Privacy Policy

1. Who We Are

ProvenTen Ltd is a limited company registered in Finland. We operate as the Data Controller for the personal data collected through our public websites and for account management purposes. When we process data on behalf of our enterprise customers within our platform, we act as a Data Processor under our Data Processing Agreement (DPA).

Contact Details:

• Company: ProvenTen Ltd (Business ID FI36482929)
• Address: Agricolankatu 4, 20500 Turku, Finland
• Email: privacy@proventen.com

2. Information We Collect

We collect information in two distinct contexts:

A. Public Website Visitors

When you visit proventen.com or developers.proventen.com, we collect information through standard web technologies (cookies, pixels) and interactions.

• Browsing Data: IP address, browser type, device information, and pages visited.
• Contact Information: Name, email, and company details provided via contact forms, demo requests, or newsletter sign-ups. We store this in our CRM (HubSpot), with data hosting in the European Union, so we can respond and follow up.
• Cookie Preferences: Your statistics and marketing cookie choices, stored in an essential cookie on proventen.com for up to 180 days so both public sites can follow the same setting. Details are in our Website Cookie Policy.
• Office map (optional): If you opt in to Marketing cookies, Contact Us may load a Google Maps embed. Google then receives technical data needed to display the map (typically IP address, browser and device information, and similar request data). The map is not loaded until that opt-in. You can also open the location in Google Maps in a new tab without loading the embed.

B. Registered Platform Users

When you use the ProvenTen platform, we collect:

• Account Data: Professional contact information (name, business email, job title) required to create and manage your user profile.
• Usage Data: Logs of how you interact with our features, reference requests, and system activity.
• Customer Data: As a B2B platform, our customers may upload and process contact information (e.g., of their own prospects or references). This data is processed strictly according to our Data Processing Agreement (DPA) with that customer.

3. How We Use Your Information

We process your data for the following purposes and based on the following legal grounds (under GDPR):

• To Provide Our Service: (Contract Performance) To manage your account, provide platform access, and facilitate sales reference operations.
• Communication: (Legitimate Interest) To respond to inquiries, provide support, and send updates regarding our platform.
• Marketing: (Consent) To provide relevant content or business-tailored updates if you have opted in, and to load optional third-party features such as the Google Maps office map on Contact Us.
• Security & Compliance: (Legal Obligation) To ensure platform security, prevent fraud, and comply with EU data protection requirements.

4. Data Residency & International Transfers

ProvenTen is committed to EU-based data residency.

• All customer production data and core platform infrastructure are hosted within the EU (Frankfurt & Helsinki).
• We do not perform cross-border data transfers of sensitive customer data outside of the European Economic Area (EEA) without specific contractual protections.
• If you opt in to Statistics or Marketing on this website, Google (Google Ireland Limited) may process the related data as described in our Website Cookie Policy (Google Analytics and, on Contact Us, the Google Maps embed). Google may process that data on servers outside the EEA. Where that involves an international transfer, it is carried out under Google's terms for Google services and appropriate GDPR transfer safeguards. This does not change where ProvenTen hosts customer platform data.

5. Third-Party Sharing (Sub-processors)

We do not sell your personal data. We share data with essential third-party service providers (Sub-processors) that assist us in operating our platform and marketing site (e.g., cloud hosting, email delivery, CRM, support ticketing). Website inquiries and sales contacts are processed in HubSpot (EU-hosted). All such providers are vetted for GDPR compliance. Our full, up-to-date authorized Sub-processor list is maintained centrally at /sub-processors-info.

On this marketing website, optional Google services (Google Analytics after Statistics opt-in, and the Google Maps embed on Contact Us after Marketing opt-in) may also receive technical visitor data as described in our Website Cookie Policy. Those services are not used to process ProvenTen platform customer data.

6. Your Rights

Under the GDPR, you have specific rights regarding your personal data:

• Right to Access: Request a copy of the data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete information.
• Right to Erasure: Request the deletion of your personal data where applicable.
• Right to Object: Object to our processing of your data based on legitimate interests.
• Right to Withdraw Consent: Where we process data based on your consent, you may withdraw it at any time.

To exercise these rights, please contact us at privacy@proventen.com.

7. Security Measures

We employ industry-standard technical and organizational measures to protect your data, including encryption at rest and in transit, strict Role-Based Access Control (RBAC), and regular security monitoring. For full details, see our Security Policy.

8. Updates to This Policy

We may update this policy occasionally. We will post the changes on this page and, if significant, provide a more prominent notice (e.g., via email or within the platform).