Updated 7.8.2026
This notice explains how personal data is processed on the website www.arvekari.fi. The notice has been prepared in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (2016/679, GDPR) and the Finnish Data Protection Act (1050/2018).
1. Data controller
Markku Arvekari
Email: markku@arvekari.fi
The data controller has not appointed a data protection officer because the conditions of Article 37 of the GDPR are not met.
2. What personal data is processed
2.1 Contact form
- name
- email address
- message content
2.2 Comments
If commenting is enabled on the site, the following are stored in connection with a comment: name, email address, comment content, IP address and browser identifier.
2.3 Server logs
The web server automatically stores, for each request, the IP address, timestamp, requested address, browser identifier and any referring page. Log data is used to ensure the operation of the service, to investigate errors, and for information security.
2.4 Cookies
The site uses cookies. See section 7.
3. Purpose of processing and legal basis
| Purpose | Legal basis |
|---|---|
| Responding to inquiries and managing the customer relationship | Pre-contractual measures or the data controller’s legitimate interest (GDPR Art. 6(1)(b) and (f)) |
| Publishing and moderating comments | Legitimate interest (GDPR Art. 6(1)(f)) |
| Technical operation of the service, information security and prevention of misuse | Legitimate interest (GDPR Art. 6(1)(f)) |
| Non-essential cookies | Consent (GDPR Art. 6(1)(a), Act on Electronic Communications Services Section 205) |
| Compliance with statutory obligations | Legal obligation (GDPR Art. 6(1)(c)) |
4. Where the data is obtained from
All personal data is obtained from the data subject themself when they submit a form or comment, or is generated automatically when using the site (log data and cookies). Data is not collected from external sources.
5. Retention period
- Inquiries: retained for as long as required to handle the matter, up to a maximum of 24 months from the most recent inquiry. If an inquiry results in a customer relationship, the data is retained for the duration of the customer relationship and thereafter for the period required by the Accounting Act.
- Comments: retained until further notice or until the data subject requests deletion.
- Server logs: up to 12 months.
- Cookies: see section 7.
6. Recipients of the data and transfer outside the EU
Personal data is not sold or disclosed for marketing purposes. The data is processed by the following service providers acting on our behalf:
- Web hosting and email: Suomi Solutions and Micrsoft, servers located in the EU/EEA.
Machine translation of the site content. The text content of the site’s articles and pages is translated automatically using OpenAI’s API. In processing, the site’s own public content is transferred, not the personal data from the contact form or comments. However, if published content nevertheless contains personal data, it will in this context be transferred to the United States. The transfer is based on the European Commission’s approved Standard Contractual Clauses and the EU–U.S. Data Privacy Framework.
7. Cookies
A cookie is a small text file that the site stores in your browser.
- Essential cookies. A cookie that remembers your language selection (
arvekari_lang) as well as a cookie that stores your cookie consent. These are necessary for operation and do not require consent. Validity period up to 12 months. - Non-essential cookies. These are enabled only with your consent. You can change or withdraw your consent at any time in the site’s cookie settings.
You can also block or delete cookies in your browser settings. Blocking essential cookies may impair the functionality of the site.
8. Automated decision-making and profiling
Personal data is not used for automated decision-making or profiling.
9. Rights of the data subject
You have the right to:
- access your data and obtain a copy of it (GDPR Art. 15)
- request rectification of inaccurate data (Art. 16)
- request erasure of your data (Art. 17)
- request restriction of processing (Art. 18)
- transfer your data from one system to another when processing is based on consent or a contract (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw the consent you have given at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3))
Requests should be sent to the email address mentioned in section 1. Requests will be answered within one month. Your identity may need to be verified before fulfilling the request.
10. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data is contrary to data protection legislation, you may lodge a complaint with the supervisory authority:
Office of the Data Protection Ombudsman
P.O. Box 800, 00531 Helsinki
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Telephone: 029 566 6700
Email: tietosuoja@om.fi
tietosuoja.fi
11. Protecting the data
The site uses an encrypted HTTPS connection. Administrative access requires a personal username and password. The service provider is responsible for the technical information security of the server environment. Access to personal data is limited only to those who need it to perform their duties.
12. Changes to this notice
This notice is updated when the content of the processing or the services used change. The current version is always available on this page. At the top of the page you can see when the notice was last updated.