B2B website visitor identification in Finland

The Data Protection Ombudsman (Tietosuojavaltuutettu) supervises personal data processing in Finland, and administrative fines are decided by a collegial sanctions board sitting within that same office rather than by the Ombudsman alone — an unusual two-step structure in a European context. Cookies and comparable device-level technologies fall instead under the Act on Electronic Communications Services and are supervised by Traficom, the Finnish Transport and Communications Agency. In practice a Finnish review of a visitor-identification tool can therefore run through two separate rulebooks at once: whether the personal data processing satisfies the GDPR, and whether anything stored on or read from the visitor's device meets Traficom's telecom-law standard. Knowing which authority owns which question saves time in procurement conversations.

The Tietosuojalaki (Data Protection Act 1050/2018) is a supplementary national act, not a replacement for the GDPR. It sets Finnish specifics on processing personal identity codes (henkilötunnus), on processing carried out for research, statistics and journalism, and on the domestic supervisory and sanctions structure described above. For company-level website visitor identification none of those special regimes apply, so the operative obligations remain the general GDPR ones: a documented lawful basis, a transparent privacy notice, and an Article 28 data processing agreement with any processor involved, including the identification vendor itself.

The device-level rule sits in the Act on Electronic Communications Services, which governs storing information on, or reading it from, a visitor's terminal equipment, and it is supervised by Traficom rather than the Data Protection Ombudsman. lead.box identifies companies from network-level information tied to the visit and does not place advertising identifiers, tracking pixels or device fingerprints on the visitor's equipment, so the tool itself is not the target of that consent-style rule. Whatever else your site loads — analytics tags, ad pixels, chat widgets — is still assessed separately against Traficom's requirements, so it is worth auditing your own tag stack independently of this question.

Yes. Any visitor can object to the processing at any time through the public opt-out page, and a company can request a company-level opt-out covering everyone browsing from its network. Because the legal basis relies on a documented legitimate-interest balancing test rather than consent, the right to object is the practical control point, and it should be exercised without needing to explain a reason. The identification activity should also be named in your own privacy statement (tietosuojaseloste); a copy-ready paragraph describing the processing is available on the GDPR page for you to adapt to your own wording.

Finnish company data is unusually clean to work with because the Business Information System (Yritys- ja yhteisötietojärjestelmä, YTJ) maintained by the PRH assigns every registered entity a Y-tunnus, a stable business identifier that is searchable and free to look up. When lead.box resolves a visit to an organisation, that organisation can typically be cross-checked against the YTJ register in seconds, which is one reason Finnish sales and marketing teams tend to trust a company-level match quickly rather than treat it as a black box. It also makes deduplication against your CRM straightforward, since the Y-tunnus is the reference key most Finnish B2B databases already use.

Finnish B2B procurement, even outside the strict public-sector tendering rules, tends to be pragmatic and document-led rather than legalistic: a reviewer typically wants the standard Article 28 data processing agreement, the published sub-processor list, confirmation of the processing location, and a short written note on the legal basis and balancing test, and will move quickly once those are in hand. Larger organisations and anything touching the public sector will additionally expect the vendor to answer a written data-protection questionnaire covering retention, security measures and breach notification, so having those answers prepared in English in advance shortens the cycle noticeably.

Finnish B2B teams commonly run HubSpot, Pipedrive or Microsoft Dynamics alongside a marketing automation tool, and the practical question during evaluation is rarely about the legal basis but about how quickly an identified visit turns into a workable record. lead.box exports identified companies as CSV, Excel or JSON and can push matches onward by webhook, so a visit can land as an enriched record or a task in the CRM your sales team already opens every morning, without asking anyone to learn a new interface. That handover pattern matters more in Finland's account-based, high-value B2B sales motion than in markets that rely on high transaction volume.

Installing the snippet is a single tag added once to the site template, after which the first identified companies from your own traffic typically appear within a day, giving a Finnish buyer's preferred proof-before-commitment approach something concrete to evaluate rather than a sales claim. Team seats can be added as more colleagues need access, exports and webhooks can be configured to match whatever CRM or spreadsheet workflow already exists, and cancellation is self-service with no fixed contract term to negotiate out of — a detail Finnish buyers, who dislike being locked into vendor relationships, tend to check early rather than late.