SuperQuest – Privacy Policy
Updated: 1 August 2026
1. General
Javanainen Consulting Oy / J&Co Digital (hereinafter referred to as ‘J&Co’ or ‘we’) provides the SuperQuest service to businesses and organisations (hereinafter referred to as the ‘Customer’). With SuperQuest, Clients can build and publish interactive content and services on their websites and other digital channels.
In this privacy policy, we explain how J&Co processes personal data in connection with the SuperQuest service and its own websites.
J&Co’s role in the processing of personal data depends on the context in which the personal data is processed.
When you use J&Co’s or SuperQuest’s own websites or services, J&Co may act as the data controller for your personal data, for example in connection with your customer relationship, user account, enquiries, service communications and your use of its website.
When you use a SuperQuest implementation published on our Client’s website or via another channel, that Client will, as a rule, act as the data controller and determine what personal data is collected and for what purposes it is used. In such cases, J&Co processes personal data on behalf of the client as a data processor.
For further information on the processing of a customer’s personal data, please refer to that customer’s own privacy policy.
2. Data controller and contact details
Javanainen Consulting Oy / J&Co Digital
Company registration number: 2207696-2
Vasarasepäntie 34
10330 Billnäs, Finland
Enquiries regarding data protection:
Email: info@jco.fi
3. What personal data do we process?
As the data controller, J&Co may process the following personal data, for example:
- name and contact details, such as an email address and telephone number
- company, organisation and job title
- Information relating to your SuperQuest user account
- information relating to customer accounts, orders and invoicing
- Enquiries and messages sent to J&Co
- technical and log data relating to the use of the service
- information relating to the use of and interaction with our websites
- decisions relating to marketing and communications.
In our clients’ SuperQuest implementations, data such as names, email addresses, telephone numbers, form responses, survey responses and other information specified by the client may be collected. With regard to this data, the customer determines the information to be collected and the purposes for which it is to be used, and J&Co acts, in principle, as a data processor.
4. What do we use personal data for?
Where J&Co acts as the data controller, we may process personal data for the following purposes:
- Delivery of the SuperQuest service and management of user accounts
- customer relationship management
- management of orders, payments and invoicing
- customer service and handling support requests
- communication regarding the service
- service security and the prevention of misuse
- the development of our services and websites
- analysis and compilation of usage statistics
- sales and marketing in accordance with applicable legislation
- compliance with statutory obligations.
When we process personal data on behalf of a Customer in SuperQuest implementations, the purposes of the processing are determined by the Customer in question.
5. Legal bases for the processing of personal data
J&Co processes personal data depending on the circumstances:
- to implement the agreement or to carry out preparatory measures for the agreement
- On the basis of J&Co’s legitimate interests, for example, in managing customer relationships, developing services and ensuring data security
- on the basis of a statutory obligation
- on the basis of consent, where such processing requires consent.
Where J&Co acts as a data processor in relation to the Customer’s personal data, the Customer is responsible for determining the appropriate legal basis for such processing.
6. Where is personal data obtained from?
We obtain personal data mainly:
- from you yourself
- from the company or organisation you represent
- When using the SuperQuest service
- when using our websites
- From our customers, where this is necessary for the provision of the service.
The personal data processed in customers’ SuperQuest implementations is mainly obtained directly from the user of the implementation or from the customer.
7. Cookies and analytics
We use cookies and similar technologies on our websites to enable the site to function, as well as for analytics and marketing purposes.
Where necessary, the user’s consent is sought for the use of non-essential cookies and similar tracking technologies.
Responsibilities regarding the cookies and other tracking technologies used in connection with a SuperQuest implementation published on the client’s website are determined on the basis of that specific implementation and the technologies used.
8. To whom are personal data disclosed?
We use trusted service providers to deliver our services, who may process personal data on our behalf.
Examples of these might include:
- cloud and hosting service providers
- payment service providers
- email and communication services
- analytics and other technical service providers
- systems used for customer relationship management and support services.
Service providers may process personal data only to the extent necessary to provide the agreed service.
We may also disclose information if required to do so by law, by a public authority or by a court order, or if it is necessary for the purpose of preparing, bringing or defending legal claims.
9. Where is personal data processed?
The SuperQuest service’s infrastructure operates on the Google Cloud Platform, and the service’s data is primarily stored within the EU.
If personal data is processed or transferred outside the European Union or the European Economic Area, we will ensure that the transfer is lawful in accordance with the applicable data protection legislation.
Where necessary, we use appropriate data transfer mechanisms, such as the standard contractual clauses approved by the European Commission.
10. How long is personal data retained?
We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected or as required by law.
The retention period depends on the nature of the data and the purpose of its processing.
The retention of personal data processed by SuperQuest on behalf of customers is agreed with the customer, and the data is processed in accordance with the customer’s instructions.
11. How do we protect personal data?
We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss and other unauthorised processing.
Access to personal data is restricted to those whose duties require them to process such data.
The SuperQuest service and its security are continuously maintained and developed.
12. Rights of the data subject
Under the applicable data protection legislation, you may have the right to:
- to obtain information about the processing of your personal data
- to access your personal data
- request the correction of incorrect or incomplete information
- request the erasure of personal data
- request a restriction on the processing of personal data
- object to the processing of personal data
- to have your personal data transferred from one system to another in certain circumstances
- withdraw the consent you have given at any time where the processing is based on consent.
Where J&Co acts as the data controller for your personal data, you may send a request regarding your rights to us at the address set out in section 2.
If your personal data has been collected via one of our Clients’ SuperQuest implementations and the Client acts as the data controller, any request regarding your rights should in the first instance be addressed to that Client. J&Co assists the Client in fulfilling the rights of data subjects as agreed.
13. The right to lodge a complaint
If you consider that your personal data has been processed in breach of data protection legislation, you have the right to lodge a complaint with the relevant supervisory authority.
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.
14. Changes to this privacy notice
We may update this privacy policy if our services, the way we process personal data or the applicable legislation change.