Skanska CDF Oy privacy notice

1. General

Skanska CDF develops, builds and manages properties for the future of work in Finland and the rest of the Nordic countries.

In this Privacy Notice, we describe how we process your personal data when you work with us in connection with Skanska CDF’s commercial development projects in Finland. The data subjects include, for example, Skanska's contractual partners and their employees, as well as any other persons working with us in connection with Skanska's development projects.

The main purpose of the processing of personal data is to ensure that our commercial development projects and other operations are carried out in accordance with legislation, contractual obligations and other guidelines applicable to Skanska CDF’s business operations.

2. Data Controller

The data controller for the processing of personal data described in this Privacy Notice is Skanska CDF Oy ("Skanska" or "we") for its own commercial development projects and other applications.

3. From which sources we collect your personal data

We mainly collect the data directly from you or from your employer when you interact with us. Personal data is also collected from the public tax number register and other registers and information services, such as the Trade Register, Asiakastieto Oy, VastuuGroup Oy and other similar data sources commonly used in the construction sector.

4. What data do we process

The information we process about you ultimately depends on the business relationship between us. When you do business with us, we typically process the following information about you:

name, contact details (telephone number, email), and other identifying information
the entity you represent, as well as your position and job title within that entity
areas of interest (information related to the search for business premises)
newsletter and/or publication subscription details, as well as information related to your responses to these and other communications

photographs, videos, audio recordings (e.g. in connection with CCTV surveillance)
cookies generated during website visits, as well as IP address and information related to the use of our website. More information about cookies is available on our website
data related to sanctions and PEP (Politically Exposed Person) checks
other information you have provided yourself

5. What are the purpose and legal grounds for processing of personal data

Just as the scope of the personal data we process, the respective legal bases also depend on the details of our business relationship. However, in Skanska's operations, the processing of personal data is usually based on one of the following four legal bases:

Skanska’s legal obligations

The processing of personal data is necessary for Skanska to comply with its legal obligations. These legal obligations relate in particular to statutory obligations concerning commercial agreements, accounting legislation, and other laws and regulations binding on Skanska.

Skanska’s contractual obligations in case we have entered into a contract directly with you.

Legitimate interests of Skanska or a third party, to the extent that Skanska's contractual partner is your employer or another party (e.g. the client of a construction project). Depending on the situation, Skanska and/or a third party may have a legitimate interest to e.g.:

managing corporate customer relationships, construction sites and other assignments with Skanska’s contractual partners
ensuring the safety of our construction sites and premises (e.g. through CCTV surveillance)
complying with the applicable Code of Conduct of the Skanska Group and addressing potential misconduct
developing our business operations as well as the technical and other solutions we use and provide
marketing our services to our various stakeholders

Consent. In certain situations, the processing of your personal data may be based on your consent.

6. To whom do we disclose your data

We may disclose your personal data as required and permitted by applicable law:

To other companies within the Skanska Group. Skanska Group companies may process your personal data for the purposes set out in this Privacy Notice;
To subcontractors acting on behalf of Skanska who process personal data on behalf of us on the basis of an assignment given by us. The processors referred to herein include, but are not limited to, IT service providers, contractors, suppliers and parties performing marketing activities on our behalf;
In connection with legal proceedings, at the request of an authority or by applicable law or by order of a court in connection with a court proceeding or governmental process. On the basis of a court decision, personal data (e.g. access control data from a construction site) may be disclosed, for example, to parties of a civil or criminal proceeding. We may also disclose information to competent authorities, such as the police, tax administration and similar parties;

Where required and/or permitted by law;
Based on your consent we may disclose information on the completion of Skanska's online courses to various databases commonly used in the construction industry, such as Valtti+ and other services and platforms

As a general principle, personal data is not transferred outside the European Union or the European Economic Area (EU/EEA). In certain situations, however, service providers or other processors involved in the processing of personal data may be located outside the EU/EEA.

Personal data may be transferred to third countries in accordance with applicable data protection legislation and subject to appropriate safeguards. Such safeguards include, among others, standard contractual clauses adopted by the European Commission, adequacy decisions, and other transfer mechanisms permitted under applicable data protection laws.

7. How long do we store your personal data

We only store personal data for as long as is necessary for the purposes specified in this Privacy Notice, unless otherwise required by law. Any unnecessary data is deleted at intervals in accordance with Skanska's data storage standard.

Data processed on the basis of a contractual relationship is processed for the duration of the contractual relationship or for as long as required for the performance of the contract. After the termination of the contractual relationship, personal data is stored for as long as necessary, for example, for unfinished business, invoicing, complaints or Skanska's contractual liability periods.

Data processed on the basis of legal obligations is processed for as long as required by law.
Data processed on the basis of legitimate interest will be processed for as long as the basis for processing exists.
The storage period of the data processed with your consent is determined by the purpose of the processing.

8. Your rights

In accordance with current data protection legislation, you have the rights specified below. We process your personal data to the extent necessary to exercise your rights.

Right of access to your data

You have the right to obtain confirmation from the controller whether your personal data is being processed or not. If your personal data is being processed, you have the right of access to the personal data we process about you. We may refuse to provide information if there is a legal basis for doing so.

Right to rectification, erasure or restriction of processing

You have the right to request us to rectify any incorrect information about you. In addition, you can request us to delete some information about you or request the restriction of processing on legal grounds.

Right to object to the processing of your data

You have the right to object processing on grounds relating to your particular personal situation, provided that we are processing your personal data on the basis of legitimate interest. You can submit your objection request to us by contacting tietosuoja[at]skanska.fi. You must specify the specific situation on the basis of which you object to the processing. Skanska has the right to refuse your request if the processing is necessary for the purposes of Skanska's or a third party's legitimate interests.

Right to withdraw your consent

You have the right to withdraw your consent to the processing of your personal data to the extent that the processing is based on your consent.

Right to data portability

To the extent that we process your data on the basis of a contract and the processing is carried out by automated means, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and the right to transmit such data to another data controller.

Right to lodge a complaint before a competent supervisory authority

If you consider that the processing of your personal data has not complied with the requirements of the applicable data protection legislation, you can always contact Skanska. You can also refer your case to the supervisory authority. In Finland, the supervisory authority responsible for data protection matters is the Data Protection Ombudsman (TSV).

9. Contact information

If you would like to know more about how we process your personal data at Skanska, or if you would like to exercise your rights as a data subject, please contact us as follows:

Jere Sundqvist
P.O. Box 114, 00101 HELSINKI
Nauvontie 18, 00280 HELSINKI
tietosuoja[at]skanska.fi

10. Changes and updates to this privacy notice

We regularly review our practices related to the processing of personal data. We may make changes to this Privacy Notice from time to time. The up-to-date version is available on Skanska's website.

Last updated: 9 June 2026