Privacy policy

Controller

The controller is the company operating this website; its name and business ID appear in the page footer. Data protection questions are answered at the address at the end of this page. The company has not appointed a separate data protection officer.

What data is collected

Personal data is collected only through the enquiry form. Browsing the site requires no details and the site does not identify visitors.

• What you type in the form: name, e-mail address and message are required; company, telephone number, site location, service and roof area are optional.
• Attachments you choose to send: up to five images or PDF files. Photographs may contain information about your building.
• Technical data at the moment of sending: your IP address and your browser's identification string (the user agent). The IP address is not stored as such but as a hash, used only to limit how many submissions come from one source. The browser identification string is stored as it was sent.

What the data is used for

The data is used to handle your enquiry: to assess the building, prepare an offer and contact you. The basis for processing is the preparation of a contract at your request (GDPR Article 6(1)(b)) — without these details the enquiry cannot be answered. The tick box on the form confirms that you have read this statement; it is not a separate consent, and the processing does not rest on one.

The data is not used for profiling, automated decision-making or marketing. It is not sold. It is not passed to outside parties for any purpose other than running the service: the providers described below process it only on the company's instructions.

Who handles the data

Enquiries are stored in the company's own system and handled by the employees responsible for offers and for sites. The data is not transferred outside the EU or the EEA.

A notification of the submission is also sent to the company's own mailbox, so the mail provider processes that message while delivering it. The substance of the enquiry stays in the company's own system whether or not the notification arrives.

The system runs on a server rented from a hosting provider, and attachments are kept in object storage of the same kind. These providers process the data only as far as running the service requires, and not for their own purposes.

Security and event log

The system keeps a separate event log of what has been done in it: when an enquiry was received, a hash of the IP address, and the browser identification string. The log is used to prevent misuse and to show what actually happened. The basis for processing is legitimate interest (Article 6(1)(f)): the security of the system and the verifiability of what it did.

The event log cannot be altered afterwards and entries cannot be removed from it — that is exactly what makes it evidence. Log entries therefore remain when the enquiry itself is deleted, and they are kept separately from the retention period for enquiries. The log does not record your name, your address, your telephone number or the content of your message.

How long the data is kept

If an enquiry leads to no customer, no offer and no work, the enquiry and its attachments are deleted automatically 365 days after it was last handled. The deletion runs on a schedule; it does not have to be asked for.

If an enquiry becomes an offer, a customer, a contract or work, the enquiry and the copies taken from its attachments are part of that business, contractual or accounting record. They are then kept for that record's own purpose and for the retention period that applies to it, not for the 365 days above. Different records have different periods, and no single figure is given here for all of them.

You can ask for deletion sooner. Entries in the security and event log remain separately, as described above.

Your rights

You have the right to know what data is held about you and to receive a copy of it. You can ask for incorrect data to be corrected or for data to be deleted, and object to the processing. Some data may have to stay where keeping it is necessary for a business relationship, a contract, accounting or another legal obligation, or for making or defending a legal claim; in that case we tell you what remains and why. Requests go to the address at the end of this page.

If you consider that the matter has not been handled properly, you can lodge a complaint with the data protection supervisory authority. In Finland this is the Office of the Data Protection Ombudsman.

The version of this statement

The version of this statement is 2026-01. When you send an enquiry, the system records which version you confirmed you had read, in which language, and when — so that it is later known exactly which text you were shown.