Privacy Policy Introduction

This Privacy Policy explains how Läikähdys Oy collects, uses, stores, and protects your personal data when you access or use laikahdys.fi. We are committed to safeguarding your privacy and handling your personal data in a lawful, fair, and transparent manner.

We process personal data in accordance with all applicable data protection laws and regulations, including, where relevant, the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any local implementing legislation. This Privacy Policy provides an overview of the types of personal data we collect, the purposes and legal bases for processing, how and with whom data may be shared, and how long we retain it. It also explains our use of cookies and similar technologies, your rights in relation to your personal data, and how you can contact us with questions or requests regarding your privacy at ilari@laikahdys.fi. Please read this Privacy Policy carefully to understand how we handle your personal data when you visit and use our Website.

Data Controller and Personal Data Collected

The data controller responsible for processing your personal data is Läikähdys Oy, a company registered under registration number 3650907-9. If appointed, our Data Protection Officer is Ilari Konttinen. You can contact us regarding any privacy or data protection matter at ilari@laikahdys.fi.

We collect and process the following main categories of personal data, depending on how you interact with us and which services you use:

• Identification data: such as name, surname, title, and, where relevant, company name or role.
• Contact data: such as email address, telephone number, postal address, billing and shipping address, and other similar contact details.
• Account data: such as username, password hash (never the plain password), account settings, roles, and access permissions.
• Communication data: such as the content of your messages, inquiries, support requests, feedback, and any attachments or related metadata.
• Usage and technical data: such as IP address, browser type and version, device identifiers, operating system, referral URLs, pages viewed, time and date of visits, and log data generated by our servers.
• Marketing and communication preferences: such as your choices regarding newsletters, promotional communications, notification settings, and consent or opt-out records.
• Transaction and service data (if applicable): such as order history, services used, payment status, and other information related to your interactions with our products or services (excluding full payment card details, which are handled by secure payment providers where relevant).
• Other data you choose to provide: any additional information you voluntarily submit through forms, surveys, uploads, or other communication channels.

Some of this data is provided directly by you, for example when you create an account, fill in forms, subscribe to newsletters, contact us, participate in events, or make purchases. Other data is collected automatically when you use our website or services, for example through cookies, log files, and similar technologies, as well as analytics tools that help us understand how our services are used and improve their performance and security.

Purposes and Legal Bases for Processing Personal Data

1. Providing and Operating the Website and Services

We process personal data to provide, operate, and maintain our website and related online services. This includes enabling core functionalities, ensuring that content is displayed correctly, and allowing you to access features you request.

Typical legal bases:

• Performance of a contract or steps prior to entering into a contract
• Legitimate interests (efficient and secure provision of our website and services)

2. Processing Orders or Requests

When you place an order, submit a request, or otherwise engage in a transaction with us, we process your personal data to handle and fulfil the order or request, manage billing and payments, and provide related customer administration.

Typical legal bases:

• Performance of a contract or steps prior to entering into a contract
• Compliance with legal obligations (e.g., tax and accounting rules)

3. Customer Support

We use your personal data to respond to enquiries, handle complaints, and provide technical or customer support via email, contact forms, or other communication channels.

Typical legal bases:

• Performance of a contract or steps prior to entering into a contract
• Legitimate interests (effective handling of enquiries and improvement of our services)

4. Account Management

If you create an account, we process your data to set up, administer, and secure your user account, manage access credentials, and maintain your account settings and preferences.

Typical legal bases:

• Performance of a contract
• Legitimate interests (efficient account administration and security)

5. Service-Related Communications

We may send you service-related communications, such as confirmations, notifications about changes to our terms or policies, security alerts, and information necessary for the performance of our services.

Typical legal bases:

• Performance of a contract
• Compliance with legal obligations (e.g., mandatory notifications)
• Legitimate interests (informing users about important service-related matters)

6. Marketing Communications (If Applicable)

With your consent where required by law, we may process your contact details to send you newsletters, offers, and other marketing communications about our products and services or those of selected partners.

Typical legal bases:

• Consent (e.g., subscription to newsletters)
• Legitimate interests (direct marketing to existing customers, where permitted by law and subject to your right to object)

7. Website Security and Fraud Prevention

We process personal data (including technical and usage data) to protect the security and integrity of our website and services, detect and prevent fraud, abuse, and unauthorised access, and ensure the ongoing confidentiality, integrity, and availability of systems.

Typical legal bases:

• Legitimate interests (ensuring security of systems, data, and users)
• Compliance with legal obligations (e.g., security and incident reporting duties)

8. Analytics and Performance Monitoring

We use analytics tools to understand how our website and services are used, to measure performance, and to improve content, usability, and user experience. Data may be aggregated or pseudonymised where possible.

Typical legal bases:

• Legitimate interests (analysis and improvement of our website and services)
• Consent (for non-essential cookies or similar technologies, where required by law)

9. Legal or Regulatory Compliance

We may process personal data to comply with legal or regulatory obligations, respond to lawful requests from authorities, enforce our rights, or establish, exercise, or defend legal claims.

Typical legal bases:

• Compliance with legal obligations
• Legitimate interests (establishment, exercise, or defence of legal claims)

Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes described above, or as required by applicable laws and regulations. After the relevant retention period has expired, data will be deleted, anonymised, or securely archived.

Indicative retention periods include, for example:

• Account and profile data: retained for the duration of the account and for up to 1 year thereafter.
• Order and transaction data (including invoices): retained for 1 year to comply with tax, accounting, and commercial law obligations.
• Customer support communications: retained for up to 1 year after resolution of the enquiry.
• Marketing contact data: retained until you withdraw your consent or object to processing, and for up to 1 year thereafter for documentation purposes.
• Technical and usage data (logs, analytics): retained for up to 1 year, unless longer retention is necessary for security, fraud prevention, or legal reasons.

Where specific statutory retention periods apply, we retain the relevant data for at least the duration of those periods. In all cases, we regularly review the data we hold and delete or anonymise it when it is no longer needed.

Data Sharing and Categories of Recipients

We may share personal data with carefully selected recipients to the extent necessary for the purposes described above, always in accordance with applicable data protection laws.

Processors (Service Providers)

We engage external service providers who process personal data on our behalf and in accordance with our instructions. These processors are bound by data processing agreements and are required to implement appropriate technical and organisational measures to protect personal data. Typical categories of processors include:

• IT and hosting providers
• Email and communication service providers
• Analytics and marketing service providers

These processors may only use the data to provide the contracted services to us and not for their own purposes.

Other Third-Party Recipients

In addition to processors, we may share personal data with other independent controllers where necessary and lawful, for example:

• Professional advisors (e.g., lawyers, tax advisors, auditors) for the establishment, exercise, or defence of legal claims or for compliance and advisory purposes.
• Banks and financial institutions involved in processing payments.
• Public authorities, courts, law enforcement agencies, or regulatory bodies where disclosure is required by law or necessary to protect our rights or the rights of third parties.

Where data is transferred to recipients in countries outside your jurisdiction, we will ensure that appropriate safeguards are in place in accordance with applicable data protection laws (e.g., adequacy decisions or standard contractual clauses), and we will provide further information on such safeguards upon request.