Privacy Notice
Prepared on 25 August 2026. Last updated on 27 October 2026.
This is YES-EU Oy’s privacy notice on the processing of personal data on the farizon.fi website, in accordance with the EU General Data Protection Regulation (EU) 2016/679. The notice describes how YES-EU Oy processes the personal data of website visitors, people who contact us and contact persons of our customers (“data subjects”).
YES-EU Oy’s line of business is the import, sale, installation and servicing of electric buses, commercial vehicles and the equipment needed to electrify them.
1. Controller
YES-EU Oy
Address: Perintötie 8 C, 01510 Vantaa, Finland
Business ID: 3198522-8
2. Contacts regarding the processing of personal data
Contact: infosuomi@YES-EU.com
3. Purposes and legal basis of processing
The controller processes data subjects’ personal data for the following purposes:
a) Customer relationship management
Processing the data of contact persons of customers and potential customers to handle quotes, contracts, orders, deliveries and invoicing, and to maintain the customer relationship. Legal basis: contract (Art. 6(1)(b)), legal obligation, for example for accounting data (Art. 6(1)(c)), and legitimate interest (Art. 6(1)(f)).
b) Contacts and bookings made via website forms
Test drive bookings, service bookings, quote requests and contact requests. The data is processed to handle and respond to the request. Legal basis: steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b)) when the contact relates to the purchase of a product, and the controller’s legitimate interest (Art. 6(1)(f)) for communication and providing information.
c) Website chat service
Processing conversations held via the AI-assisted chat service on the site in order to provide customer service and advice and to pass contact requests on to sales. Legal basis: legitimate interest (Art. 6(1)(f)) and, for contact details, steps prior to entering into a contract (Art. 6(1)(b)). See section 11 for details.
d) Newsletter and contact list for interested parties
Visitors can leave their contact details on the site (name, email address and nearest location, and optionally company and phone number) to receive information about products, services and their availability. The data is used for providing information and making contact. Legal basis: consent (Art. 6(1)(a)). Consent can be withdrawn at any time, which does not affect the lawfulness of earlier processing.
e) Direct marketing and electronic direct marketing
Newsletters, product presentations, event invitations, marketing campaigns and prize draws. Legal basis: consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)). When the basis is consent, it can be withdrawn at any time. When the basis is legitimate interest, the data subject has the right to object at any time to the use of their data for direct marketing.
f) Technical operation of the website, information security and visitor analytics
The IP addresses of website visitors and cookies necessary for the service are processed to ensure information security and the operation of the site. Legal basis: legitimate interest (Art. 6(1)(f)). Consent is requested separately for analytics and third-party cookies. See section 12.
g) Monitoring and developing the quality of the chat service
Chat conversations and notes made on them are used to monitor the operation of the service, assess the quality of responses and develop the service. Legal basis: legitimate interest (Art. 6(1)(f)).
4. The controller’s legitimate interest
The controller has a lawful and actual legitimate interest in maintaining its relationships with customers, suppliers, stakeholders and partners in order to conduct its business, in responding to contacts received through its website, in ensuring the technical security of its website and in marketing its services. The processing is necessary to achieve the purposes mentioned in this notice, and the same objectives cannot be achieved by other means.
The data processed is mainly limited to contact details and information provided by the data subject about their vehicle needs. The scope of processing is limited. The data subject can reasonably expect that their contact will be answered and that their contact details will be used for this purpose. The data subject has the right to object at any time to the processing of their personal data on the basis of legitimate interest, and direct marketing can always be objected to unconditionally.
Personal data is not used for automated decision-making that has legal or otherwise significant effects on the data subject.
5. Personal data processed
The personal data processed includes:
- the person’s name and position in the organisation
- contact details provided by the data subject
- company name (optional on forms)
- booking and request details provided on forms: preferred time, vehicle or service, free-text message
- the content of chat conversations and background information extracted from the conversation (see section 11)
- notes made by sales on the conversation
- feedback given in the chat
- marketing consent data: the content and time of consent, IP address and browser information to verify the consent
- information on ordered services, products and changes to them, invoicing details and other information related to the customer relationship and ordered services
- information obtained through cookies, such as IP address
6. Regular sources of data
Personal data is obtained primarily from the data subjects themselves: from website forms, chat conversations, by email, by phone, through social media services, from contracts, customer meetings and other situations in which the data subject provides their data.
Data on contact persons of companies and other organisations may also be collected from public sources such as websites, directory services and other companies.
7. Regular disclosures of data, processors and transfers of data outside the EU or EEA
Data is not regularly disclosed to other parties and it is not sold. For marketing purposes, data is only passed on to the advertising services described below with the visitor’s consent.
The following processors process data on behalf of the controller:
| Processor | Role | Location | What it processes |
|---|---|---|---|
| Digitoimisto Digitaali Oy | Supplier and maintainer of the website and chat service (processor) | Finland / EU | Technical implementation and maintenance of the site and chat, server environment, visitor analytics (Matomo) and stored conversation data |
| Anthropic PBC | Provider of the AI model (Claude) (sub-processor) | United States | Receives the messages written in the chat and generates a response based on them. Does not receive the fields of the chat contact form. |
| Hetzner Online GmbH | Data centre service (sub-processor) | Finland | Server environment hosting the site and the chat database |
Appropriate data processing agreements have been concluded with the processors.
Advertising services (only with consent)
If the visitor accepts marketing cookies (section 12), information about the use of the site, such as browser identifier, IP address and the page visited, is passed on to the following advertising services for targeting advertising and measuring its results. The services also process the data for their own purposes in accordance with their own privacy notices.
- Google Ads: Google Ireland Limited, Ireland
- Meta (Facebook and Instagram): Meta Platforms Ireland Limited, Ireland
- Adform: Adform A/S, Denmark
Through Google and Meta, data may also be transferred to the United States (Google LLC, Meta Platforms, Inc.). The transfer is based on the EU–U.S. Data Privacy Framework, to which both companies have committed. Without consent, no data is passed on to advertising services.
Transfers of data outside the EU / EEA
Messages written in the chat are transferred for processing to the United States (Anthropic PBC). The safeguard for the transfer is the standard contractual clauses (SCC) approved by the European Commission, which are included in Anthropic’s Data Processing Addendum. The DPA with its standard contractual clauses is automatically incorporated into Anthropic’s commercial terms, so it applies when the service is used without a separate signature.
The service provider’s commercial terms prohibit the use of customer content for training AI models.
A copy of the safeguards applied is available from the address given in section 2.
Anthropic deletes messages and responses processed via the API from its systems within 30 days. They may be retained longer only if required by law or if Anthropic’s automated monitoring identifies a message as violating its terms of use (up to two years).
8. Principles of personal data protection
Personal data is protected by appropriate technical and organisational measures. Information systems are protected by access rights, user IDs and other appropriate security measures. Material containing personal data is stored and destroyed securely. Connections are encrypted (HTTPS).
Access to personal data is limited to employees and other authorised persons who need the data to perform their duties. The data is processed confidentially. Data processing agreements are used with external service providers where necessary. In practice, access is limited to those people at YES-EU Oy and the service provider whose duties require it; chat conversations can be read by people working in YES-EU’s sales and customer service and by those responsible for maintaining the service.
No manual, i.e. paper, material is generated through the website.
9. Retention periods
Personal data is retained only for as long as necessary to fulfil the processing purposes described in this notice or to meet legal obligations. At the end of the retention period, the data is deleted automatically from the website’s systems. Notifications sent by email from the forms, the online shop and the chat remain in the recipient’s mailbox and are deleted in accordance with the same retention periods.
| Data | Retention period |
|---|---|
| Chat conversation messages | 90 days |
| Background information extracted from chat conversations | 90 days |
| Technical event log of the chat | 90 days |
| Chat pre-screening log, including the content of rejected messages (see 11.1) | 90 days |
| Notes made by sales on the conversation | 12 months |
| Feedback given in the chat | 12 months |
| Contact requests left via the chat | 12 months from the contact request |
| Event data on the use of the site | 30 days |
| Contacts and bookings received via forms | 12 months from the last contact |
| Order requests made through the online shop | 12 months from the order request |
| Newsletter and contact list for interested parties | Up to 24 months from collection, unless the data subject withdraws consent before then |
| Data used for direct marketing | Up to 24 months from the last active contact or the giving of consent |
| Contract-related data | 6 years from the end of the contractual relationship (Accounting Act) |
| Data collected through website cookies | Mainly for the duration of the session |
If the contact leads to a customer relationship, the data is retained on the basis of the customer relationship as described above.
10. Rights of data subjects
You have the rights listed below regarding the processing of your personal data. Please make your requests in writing to the email address given in section 2. We will respond to the request within the time limit of applicable legislation, usually within one month. If necessary, the person making the request may be asked to prove their identity.
- The right to know what data is processed about you (right of access).
- The right to have incorrect or incomplete data corrected (right to rectification).
- The right to request the deletion of your data (“right to be forgotten”) when there is no longer a basis for processing.
- The right to request the restriction of processing in certain situations.
- The right to object to the processing of your personal data on the basis of legitimate interest and for direct marketing purposes.
- If the processing is based on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
- The right to receive data processed on the basis of a contract or consent in a machine-readable format and to have it transferred to another controller.
Chat conversations are held without logging in, and no identifying data is stored in the conversation as separate fields unless the visitor has left their contact details. Identifying an individual conversation for an access or deletion request may therefore require an email address or other identifying information given in the conversation.
The data subject also has the right to lodge a complaint about the processing of their personal data with the Data Protection Ombudsman if they consider that the processing violates their rights and freedoms. Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, Finland. Contact details: tietosuoja.fi/yhteystiedot
11. The chat service and the use of AI
The site has an AI-assisted chat with which visitors can converse freely. Digitoimisto Digitaali Oy is responsible for the technical implementation and maintenance of the service as a personal data processor. Data processed in the chat follows different processing paths depending on how it was provided.
11.1 What is processed in the chat and where
All the data mentioned below is stored for the retention periods given in section 9.
| Data | Does it pass through the AI service? |
|---|---|
| Conversation messages (everything the visitor writes in the chat) | Yes — Anthropic PBC, United States |
| Contact form fields in the chat (name, email, phone) | No — sent directly to the server, bypassing the AI model |
| Background information extracted from the conversation (e.g. industry, location, fleet size) | Yes |
| The visitor’s IP address and browser information when the form is submitted | No |
The chat uses Anthropic PBC’s Claude language model to understand the conversation and generate responses. The model has access to the messages written by the visitor and to the product information and instructions given to it by YES-EU. The model does not have access to YES-EU’s customer register or to previous visitors’ conversations.
When the chat asks for contact details, they are given in a separate form that is sent directly to YES-EU’s server. Name, email address and phone number do not pass through the AI service provider’s systems.
Other content written in the chat passes through Anthropic’s systems as part of the conversation message and is included in the stored conversation for the retention period given in section 9.
The chat checks every message before sending it to the AI service and records the result of the check in its own log on YES-EU’s server. If a message is rejected — for example because it is too long or concerns a topic the chat does not handle — the message does not pass through the AI service at all, but its content is stored in this log for the retention period given in section 9 so that the operation of the check can be monitored.
The chat service is intended for general product and service questions. Users are asked not to enter personal identity codes, payment card details, health information or other special categories of personal data in the conversation.
We recommend that you do not write sensitive information, your personal identity code, account numbers, passwords or other confidential information in the chat.
The chat service does not make automated decisions that would have legal or similarly significant effects on the data subject.
11.2 Background information extracted from the conversation
The chat extracts background information related to vehicle needs from the conversation (for example industry, location, fleet size, mileage) and stores it with the conversation, so that the salesperson can serve the visitor better and the same things do not need to be asked again.
This information is provided by the data subjects themselves. It is processed as personal data in the same way as other contact data: the same retention periods and the same right to deletion.
Background information is limited to the visitor’s vehicle needs and business. Health, beliefs or other special categories of personal data are not stored as background information. Contact details are not collected as background information but are given separately in a form (see 11.1); the system automatically detects and rejects the most common forms of contact details.
The restriction applies to storing background information. Conversation messages are stored as they are for the retention period given in section 9 (see 11.1).
11.3 A person can join the conversation
A YES-EU salesperson can follow ongoing chat conversations and take over a conversation, in which case the visitor talks to a person instead of the AI. The visitor is told in the chat when the conversation moves to a person and when it returns to the AI. The salesperson can also see the content of the conversation held with the AI.
12. Cookies
The site uses cookies to ensure the operation of the site, to monitor visitor numbers and to develop the service. Cookies necessary for operation are used without consent; consent is requested separately for analytics and marketing cookies, and consent can be changed at any time.
Visitor analytics uses Matomo software on a server maintained by Digitoimisto Digitaali in Finland (matomo.digitaalihosting.com). Matomo visitor statistics are always on: Matomo does not use cookies or store anything in the visitor’s browser. Visitor-level data is not transferred to third parties or outside the EU/EEA. Legal basis: legitimate interest (aggregate measurement of visitor numbers without cookies).
The chat stores a conversation identifier in the visitor’s browser local storage so that the conversation continues when moving from page to page.
Cookies and similar browser storage technologies are divided into three groups:
- Necessary: the operation of the site and chat, information security and storing cookie choices, for example the chat session cookie, which is valid for up to one day. They are used without consent because the site does not work without them.
- Analytics: monitoring visitor numbers and page usage. Analytics cookies are only used with consent.
- Marketing: targeting advertising and measuring its results. Only used with consent.
You can change your cookie choices and withdraw your consent at any time in the site’s cookie settings. An up-to-date list of the cookies used by the site, with their purposes and retention periods, can be seen in the cookie settings. You can also block or delete cookies in your browser settings, in which case some site functions, such as the chat, may not work.
13. Changes to this notice
We reserve the right to update this notice. We will announce material changes on our site. We recommend that you check the notice regularly.