Privacy · GDPR by design
Your data,protected.
By design, Poemwork does not require detailed information about you or your company. Your organization stays in full control of its own data — the only commitment is to follow the program.
What we collect. The minimum needed to run the service: account information (name, work email, organization) and basic product analytics. We do not ask for, ingest, or store sensitive HR records, payroll files, or employee-level company data — those stay with you.
How we use it. To deliver assessments, generate aggregated insights for your organization, secure the platform, and communicate service updates. We never sell personal data.
Your rights. You can request access, correction, export, or deletion of your personal data at any time by contacting privacy@poemwork.com.
Updated 1 October 2026
Controller and contact
The controller is L. Laurén Oy (business name Poemwork), Business ID 3535680-8, Eerikinkatu 7 C 12, 00100 Helsinki, Finland. Privacy enquiries and data-subject requests can be sent to privacy@poemwork.com.
Personal data we process
Depending on how you use the service, we process identification and contact details, organization and role, account and authentication information, order and payment-status information, communications, consent choices, and technical usage and security logs.
Payment card details are handled by our payment provider and are not stored by Poemwork. We do not ask you to submit employee-level HR, payroll, health, or other special-category data to the program.
Purposes and legal bases
We process data to provide accounts and purchased services, administer orders and customer support, secure the service, comply with legal duties, and improve our offering. The legal bases are performance of a contract, compliance with legal obligations, our legitimate interests in operating and protecting the service, and consent where required for optional cookies or communications.
Sources and recipients
Most information comes directly from you, your organization, or your use of the service. We share data only as necessary with trusted hosting, authentication, email, payment, support, analytics, and professional-service providers acting under appropriate agreements, and with authorities when legally required.
We do not sell personal data.
International transfers
We favor service providers and hosting within the European Economic Area. If a provider processes data outside the EEA, we use a lawful transfer mechanism such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with appropriate safeguards.
Retention
We keep account and service data while the account or customer relationship is active and for a reasonable period afterward. Transaction and accounting records are retained for the period required by law. Security logs are retained only as long as needed to detect and investigate misuse. Consent records are kept while needed to demonstrate your choice.
When data is no longer necessary, it is deleted or anonymized unless law requires continued retention.
Security
We use access controls, encryption in transit and at rest, managed infrastructure, monitoring, backups, and data-minimization practices. No online service can guarantee absolute security, but we continually review safeguards in proportion to the risks.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland or your local supervisory authority.
We may need to verify your identity before fulfilling a request. Contact privacy@poemwork.com.
Cookies, changes, and children
Optional cookies are used only according to your choices. Details and controls are available in the Cookie Policy. Poemwork services are intended for organizations and adults, not children. We may update this notice when our processing or legal requirements change and will show the effective date on this page.
Chapter 02 · Key principles
Three simplepromises.
Data minimizationwe ask less
We only collect what is necessary to run assessments and deliver insights.
EU hostingstays in europe
Personal data is hosted on servers located within the European Union.
Encryptionin motion & rest
All data is encrypted in transit and at rest using industry standards.