace Big Five Profile

According to the Data Processing Addendum of Paradigm Personality Labs LLC, the service customer acts as the data controller and Paradigm as the data processor. Paradigm processes personal data in accordance with documented instructions.

The service may process information such as the participant’s name, email address, basic work-related information, assessment responses, and the resulting personal report.

According to Paradigm’s DPA, personal data is retained for the period required by the service agreement and in accordance with applicable law. When the agreement ends, Paradigm returns or deletes data that is no longer needed to provide the service, unless retention is required by law.

Participants may request deletion of their data by contacting Imaction.

For transfers of personal data from the European Economic Area to a third country that has not been recognized as providing an adequate level of data protection, Paradigm’s DPA applies the EU Standard Contractual Clauses, Module Two: Controller to Processor.

11. Other use of artificial intelligence

In addition to the use of Microsoft 365 Copilot described above, Imaction may use artificial intelligence to support the preparation and delivery of training, the organization of materials, and service development.

As a general rule, confidential client information or personal data is not entered into AI services without an appropriate legal basis for processing and adequate privacy and information security safeguards.

AI-generated content is always reviewed by the trainer before it is used in client work.

Imaction does not use AI to automatically evaluate participants’ emotions, attitudes, motivation, or job performance, or to make employment-related decisions about participants.

12. Service providers used in the processing of personal data

Microsoft 365 and Microsoft 365 Copilot
Apple and iCloud+
Nordea Business
Wiley / Everything DiSC
Paradigm Strategy Inc. / WorkPlace Big Five Profile.

Imaction does not sell personal data. Imaction may disclose personal data to an authority or another party when the disclosure is based on law, an order from a competent authority, or the establishment, exercise, or defense of legal claims.

Apple devices and cloud services

Imaction uses a Mac computer and other Apple devices in its work. Microsoft 365 applications are used on these devices.

Biometric authentication is enabled on Apple devices used by Imaction.

Client and training materials may be stored and backed up in cloud-based and local storage environments used by Imaction.

13. Transfers of personal data outside the EEA

Some of Imaction’s service providers or their subprocessors may process personal data outside the European Economic Area.

Such transfers are based on a transfer mechanism permitted under applicable data protection law, such as:

a European Commission adequacy decision
the EU-US Data Privacy Framework where the US recipient is appropriately certified
Standard Contractual Clauses approved by the European Commission
another transfer mechanism permitted by the GDPR.

Wiley states that it is certified under the EU-US Data Privacy Framework. According to Wiley, learner data for the Everything DiSC service is stored in the United States.

According to Paradigm’s DPA, transfers of personal data from the EEA to a third country that has not been recognized as providing an adequate level of data protection are subject to the EU Standard Contractual Clauses (Module Two: Controller to Processor).

More information about the safeguards applicable to a particular service can be requested from Imaction.

14. Retention periods

Imaction retains personal data only for as long as necessary for the purpose for which it is used, or for as long as required by law, contractual obligations, or potential legal claims.

Retention periods by category

Client and contact information: for the duration of the client relationship and afterward for as long as there is a justified need to retain it.
Proposals, contracts, and assignments: for as long as required by contractual obligations, applicable law, and potential legal claims.
Billing and accounting records: for the period required by applicable law.
Participant information: for as long as needed to organize the training and carry out agreed follow-up actions.
Original pre-training survey responses: normally for no more than one year after the training has been delivered.
Non-identifying group-level summaries of pre-training surveys: may be retained, where necessary, for the duration of an active training engagement relating to the same topic to support training planning, development and comparison.
Microsoft Teams transcripts: for as long as they are needed to prepare the training summary or carry out agreed follow-up actions, after which they are deleted.
Training feedback from which individuals cannot be identified: indefinitely, to support quality evaluation, service development, and long-term comparison.
Everything DiSC material: in accordance with the service provider’s applicable retention practices. Participants may request deletion of their data through Imaction.
WorkPlace Big Five Profile material: for the period required by the service agreement and in accordance with applicable law. Participants may request deletion of their data through Imaction.

15. Information security

Imaction protects personal data using technical, organizational, and physical measures appropriate to the nature of the data and the risks associated with the processing.

Key information security measures

Information security measures used by Imaction include:

individual user accounts and strong passwords
multi-factor authentication for the Microsoft 365 account
biometric authentication on Apple devices
restricting access to the business owner only
use of a Microsoft 365 Business Premium business environment
use of Microsoft 365 Copilot with Imaction’s work account
storing materials in Microsoft 365 services controlled by Imaction and on a computer protected by biometric authentication
local backups to physical storage media controlled by Imaction
cloud-based data storage and backups in iCloud+ and Microsoft 365 environments
protection of devices, operating systems, software, and network connections
keeping operating systems and software security updates up to date
minimizing the collection of personal data
deleting personal data that is no longer needed
secure destruction of paper records
documenting and handling personal data breaches.

16. Website, cookies, and Plausible Analytics

Imaction’s website does not use cookies for tracking or advertising profiling.

The Imaction.fi website is hosted by Hostingpalvelu.fi. According to Hostingpalvelu.fi, its web hosting services are located in Finland.

The website uses the functional pll_language cookie. The Polylang plugin used for the website’s multilingual functionality uses this cookie to save the visitor’s language preference.

Imaction uses Plausible Analytics to collect website visitor statistics.

Plausible Analytics and website visitor data

Plausible Analytics is used to understand general trends in website use and visitor statistics.

According to Plausible’s own data policy, it does not use analytics cookies, browser local storage, or persistent visitor identifiers, and does not track visitors across different websites, devices, or days.

The following information may be processed to generate statistics, for example:

the page visited
traffic source and campaign information
browser
operating system
device type
approximate country, region, and city
page views and metrics describing website use.

According to Plausible, raw IP addresses and User-Agent information are not stored. The technical identifier used to count daily visitors changes daily.

According to Plausible, visitor data is processed and stored in the EU and does not leave the EU.

Plausible states that visitor data is not used for advertising, profiling, or commercialization and that analytics data is not sold.

Imaction does not use Plausible’s additional features, such as custom events, custom properties, or revenue tracking.

If services that change the use of cookies or the processing of personal data are introduced on the website in the future, Imaction will update its privacy information and request user consent where required.

17. Data subject rights

Depending on the processing situation and the legal basis for processing your personal data, you may have the right to:

receive information about how your personal data is processed
access the personal data concerning you
request correction of inaccurate personal data
request deletion of your personal data
request restriction of processing
object to the processing of your personal data
request data portability when the requirements of the GDPR are met
withdraw your consent when processing is based on consent.

Not all rights apply in every processing situation.

A request for deletion may not be fulfilled to the extent that the information must still be retained because of a legal obligation, contractual obligation, or legal claim.

Exercising your rights

You can exercise your rights by contacting:

Jari Vuorenmaa
Imaction
Email: jari.vuorenmaa@imaction.fi
Phone: +358 40 503 0117
Kivivuorentie 12 B 16
FI-01620 Vantaa
Finland

Imaction may request additional information to verify your identity.

Imaction will respond to requests without undue delay and, as a general rule, within one month. Requests are generally handled free of charge.

Right to lodge a complaint

If you believe that your personal data is being processed in violation of data protection law, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman.

You may contact Imaction before lodging a complaint, but doing so does not restrict your right to contact the supervisory authority.

18. Personal data breaches and updates to this Privacy Notice

If Imaction becomes aware of a personal data breach, Imaction will assess its impact and take the necessary measures.

If the breach is likely to result in a risk to individuals’ rights and freedoms, Imaction will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Data subjects will be informed of a breach when required by applicable data protection law.

Imaction documents personal data breaches, their effects, and the corrective measures taken.

Imaction updates this Privacy Notice when its processing of personal data, the services it uses, or applicable requirements change.

The current version is published on Imaction’s website.

Changes to this Privacy Notice do not in themselves change the purposes or legal bases for processing personal data collected previously. If personal data is to be used for a materially new purpose, data subjects will be provided with information about that purpose before the new processing begins.

Privacy at Imaction — Your trust matters to us