Privacy notice

Last updated: 1 June 2026

We value your privacy. This notice explains, in brief, what personal data we process, for what purposes and on what legal basis, who we may share it with, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).

1. Controller, and who is responsible for your data

Will & Must Ltd (Business ID 3295686-7, Töölönkatu 4, 00100 Helsinki) is the controller for our website, enquiries, business and contractual partners, investor relations and marketing.

Each project we develop is carried out through a separate project company. That project company is the controller for the personal data relating to its project, for example the data of landowners and neighbours, and Will & Must Ltd processes that data on the project company's behalf. This notice applies to each project company as an independent controller for as long as the project company is part of our group.

If a project or project company is later sold or transferred outside the group, responsibility as controller passes to the new owner, and their own privacy practices apply.

You can ask about the processing of personal data, and exercise your rights, at [email protected].

2. What data we process, and where we obtain it

Depending on the situation, we process the following data:

• Identification and contact data: name, position, organisation, email, telephone, address.
• Contract and transaction data: information relating to contracts, bank details, and communications with us.
• Property data: property and land register data relating to projects.
• Personal identity code: only where it is needed for unambiguous identification, for example in contracts and registrations.
• Technical data: a website visitor's IP address, and browser and device information.

We obtain the data mainly directly from you. We may supplement it from public sources in order to manage contractual relationships. Providing contract-related data is a precondition for entering into a contract; otherwise, providing data is voluntary. If you apply to work with us, or work for us, we describe the processing of your personal data in a separate privacy notice for personnel and recruitment.

3. Why, and on what basis, we process data

We process personal data for the following purposes and on the following legal bases:

• Project development and delivery (land lease and purchase negotiations and contracts; contact with landowners, neighbours, authorities and other stakeholders; land use planning and permitting procedures). Basis: a contract or the steps preceding it, and legitimate interest; in permitting procedures, a statutory obligation.
• Business, contractual and investor relations, and the related accounting and reporting. Basis: a contract, a statutory obligation, and legitimate interest.
• Responding to enquiries, and arranging visits or events. Basis: legitimate interest.
• Operating, developing and securing the website. Basis: legitimate interest; any non-essential cookies on the basis of consent.
• Marketing and newsletters. Basis: consent, or legitimate interest (direct marketing to representatives of organisations).
• Legal claims and corporate transactions. Basis: legitimate interest.

4. Who we share data with

As a rule, we process data ourselves, and we limit access to those whose duties require it. We may share data with the following groups, and only to the extent necessary:

• Service providers (for example IT and cloud services, accounting and payroll, and an electronic signature service) that process data on our behalf, and with whom we have concluded data processing agreements.
• Advisers, such as legal and technical experts, our auditor, and public purchase witnesses.
• Authorities and municipalities, where required by law or in permitting procedures.
• Potential investors, buyers and parties to a corporate transaction, who act as independent controllers in respect of the data they receive.

5. Transfers outside the EEA

We process data mainly within the European Economic Area (EEA). If data is transferred outside the EEA, for example because of a service provider or a potential foreign investor, we ensure the safeguards required by the GDPR, such as a European Commission adequacy decision, standard contractual clauses, or the EU-US Data Privacy Framework. You can request a copy of the safeguards at the address above.

6. How long we keep data

We keep data only for as long as it is needed for the purpose of processing, or for the period required by law, after which we delete or anonymise it.

• Contract and landowner data: for the term of the contract, and afterwards for the period required by limitation periods; accounting material as required by law (vouchers for 6 years, accounting books for 10 years).
• Enquiries and other contact details: for as long as processing is needed; enquiries for no longer than 36 months from the last contact.
• Marketing: until you withdraw your consent.
• Technical data: 6 months.

7. Cookies

We use only cookies that are essential to the site's operation and security, together with privacy-friendly, cookieless analytics that measures visitor numbers in aggregate without identifying you or tracking you across other sites. You can control or block cookies in your browser settings.

8. Your rights

You have the right to access your data and obtain a copy of it; to ask for data to be corrected or erased; to ask for processing to be restricted; to object to processing based on legitimate interest, on grounds relating to your particular situation; to ask for your data to be transferred; and to withdraw your consent where processing is based on it. You can exercise your rights using the contact details above, and we may need to verify your identity. We do not use your data for automated decision-making or profiling.

If you consider that we are processing your data unlawfully, you can lodge a complaint with the supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

9. Changes

We update this notice as legislation or our operations change. We recommend reviewing the current version from time to time.