Privacy policy

Who processes the data

The data controller is a company registered in Finland. The business ID, home municipality and email address are at the end of this page and match the trade register entry. The company name and full address can be looked up by business ID in the open data of the Finnish patent and registration office, the PRH, free of charge.

All data protection enquiries are received at the same address. There is deliberately no separate form: a form is one more channel for collecting data, and we do not want to create those.

What the site does NOT collect

This section comes first because it is longer than the next one.

There is no registration on the site. There are no user accounts, no passwords, and no page asks for an email address.

There are no contact forms. There is no newsletter subscription.

The answers in the fraud-signs test and the price calculator are computed directly in your browser. They are not sent to the server, do not end up in a database, and do not even reach our logs — there is nothing to send, because the calculation happens on your own device. Reload the page and what you entered is gone.

The reason is not modesty. The test answers describe your personal situation in relationships, and under Article 9 of the GDPR data concerning a person’s sex life belongs to the special categories, whose processing is prohibited as a general rule. The surest way not to break that rule is not to collect such data at all.

What is processed and on what basis

Visitor analytics — Google Analytics, and only after your explicit consent. What is processed is non-identifying statistics: which pages are opened, where users come from, and what kind of device they use. The IP address is passed on in truncated form.

A second analytics tool, Vercel Web Analytics, runs without cookies and without separate consent until you press “Necessary only”. It stores nothing on your device. The data processed are the address of the page opened, the traffic source, country, region and city, browser, operating system and device type. A visitor is identified by a hash built from the request itself, and the session is discarded automatically after 24 hours. According to Vercel, the data points are recorded anonymously and are not tied to an individual or an IP address.

Legal bases. For Google Analytics it is your consent: it can be withdrawn at any time via the “Cookie settings” link in the footer, and doing so is as easy as giving it was. For Vercel Web Analytics it is the controller’s legitimate interest (Article 6(1)(f) GDPR): the need to understand which pages are read and where visitors come from. As little data as possible is processed, there are no cookies, and you can object with one click: the “Necessary only” button switches the counter off at once.

The hosting provider’s technical logs. As on any site, server requests are recorded in the web host’s logs. These entries are used for security and troubleshooting and are kept for a limited time determined by the provider.

Click-throughs on affiliate links. When you press a button leading to a partner service, we pass the affiliate network a label in the form seo_fi_ru_price_slug_table. Only the page and section the click-through came from are encoded in it. No email address, IP address, name, age or precise location is passed in this label — it is assembled from a fixed template that personal data cannot end up in.

Where data is disclosed

To Google Analytics — with your consent. The service is provided by Google, and data may be processed outside the EU on the grounds Google has set for international transfers.

To Vercel Web Analytics, until you refuse analytics. The service is provided by Vercel Inc. (USA), the same company that hosts the site. Data may be processed outside the EU on the grounds Vercel has set for international transfers.

To affiliate networks — when you click through an affiliate link, and only the label described above. Any further processing happens on the side of the service you went to and is governed by its policy, not ours.

To the hosting provider — as the processor of the technical logs.

Nowhere else. We do not sell data, we do not pass it to advertising networks, and we do not embed third-party widgets, trackers or social media buttons in our pages.

External resources on the pages

In fairness we should say what is loaded onto the pages from external addresses.

Google Fonts typefaces. When a page loads, the browser fetches the font files from Google’s servers, and in such a request Google receives your IP address. This happens regardless of consent, because it relates to displaying the page.

Source links lead to external sites — poliisi.fi, kkv.fi, tietosuoja.fi, and the services’ own pages. Following them is governed by that site’s rules, not ours.

There are no other external loads on the pages: no tracking pixels, no embedded videos and no social media widgets. The Vercel Web Analytics counter script is fetched from the site’s own address and runs until you refuse analytics, while Google Analytics appears on the page only after your consent.

Your rights and the deadlines

GDPR rights apply here too, even though there is little for us to process.

You have the right to request a copy of your data, its rectification or erasure, to restrict processing and to object to it, and to withdraw consent at any time.

A request must be answered without undue delay and in any case within one month of receipt. The deadline can be extended by at most two months if the request is complex, but the extension has to be notified within the first month.

The request is free of charge.

If the answer does not satisfy you, you have the right to lodge a notification with the Data Protection Ombudsman (tietosuojavaltuutettu). The order is strict: you must contact us first, otherwise the notification is as a rule not handled. The form is submitted through the Turvalomake secure service, and the office’s contact details are tietosuoja(at)om.fi, PL 800, 00531 Helsinki.

How to draft the request and what to ask for in it is gone through in detail on our page how to delete your own data — that guide is written about dating services, but the mechanics are the same.

Changes to this document

If the set of data processed changes — for example a new analytics tool comes into use — we will update this text and raise the consent version. The cookie question window will then open again for everyone, as the supervisory authority requires.

We mark the date of the last review only when the content has genuinely changed. A fresh date on an unchanged document looks more convincing but means precisely nothing.

Frequently asked

Sources

• GDPR: rights of the data subject and time limits
• Tietosuoja.fi: notification to the Data Protection Ombudsman
• Traficom: rules on the use of cookies
• Vercel: Web Analytics privacy and compliance