Privacy policy

1. Data controller

Suomen Asbestipro Oy

Business ID: 1581184-2

Ukkohauentie 11-13 A, 02170 Espoo

Email: info@asbesti.pro

Phone: +358 45 78 444 444

2. Contact person for matters concerning the register

For data protection matters, please contact us by email at info@asbesti.pro. As a rule we answer enquiries within one month.

3. Personal data we process

To provide our services we process the following personal data:

• Contact details – name, email address, telephone number, address and postcode.
• Order details – the address of the site, a description of the sampling, the time of the order, the price and payment details.
• Customer communications – messages sent through the contact form and email correspondence.
• Usage data – IP address, browser type, pages visited and the times of the visits.
• Payment data – payment methods and the reference details of payment transactions. Card details are not stored in our own systems; payments are processed through Viva.com.

4. Purposes of processing and legal basis

We process personal data for the following purposes:

• Performance of a contract (GDPR Article 6(1)(b)) – delivering the asbestos survey, the sampling and the reporting in accordance with the order.
• Legal obligations (GDPR Article 6(1)(c)) – the Finnish Accounting Act, the VAT Act, occupational safety legislation and the rules governing asbestos surveys (Government Decree 798/2015).
• Legitimate interest (GDPR Article 6(1)(f)) – customer service, developing our services, preventing misuse and compiling statistics.
• Consent (GDPR Article 6(1)(a)) – marketing communications and the use of non-essential cookies.

5. Sources of the data

Personal data is as a rule collected directly from the data subject through the order form, the contact form, email or a telephone conversation. Usage data on the website is collected automatically when the data subject visits the site.

6. Disclosure and transfer of data

Personal data is disclosed only to parties that are necessary for providing the service:

• OneLab (our asbestos laboratory partner) – when sampling is ordered, the contact and order details needed to carry out the sample analysis are passed on.
• Viva.com (Viva Payments Services S.A.) – processing of online payments.
• Resend – sending the service emails (confirmations, reports).
• Vercel Inc. – hosting and content delivery for the website.
• Supabase – database and authentication service for the back end (servers located in the EU).
• Google Analytics – analytics on how the site is used (anonymised IP address).
• PostHog – analytics on how the site is used and, with consent, session recordings (EU servers, anonymised IP address).
• Authorities – where legislation so requires.

Some of the service providers (for example Resend and Google) may process data outside the EU/EEA. In those situations we safeguard the data with standard contractual clauses (SCC) approved by the European Commission or with equivalent arrangements.

7. Retention period

Personal data is retained only for as long as is necessary for the purposes of the processing:

• Customer and order data – 6 years from the end of the financial period, as required by the Accounting Act.
• Asbestos survey reports – 10 years in line with the statutory retention obligation.
• Messages from the contact form – no more than 24 months.
• Data based on marketing consent – until the consent is withdrawn.
• Technical logs of the website – no more than 12 months.

8. Security of the register

Personal data is protected with appropriate technical and organisational measures: access management, strong authentication, encrypted connections (HTTPS) and encrypted database connections, regular backups, and access to personal data only for those people whose duties require it.

9. Rights of the data subject

You have the rights set out in the EU General Data Protection Regulation:

• Right of access – you can ask for a copy of the personal data stored about you.
• Right to rectification – you can ask us to correct inaccurate or incomplete data.
• Right to erasure – you can ask us to delete your data if there is no lawful basis for keeping it.
• Right to restriction of processing – you can ask us to restrict the processing in certain situations.
• Right to object – you can object to the processing, for example for direct marketing.
• Right to data portability – you can ask for your data to be transferred in a machine-readable format.
• Right to withdraw consent – where the processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint – you can lodge a complaint with the Finnish Office of the Data Protection Ombudsman: https://tietosuoja.fi.

You exercise these rights by sending a request to info@asbesti.pro. Where necessary we will ask you to verify your identity.

10. Cookies

We use cookies on the site to support functionality, analytics and, where relevant, marketing. Cookies fall into the following categories:

• Essential cookies – basic functions of the site, such as session management.
• Analytics cookies – anonymised measurement of how the site is used (for example Google Analytics).
• Marketing cookies – used only with your consent.

If you decline analytics cookies or make no choice, we still count page visits and site events anonymously, without cookies and without storing anything on your device for analytics. This is done on PostHog's servers in the EU using a hash that changes daily and cannot identify you. Session recordings and analytics cookies are only used if you accept analytics cookies.

You can manage your cookie preferences in your browser settings. Blocking the essential cookies may impair how the site works.

11. Changes to this policy

We update this privacy policy as needed when legislation or our services change. Material changes are announced on the site and, where necessary, communicated to data subjects directly.