Privacy Notice for Employees, Vapaus
Updated 25.2.2026
1. Introduction
Your employer has partnered with Vapaus Bikes Finland Oy ("Vapaus") to offer you a employee bike benefit. As part of delivering this benefit, Vapaus will process certain personal data about you.
This Privacy Notice explains who we are, what personal data we collect about you, why we process it, how long we keep it and what rights you have. This Notice is issued in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, Regulation 2016/679).
If you have any questions about how we handle your personal data, please contact us at molla@vapaus.io
2. Who We Are
Vapaus Bikes Finland Oy is a Finnish company providing employee bike benefit services to employers across Finland.
Company name: Vapaus Bikes Finland Oy
Business ID: 2879502-8
Address: Lapinlahdenkatu 16, 00180 Helsinki, Finland
Data protection contact:
DPO molla@vapaus.io
Website: www.vapaus.io
In providing the employee bike benefit to your employer, Vapaus acts as a data processor on behalf of your employer, who is the data controller in respect of your personal data. This means that your employer has instructed Vapaus to process your personal data for the purposes described in this Notice.
3. How We Obtained Your Personal Data
Your personal data was provided to us by your employer as part of the arrangement for your employee bike benefit. Your employer disclosed your work contact details to us so that we could contact you directly about the benefit, assist you with the ordering process and keep you informed about the service.
4. What Personal Data We Process
We process only the personal data that is necessary to deliver the employee bike benefit service to you. This includes:
Category and Examples
-
Identity data: First name and surname
-
Contact data: Work email address
-
Employer data: Name of your employer
-
Order data: Selected bike model, order status, lease agreement details
-
Communication preferences: Whether you have opted out of communications from Vapaus
We do not process your personal email address, home address, phone number or any special categories of personal data (such as health data or financial data) unless you provide these to us voluntarily in the course of using the service.
5. Why We Process Your Personal Data
We process your personal data for the following purposes, on the instruction of your employer:
Purpose and Description
-
Onboarding: To contact you about your employee bike benefit, explain how the benefit works and guide you through the ordering process
- Order fulfilment: To process your bike order and manage your lease agreement
Service communications: To send you relevant updates, reminders, user guides and seasonal campaigns relating to your benefit -
Legal compliance: To fulfil our obligations under applicable data protection legislation, including informing you of our processing activities under Article 14 of the GDPR.
We will not use your personal data for any other purpose, such as general marketing, profiling or selling your data to third parties.
6. Legal Basis for Processing
As Vapaus acts as a data processor on behalf of your employer, the legal basis for the processing of your personal data is determined by your employer as the data controller. Your employer's legal basis for disclosing your personal data to Vapaus is typically one of the following:
• Performance of an employment contract (Article 6(1)(b) of the GDPR): the processing is necessary to provide you with a contractual employee benefit; or
• Legitimate interests (Article 6(1)(f) of the GDPR): it is in the legitimate interests of your employer and Vapaus to contact you in connection with a benefit that has been made available to you.
If you would like further information about the legal basis relied upon by your employer, please contact our data protection contact.
7. How Long We Keep Your Data
We retain your personal data only for as long as is necessary for the purposes set out in this Notice:
Situation and Retention period
-
While your benefit is active: For the duration of your lease agreement and the Service Agreement between your employer and Vapaus
-
After your benefit ends or your employment terminates: Deleted or anonymised within 30 days of notification from your employer or from you
-
If you opt out of communications: Your data will be deleted or suppressed within 30 days of your opt-out request, except where retention is required by law
-
Legal obligations: Where applicable law requires us to retain certain data for a longer period, we will do so only to the extent required
8. Who We Share Your Data With
We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients, solely for the purpose of delivering the service:
Recipient and Purpose
-
Sub-processors: Service providers that assist us in delivering the benefit, cloud hosting providers and CRM systems (see Annex 1 of our Data Processing Agreement for the full list, available at Data Processor Agreement)
-
Your employer: We may share information about your order status or opt-out preferences with your employer where this is necessary to administer the benefit
-
Supervisory authorities: Where we are required to do so by law
All sub-processors are contractually bound to process your data only on our instructions and to implement appropriate security measures.
9. International Transfers
Where possible, we process your personal data within the European Economic Area (EEA). Where we use sub-processors located outside the EEA, we ensure that appropriate safeguards are in place in accordance with the GDPR, such as Standard Contractual Clauses adopted by the European Commission. Details of any third-country transfers are available on request by contacting molla@vapaus.io.
10. Your Rights
As a data subject under the GDPR, you have the following rights in relation to your personal data:
Right and What this means
-
Right of access: You can request a copy of the personal data we hold about you
-
Right to rectification: You can ask us to correct any inaccurate or incomplete data
-
Right to erasure: You can ask us to delete your personal data, subject to any legal obligations to retain it
-
Right to restriction: You can ask us to restrict the processing of your data in certain circumstances
-
Right to data portability: You can request your data in a structured, commonly used and machine-readable format
-
Right to object: You can object to the processing of your personal data at any time
-
Right to opt out of communications: Every communication we send you includes an unsubscribe link — you can opt out at any time
How to Exercise Your Rights
You may contact Vapaus directly to exercise any of the above rights:
Email: DPO molla@vapaus.io
We will respond to your request within 30 days of receipt. Where a request is complex or we receive a large number of requests, we may extend this period by a further two months, in which case we will notify you accordingly.
Where your request relates to data controlled by your employer rather than data processed by Vapaus, we will forward your request to your employer without undue delay.
11. Right to Lodge a Complaint
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Finnish data protection supervisory authority:
Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki, Finland
Website: www.tietosuoja.fi
Email: tietosuoja@om.fi
You may also lodge a complaint with the supervisory authority in the EU member state where you reside or work.
12. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our processing activities or applicable legislation. The current version is always available at https://www.vapaus.io/en/privacy-notice-for-employees. Where changes are material, we will notify you by email.