Projects and Corporate Clients Privacy Notice

1. General

In this privacy notice, we describe how we process your personal data when you work with us in connection with Skanska's projects. The data subjects include, for example, Skanska's contractual partners and their employees, as well as any other persons working on Skanska's projects and construction sites, as well as partners who are not in an employment relationship with the controller.

The main purpose of the processing of personal data is to ensure that the operations of the projects and construction sites for which Skanska is responsible are in accordance with legislation, contractual obligations and other guidelines, as well as safe and fair for everyone. We also process your personal data in order to be able to sell and market our services and to develop our business and the customer experience of our customers.

2. Data Controller

The data controller for the processing of personal data described in this Privacy Notice is Skanska Oy and each subsidiary, as well as Skanska CDF Oy ("Skanska" or "we") for its own projects, construction sites and other applications.

Skanska Oy's subsidiaries are Skanska Talonrakennus Oy, Skanska Infra Oy and Skanska Rakennuskone Oy.

3. From which sources we collect your personal data

We mainly collect the data directly from you when you do business with us, for example, at our construction site or other project, or when you interact with us in other similar ways.

Personal data is also collected from the public tax number register and other registers and information services, such as the Trade Register, Asiakastieto Oy, VastuuGroup Oy and other similar data sources commonly used in the construction sector.

4. What data do we process

The information we process about you ultimately depends on the business relationship between us. When you do business with us, we typically process the following information about you:

(a) Identification and contact info

name, phone number, and email address
personal identity code
address information
tax number
date of birth
nationality
project-specific username and password information

(b) Qualifications and certificates

job title and duties
information regarding completed training, orientation and job-specific qualifications

(c) Remuneration and right to work

salary information or salary payment criteria
the duties and type of employment relationship, as well as orientation and qualification information
other information related to salary or right to work

(d) Additional info regarding foreign workers

passport information
information related to the grounds for the right to work
the posted worker's certificate, the name, telephone number and address of
the representative of the foreign company in Finland
other information required by law from time to time

(e) Information on the financial status of a corporate customer

information on the contractual partner's solvency and other financial status during the contractual relationship

(f) Access control logs, photos and video surveillance footage

personal data that may be processed in connection with access control and camera surveillance of Skanska's premises and projects, such as photos and video footage, and access control timestamps

(g) Website cookies

technical information collected through cookies used on Skanska’s websites. You can read more about our website's cookie policy in the cookies section of Skanska's website.

(h) Other data processed on a case-by-case basis

customer feedback
complaints and claims
information on sanctions and PEP inspections

5. What are the purpose and legal grounds for processing of personal data

The main purpose of the processing of personal data is to ensure that all operations on the projects and construction sites for which Skanska is responsible are carried out in accordance with legislation, our contractual obligations and other guidelines, and that the conditions are safe and fair for everyone.

Just as the scope of the personal data we process, the respective legal bases also depend on the details of our business relationship. However, in Skanska's operations, the processing of personal data is usually based on one of the following four legal bases:

Skanska’s legal obligations. Skanska has an obligation directly derived from the law to e.g.:

know our customers and all individuals working on our projects
ensure occupational safety and contractor's liability obligations as well as compliance with sanctions and export control regulations
comply with other laws and regulations that are binding on Skanska and that are related to our business operations

Skanska’s contractual obligations in case we have entered into a contract directly with you.

Legitimate interests of Skanska or a third party, to the extent that Skanska's contractual partner is your employer or another party (e.g. the client of a construction project). Skanska and/or a third party may, depending on the situation, have a legitimate interest, for example, to:

manage corporate customer relationships, construction sites, and other assignments with Skanska’s contractual partners
monitor the safety of our construction sites and premises (e.g., camera surveillance)
supervise working conditions, proper pay, and other labor rights, address misconduct, and help ensure that all of Skanska’s contractual partners and other collaborators operating on our sites act ethically and comply with the applicable labor, social, and other relevant legislation in force in Finland with respect to their own employees and their own contractual and/or business partners
develop our business as well as the technical and other solutions we use and offer; and
market our services

Consent. In certain situations, the processing of your personal data may be based on your consent.

6. To whom do we disclose your data

We may disclose your personal data as required and permitted by applicable law:

To other companies within the Skanska Group. Skanska Group companies may process your personal data for the purposes set out in this Privacy Notice;
To subcontractors acting on behalf of Skanska who process personal data on behalf of us on the basis of an assignment given by us. The processors referred to herein include, but are not limited to, IT service providers, contractors, suppliers and parties performing marketing activities on our behalf;
In connection with legal proceedings, at the request of an authority or by applicable law or by order of a court in connection with a court proceeding or governmental process. On the basis of a court decision, personal data (e.g. access control data from a construction site) may be disclosed, for example, to parties of a civil or criminal proceeding. We may also disclose information to competent authorities, such as the police, tax administration and similar parties;

Where required and/or permited by law;
Based on your consent we may disclose information on the completion of Skanska's online courses to various databases commonly used in the construction industry, such as Valtti+ and other services and platforms

As a general principle, personal data is not transferred outside the European Union or the European Economic Area (EU/EEA). In certain situations, however, service providers or other processors involved in the processing of personal data may be located outside the EU/EEA.

Personal data may be transferred to third countries in accordance with applicable data protection legislation and subject to appropriate safeguards. Such safeguards include, among others, standard contractual clauses adopted by the European Commission, adequacy decisions, and other transfer mechanisms permitted under applicable data protection laws.

7. How long do we store your personal data

We only store personal data for as long as is necessary for the purposes specified in this Privacy Notice, unless otherwise required by law. Any unnecessary data is deleted at intervals in accordance with Skanska's data storage standard.

Data processed on the basis of a contractual relationship is processed for the duration of the contractual relationship or for as long as required for the performance of the contract. After the termination of the contractual relationship, personal data is stored for as long as necessary, for example, for unfinished business, invoicing, complaints or Skanska's contractual liability periods.

Data processed on the basis of legal obligations is processed for as long as required by law.
Data processed on the basis of legitimate interest will be processed for as long as the basis for processing exists.
The storage period of the data processed with your consent is determined by the purpose of the processing.

8. Your rights

In accordance with current data protection legislation, you have the rights specified below. We process your personal data to the extent necessary to exercise your rights.

Right of access to your data

You have the right to obtain confirmation from the controller whether your personal data is being processed or not. If your personal data is being processed, you have the right of access to the personal data we process about you. We may refuse to provide information if there is a legal basis for doing so.

Right to rectification, erasure or restriction of processing

You have the right to request us to rectify any incorrect information about you. In addition, you can request us to delete some information about you or request the restriction of processing on legal grounds.

Right to object to the processing of your data

You have the right to object processing on grounds relating to your particular personal situation, provided that we are processing your personal data on the basis of legitimate interest. You can submit your objection request to us by contacting tietosuoja[at]skanska.fi. You must specify the specific situation on the basis of which you object to the processing. Skanska has the right to refuse your request if the processing is necessary for the purposes of Skanska's or a third party's legitimate interests.

Right to withdraw your consent

You have the right to withdraw your consent to the processing of your personal data to the extent that the processing is based on your consent.

Right to data portability

To the extent that we process your data on the basis of a contract and the processing is carried out by automated means, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and the right to transmit such data to another data controller.

Right to lodge a complaint before a competent supervisory authority

If you consider that the processing of your personal data has not complied with the requirements of the applicable data protection legislation, you can always contact Skanska. You can also refer your case to the supervisory authority. In Finland, the supervisory authority responsible for data protection matters is the Data Protection Ombudsman (TSV).

9. Contact information

If you would like to know more about how we process your personal data at Skanska, or if you would like to exercise your rights as a data subject, please contact us as follows:

Jere Sundqvist
P.O. Box 114, 00101 HELSINKI
Nauvontie 18, 00280 HELSINKI
tietosuoja[at]skanska.fi

10. Changes and updates to this privacy notice

We regularly review our practices related to the processing of personal data. We may make changes to this Privacy Notice from time to time. The up-to-date version is available on Skanska's website.

Last updated: 9 June 2026