Privacy · GDPR by design

Your data,protected.

Poemwork processes personal data in accordance with the EU General Data Protection Regulation. This page explains what we collect, why we collect it, and how long we keep it.

By design, Poemwork does not require detailed information about you or your company. Your organization stays in full control of its own data — the only commitment is to follow the program.

What we collect. The minimum needed to run the service: account information (name, work email, organization) and basic product analytics. We do not ask for, ingest, or store sensitive HR records, payroll files, or employee-level company data — those stay with you.

How we use it. To deliver assessments, generate aggregated insights for your organization, secure the platform, and communicate service updates. We never sell personal data.

Your rights. You can request access, correction, export, or deletion of your personal data at any time by contacting privacy@poemwork.com.

Updated 1 October 2026

Controller and contact

The controller is L. Laurén Oy (business name Poemwork), Business ID 3535680-8, Eerikinkatu 7 C 12, 00100 Helsinki, Finland. Privacy enquiries and data-subject requests can be sent to privacy@poemwork.com.

Personal data we process

Depending on how you use the service, we process identification and contact details, organization and role, account and authentication information, order and payment-status information, communications, consent choices, and technical usage and security logs.

Payment card details are handled by our payment provider and are not stored by Poemwork. We do not ask you to submit employee-level HR, payroll, health, or other special-category data to the program.

Purposes and legal bases

We process data to provide accounts and purchased services, administer orders and customer support, secure the service, comply with legal duties, and improve our offering. The legal bases are performance of a contract, compliance with legal obligations, our legitimate interests in operating and protecting the service, and consent where required for optional cookies or communications.

Sources and recipients

Most information comes directly from you, your organization, or your use of the service. We share data only as necessary with trusted hosting, authentication, email, payment, support, analytics, and professional-service providers acting under appropriate agreements, and with authorities when legally required.

We do not sell personal data.

International transfers

We favor service providers and hosting within the European Economic Area. If a provider processes data outside the EEA, we use a lawful transfer mechanism such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with appropriate safeguards.

Retention

We keep account and service data while the account or customer relationship is active and for a reasonable period afterward. Transaction and accounting records are retained for the period required by law. Security logs are retained only as long as needed to detect and investigate misuse. Consent records are kept while needed to demonstrate your choice.

When data is no longer necessary, it is deleted or anonymized unless law requires continued retention.

Security

We use access controls, encryption in transit and at rest, managed infrastructure, monitoring, backups, and data-minimization practices. No online service can guarantee absolute security, but we continually review safeguards in proportion to the risks.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland or your local supervisory authority.

We may need to verify your identity before fulfilling a request. Contact privacy@poemwork.com.

Cookies, changes, and children

Optional cookies are used only according to your choices. Details and controls are available in the Cookie Policy. Poemwork services are intended for organizations and adults, not children. We may update this notice when our processing or legal requirements change and will show the effective date on this page.

Chapter 02 · Key principles

Three simplepromises.

Data minimizationwe ask less

We only collect what is necessary to run assessments and deliver insights.

EU hostingstays in europe

Personal data is hosted on servers located within the European Union.

Encryptionin motion & rest

All data is encrypted in transit and at rest using industry standards.