Privacy Policy
Last updated: 1 October 2026
This Privacy Policy explains how Svalo processes the personal data of customers, prospective customers, contact persons and users of our website.
We process personal data carefully, transparently and only to the extent necessary for our business operations, customer service, performance of contracts, marketing and compliance with our legal obligations.
Contents
- Data Controller
- Whose personal data do we process?
- For what purposes do we process personal data?
- What personal data may we process?
- Where do we obtain personal data from?
- How long do we retain personal data?
- Who may receive or process personal data?
- Is personal data transferred outside the EU or EEA?
- Cookies and similar technologies
- Profiling and automated decision-making
- Protecting personal data
- Your rights
- Right to lodge a complaint
- Changes to this Privacy Policy
1. Data Controller
Svalo
Business ID: 3552482-4
For matters relating to data protection, please contact:
Joona Korvenaro
joona.korvenaro@svalo.fi
2. Whose personal data do we process?
We may process personal data relating to individuals who, for example:
- are or have previously been our customers
- have requested a quotation or contacted us
- are prospective customers
- are contact persons for corporate customers or business partners
- use our website
- have participated in our marketing or interacted with us through social media or advertising platforms.
3. For what purposes do we process personal data?
Handling enquiries and quotation requests:
When you contact us through a website form, by email, by phone, through social media or by other means, we process the information you provide in order to respond to your enquiry, assess your needs and, where applicable, prepare a quotation.
The processing may be based on steps taken at your request prior to entering into a contract or on our legitimate interest in responding to enquiries addressed to us.
Managing customer relationships and orders:
If you order products or services from Svalo, we may process your personal data for purposes such as:
- processing quotations and orders
- product planning and measurements
- arranging deliveries and installations
- communicating with the customer
- invoicing and payment monitoring
- warranty and complaint matters
- establishing, exercising or defending potential legal claims.
The processing is primarily based on the contract entered into with the customer. Certain processing may also be based on our legal obligations or our legitimate interest in managing and documenting the customer relationship.
Developing our services and business:
We may use information generated through customer relationships, enquiries and website use to develop our services, customer experience and business operations, as well as for statistical purposes and internal reporting.
Where possible, such information is processed in aggregated form or in a manner that does not require the identification of an individual.
Marketing:
We may process contact details for the marketing of our products and services to the extent permitted by applicable law.
Electronic direct marketing sent to consumers, such as marketing emails and text messages, is based, where required, on the user's consent or another lawful basis permitted by law.
You may always object to marketing, and any consent you have given may be withdrawn at any time.
Website operation and analytics:
Use of our website may generate technical information, for example in server logs. This information may be processed to ensure the technical operation and security of the website, prevent misuse and investigate technical issues.
We may use analytics services, such as Google Analytics, to help us understand how the website is used and to improve its content and functionality.
Non-essential analytics and marketing cookies and similar technologies are used in accordance with the cookie and privacy choices made by the user.
Digital advertising:
We may use services provided by Google, Meta, TikTok or other similar service providers to carry out and measure digital advertising.
With the user's consent, technologies provided by these services may be used, for example, to:
- measure advertising effectiveness
- target advertising
- carry out remarketing
- create advertising audiences
- assess whether an advertisement leads to, for example, a website visit or an enquiry.
Up-to-date information about the analytics and marketing technologies used on the website is available in the website's cookie settings.
4. What personal data may we process?
We may process, for example, the following categories of personal data:
Basic and contact information:
- name
- telephone number
- email address
- address
- postal code
- city or municipality
Customer and order information:
- quotation requests and quotations
- products and services ordered
- contracts
- delivery and installation information
- invoicing and payment information
- warranty and complaint information
- communications relating to the customer relationship
Information relating to the installation site:
- address of the installation site
- measurements and other technical information relating to the site
- plans
- photographs and other information about the site provided by the customer
Information relating to corporate customers:
- company name and Business ID
- name and position of the contact person
- company contact details
Marketing-related information:
- marketing consents and objections
- information concerning the receipt or performance of marketing communications, to the extent such information is collected
Technical website data:
- IP address
- technical information about the browser and device
- date and time of the visit
- visits to different parts of the website
- traffic source
- information relating to cookies or similar identifiers
- events describing website use, to the extent that their collection is permitted.
5. Where do we obtain personal data from?
Personal data is primarily obtained directly from the individual, for example:
- through the website contact form
- by email
- by phone
- during a meeting or measurement visit
- when preparing a quotation or entering into a contract
- during the customer relationship
- through contact forms on social media or digital advertising platforms.
Additional information may be generated in connection with the planning, ordering, delivery and installation of products, invoicing and other activities relating to the management of the customer relationship.
Where necessary, information may also be supplemented, within the limits permitted by law, using public sources and company or organisation registers.
6. How long do we retain personal data?
We retain personal data only for as long as it is needed for the purpose for which it was collected or for as long as required by law.
Enquiries and quotation requests that do not result in a customer relationship are generally retained for no more than 24 months from the most recent contact, unless there is a justified reason for a longer retention period.
Customer, contract and order information is retained for the duration of the customer relationship and thereafter for as long as the information is required, for example, in connection with contractual obligations, warranties, complaints or potential legal claims.
Accounting, invoicing and other information subject to statutory retention requirements is retained for the period required by law.
Information processed on the basis of marketing consent is retained until the consent is withdrawn or the purpose of the processing otherwise ends. Information concerning an objection to marketing may be retained to ensure that marketing to which the individual has objected is not sent to them.
Technical log data is retained only for as long as necessary for information security and technical maintenance purposes.
The retention periods for data processed by analytics and advertising services depend on the services used and their settings.
7. Who may receive or process personal data?
Svalo does not sell its customers' personal data without the customer's consent or permission.
We may use service providers that process personal data on our behalf or have access to such data to the extent necessary to provide their services.
Such service providers may include, for example:
- website hosting, maintenance and form service providers
- email, cloud storage and office software providers, such as Google Workspace
- invoicing, accounting and financial administration service providers
- product manufacturers, suppliers, installers and other subcontractors where the information is necessary to fulfil an order
- IT and information security service providers
- debt collection, legal and other professional service providers
- analytics and advertising service providers, such as Google, Meta and TikTok, where such services are in use.
Personal data may also be disclosed to public authorities or other parties where required by law.
8. Is personal data transferred outside the EU or EEA?
Some of the international service providers we use may process personal data outside the European Union or the European Economic Area.
Where personal data is transferred outside the EU or EEA, appropriate safeguards required under applicable data protection legislation are used. These may include an adequacy decision adopted by the European Commission, standard contractual clauses approved by the European Commission or another transfer mechanism permitted by law.
9. Cookies and similar technologies
The website may use cookies or similar technologies that are necessary for its operation and security.
With the user's consent, analytics, marketing and other non-essential cookies or identifiers may also be used.
You can accept or reject non-essential technologies and change your choices later through the website's cookie settings.
Up-to-date information about the cookies used on the website, the relevant service providers and the purposes for which they are used is available in the website's cookie settings.
10. Profiling and automated decision-making
Svalo does not make fully automated decisions based on personal data that produce legal effects concerning an individual or similarly significantly affect them.
Where the user has consented to the use of marketing and analytics technologies, advertising platforms may use website activity to create advertising audiences or other groups used for marketing purposes.
11. Protecting personal data
Access to personal data is restricted to individuals and service providers who require the information to perform their duties.
Electronic data is protected using appropriate technical and organisational measures, such as access controls, usernames and passwords, strong authentication where available, keeping systems up to date and other appropriate information security practices.
Any paper records containing personal data are stored in a manner that prevents access by unauthorised persons.
12. Your rights
Depending on the circumstances and in accordance with applicable data protection legislation, you may have the right to:
- receive information about how your personal data is processed
- obtain confirmation as to whether we process your personal data and receive a copy of that data
- request the correction of inaccurate or incomplete information
- request the deletion of your personal data
- request the restriction of processing
- object to the processing of personal data based on legitimate interests
- object to the use of your personal data for direct marketing
- withdraw your consent at any time
- in certain circumstances, receive personal data you have provided in a machine-readable format and transmit that data to another data controller.
The availability of these rights depends, among other things, on the legal basis on which the personal data is processed.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
A request for deletion cannot be fulfilled to the extent that the continued retention of personal data remains necessary, for example, in order to comply with a legal obligation.
You can submit a request concerning your rights to:
joona.korvenaro@svalo.fi
We may ask you to provide additional information where necessary to verify your identity before fulfilling your request.
13. Right to lodge a complaint
If you believe that your personal data has been processed in breach of applicable data protection rules, you may contact Svalo so that the matter can be investigated.
You also have the right to lodge a complaint with the competent supervisory authority. In Finland, the supervisory authority for data protection is the Office of the Data Protection Ombudsman.
14. Changes to this Privacy Policy
We may update this Privacy Policy, for example, if our operations, systems, service providers, website features or applicable legislation change.
The current version of this Privacy Policy is available on this page. The date on which the policy was last updated is shown at the beginning of the page.