Customer & Learner Privacy Notice

This privacy notice explains how Breakout Labs Oy ("Breakout Labs", "we", "us") handles personal data relating to customers, prospective customers and people participating in our training and enablement programmes.

1. Who we are

Breakout Labs Oy is a Finnish training and enablement company.

Breakout Labs Oy
Business ID: 3549465-3
PL 8
53101 Lappeenranta
Finland

For privacy questions or requests, contact privacy@breakout-labs.com.

2. When this notice applies

This notice applies when Breakout Labs decides how and why personal data is processed, for example when we:

• respond to enquiries and manage customer relationships;
• register and administer learners;
• deliver training and provide learner support;
• track attendance, progress and completion;
• record training sessions;
• collect feedback; or
• operate our websites and learning services.

In some engagements, we may process personal data solely on a client's instructions, acting as a processor rather than a controller. In those cases, we process the information on the client's behalf under our agreement with them.

3. What information we process

Depending on how you interact with us, we may process:

Contact and customer information, such as your name, work email address, company, role and communications with us.

Training and learning information, such as registration, attendance, training dates, learning activity, progress, completion, certificates and activity in training environments.

Support and communications, such as questions, support requests and communications with our team or instructors.

Live session information, such as your name, audio, video, chat messages and other contributions you choose to make during a session.

Recordings, where a training session is recorded, including the recording, transcript and session chat.

Feedback, including course evaluations, ratings and written comments.

Website and analytics information, such as information about how our websites and online services are used, including pages viewed, interactions, device and browser information, and general traffic and usage information collected through Google Analytics 4 where analytics consent has been provided.

We do not deliberately collect health information or other sensitive personal data as part of our standard training administration.

4. Where we get your information

We may receive personal data:

• directly from you;
• from your employer or another organisation arranging training for you;
• from our customers and partners; and
• through the learning, communication and training systems you use while participating in our services.

5. Why we use your information

We process personal data where it is necessary for our legitimate interests in operating and delivering our B2B training and enablement services. This includes responding to business enquiries, administering customer relationships, registering learners, delivering training, providing support, maintaining training records, reporting on agreed programme activity and improving our services.

We also process personal data where necessary to comply with legal obligations, such as accounting requirements.

Where processing is based on your consent, participation is optional. This includes publishing a named testimonial. You may withdraw your consent at any time without affecting processing that took place before withdrawal.

We use Google Analytics 4 (GA4) to understand how visitors use our website. GA4 is treated as non-essential analytics and is not enabled until you provide analytics consent through our cookie controls. If you reject analytics cookies, GA4 remains disabled. You can change or withdraw your analytics consent at any time through our cookie controls.

6. Learner administration and employer reporting

If training is arranged by your employer or another organisation, we may receive registration information from that organisation and provide it with information about participation in the programme.

Depending on the programme, we may provide the organisation arranging the training with information about registration, attendance, progress and completion.

We do not use this information to make employment decisions about learners. Your employer or the organisation arranging the training determines how it uses information it receives from us.

Some information is necessary for us to administer and deliver training, including your name, contact information and relevant participation records. Without this information, we may not be able to provide access to the training.

7. Training recordings

Some live training sessions are recorded so that learners can review the session afterwards and so that we can maintain appropriate training records.

Recordings, including any transcript, may include your name, voice, video, screen sharing, chat messages and other contributions you make during the session.

If you do not want a particular contribution recorded, you can ask the instructor to pause the recording.

Learner access to a recording is normally available for one calendar month after the training. Recordings, transcripts and session chat are retained for a maximum of 12 months from the session and are then deleted in accordance with our retention process.

8. Feedback and testimonials

We collect learner feedback to evaluate and improve our training.

Source feedback may be linked to an individual learner. When feedback is shared with instructors or analysed without learner identification, we remove identifying information first.

Providing a testimonial for public use is voluntary. We publish a named testimonial only with the person's permission.

9. Who we share information with

We share personal data only where necessary for the purposes described in this notice.

This may include:

• the customer or employer arranging the training;
• instructors delivering the relevant training;
• service providers that support our technology, training delivery and business operations; and
• professional advisers or authorities where required by law or necessary to establish, exercise or defend legal claims.

Instructors have access only to learner information needed to deliver the relevant training.

Our service providers process personal data under appropriate contractual and data protection obligations.

10. International transfers

Some of our service providers and instructors may process personal data outside Finland or the European Economic Area.

Where personal data is transferred outside the European Economic Area, we use an applicable legal transfer mechanism and safeguards required by data protection law, such as an adequacy decision or the European Commission's Standard Contractual Clauses. Contact privacy@breakout-labs.com for more information about the safeguards we use.

11. How long we keep information

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal requirements.

Our standard retention periods are:

• learner registration, attendance, progress, completion and certificate records: 3 years after the end of the course or access period;
• identifiable learner feedback: 2 years after it is collected; and
• training recordings, transcripts and session chat: maximum 12 months from the session.

Other business records, including support communications, enquiries and customer correspondence, are retained for as long as reasonably necessary for the relevant purpose and are periodically reviewed.

Some records may be retained for longer where required by law or reasonably necessary to establish, exercise or defend legal claims.

Information that has been genuinely anonymised so that it can no longer be linked to an identifiable person is not personal data and may be retained for longer.

12. Your rights

Depending on the circumstances, you may have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete information corrected;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a portable format where the legal requirements for portability apply; and
• withdraw consent at any time where processing is based on consent.

These rights are not absolute and may depend on the circumstances and legal basis for the processing.

To exercise your rights, contact privacy@breakout-labs.com. We may need to verify your identity before completing a request.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman or another competent data protection authority.

13. Changes to this notice

We may update this privacy notice as our services or data processing practices change. The latest version will be available on our website, with the date of the most recent update shown at the top.