Who is the data controller?
The data controller is the operator of this website, to whom your quote requests and orders go. The controller’s details are at the end of this page. You can send questions and requests about your data to the email address given there.
What data do we collect, and where from?
We collect the data from you directly: through the quote request form, from your emails and when you place an order.
| Source | Data |
|---|---|
| Quote request form | Name and email address (required), phone number, postcode or town, product, measurements, stone or colour preference, message and up to three attachments. The time of sending and the page language are also recorded. |
| Your message, its attachments and your contact details. | |
| Order | Delivery and installation address, billing details, the quote, the order confirmation and your acceptance of it, measurements and photos of the installation site, and messages about the order and any defect reports. |
| Use of the website | IP address and other technical data the site’s hosting provider needs to show and protect the pages. |
For a quote we only need details of the piece and your contact details, and the measuring guide explains which measurements are needed. Please do not send photos showing people or anything else we do not need for the quote.
Why do we process the data, and on what legal basis?
We process the data only to handle your quote request and order and to meet our legal obligations. The legal bases come from Article 6(1) of the EU General Data Protection Regulation (GDPR):
| Purpose | Legal basis |
|---|---|
| Replying to your quote request and preparing the quote | Steps taken at your request before entering into a contract (point b) |
| Order confirmation, making, delivery, installation, customer service and handling defect reports | Performance of the contract (point b) |
| Bookkeeping | Legal obligation under the Finnish Accounting Act (point c) |
| Keeping data after delivery in case of legal claims | Legitimate interest (point f) |
| Showing and protecting the website | Legitimate interest (point f) |
Our legitimate interest is to keep the website running and secure and to be able to investigate defect reports and respond to legal claims about a piece we have delivered.
By ticking the required box on the form, you confirm that your details may be used to handle your quote request as described in this notice. The processing is still based on your request, that is, on steps taken before a contract, not on separate consent.
We do not use your data for marketing, and we make no decisions based solely on automated processing, including profiling.
Do you have to give us your data?
Giving us your data is voluntary, but without your name and email address we cannot reply to your quote request, and without measurements and a description of the piece we cannot prepare a quote. To deliver an order we also need the delivery and installation address and billing details. Keeping bookkeeping records is required by law.
Who receives the data, and is it transferred outside the EU?
We do not sell your data or pass it on for marketing. Two service providers process the quote form data on our behalf:
| Service provider | Task | Where the data is processed | Transfer basis outside the EU |
|---|---|---|---|
| Cloudflare, Inc. (United States) | Hosting the website and handling the quote form. The text of form submissions and the attachment file names can also be stored as a backup copy, without the attachment files themselves. | According to Cloudflare, mainly in the United States and the European Economic Area, and the data can also be accessed from elsewhere. | The EU-U.S. Data Privacy Framework; if that lapses, the European Commission’s standard contractual clauses. |
| Resend (Plus Five Five, Inc., United States) | Delivering quote requests and their attachments to our inbox. | According to Resend, mainly in the United States. | The European Commission’s standard contractual clauses and Resend’s stated certification under the EU-U.S. Data Privacy Framework. |
Both act as processors, which means they process the data only to provide their service. Quote requests and emails are also stored in our email service, which we use to read and answer them. Data is disclosed to authorities only when the law requires it.
How long do we keep the data?
We keep data only as long as it is needed, and how long depends on whether the quote request leads to an order:
| Data | Retention |
|---|---|
| A quote request that does not lead to an order | As long as we need it to stay in touch about the quote. We then delete it. |
| Bookkeeping vouchers and business correspondence | At least six years from the end of the year in which the financial period ended (Accounting Act, chapter 2, section 10). |
| Data about the order, measurements, order confirmation and defect reports | As long as it may be needed to deal with defect reports and legal claims, at most ten years from delivery of the piece, unless a matter is still being handled then. |
| Technical data from use of the website | Only as long as showing and protecting the pages requires. |
The ten-year limit comes from the Finnish Act on the Limitation of Debts (laki velan vanhentumisesta): a claim based on a defect usually becomes time-barred three years after the buyer discovered the defect or should have discovered it, and the limitation must be interrupted within ten years of the breach of contract at the latest (sections 4 and 7).
What are your rights?
Under the GDPR you have the right to:
- Know what data we process about you and get a copy of it (Article 15)
- Have inaccurate data corrected (Article 16)
- Have your data erased when it is no longer needed and the law does not require us to keep it (Article 17)
- Have the processing restricted (Article 18)
- Receive the data you gave us in a machine-readable format and transfer it to another controller, when the processing is based on a contract and carried out by automated means (Article 20)
- Object to processing based on our legitimate interest (Article 21).
Send your request by email. The controller’s contact details are at the end of this page. We reply without undue delay and within one month at the latest (Article 12), and we may ask for more information to confirm your identity.
If you think the processing of your data breaks data protection law, you can lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):
- Visiting address Lintulahdenkuja 4, 00530 Helsinki
- Postal address PL 800, 00531 Helsinki
- Switchboard 029 566 6700
- Email tietosuoja(at)om.fi
- Website tietosuoja.fi, which also has an online notification form.
Do we use cookies?
Our website uses no analytics or marketing cookies, and the site’s own code stores no cookies on your device. That is why we do not ask for cookie consent.
Cloudflare, the site’s hosting provider, may set a strictly necessary security cookie if Cloudflare’s bot protection is switched on for the site. Cloudflare describes its cookies as strictly necessary to provide its services. The Finnish Act on Electronic Communications Services allows strictly necessary cookies without consent (section 205), and according to guidance from Traficom, the Finnish Transport and Communications Agency, a cookie needed for the secure use of a service does not require consent.
If we later start using cookies that require consent, we will ask for your consent before using them.
How is the data protected?
The website and the quote form use an encrypted HTTPS connection, and form data is passed to the email delivery service over an encrypted connection. Only people who need the data to handle a quote or an order have access to it.
Changes to this notice
We update this notice if the way we process data changes. This version is effective from 13 November 2026. The steps of an order are described on how to order, and orders are subject to our order terms.