GDPR PRIVACY POLICY

Last updated: April 29, 2026

This policy describes how Oravalan Oy processes your personal data when you contact us via our website forms at www.artsanfinland.fi or www.oravalan.fi, or provide us with your billing information by other means.

1. Data Controller

Company: Oravalan Oy - www.artsanfinland.fi - www.oravalan.fi

Business ID: 2578539-3

Address: Otavantie 11, 52550 Hirvensalmi, Finland

Email: eero@artsanfinland.fi and eero@oravalan.fi

2. Personal Data Collected

We collect the following information through the contact forms:

Basic Information: Name, email address, phone number, and message content.

Billing Information (Companies): Company name, Business ID, billing address, e-invoice address, or email.

Billing Information (Private Individuals): Recipient's name, postal address, and if necessary, email address for electronic invoices. A postal address is always required for invoicing to identify the customer.

3. Legal Basis and Purpose of Processing

We process data for the following purposes:

Responding to inquiries and customer service

Legal basis: Legitimate interest

Service delivery, quotations, and contract management

Legal basis: Contract or pre-contractual measures

Invoicing and accounting

Legal basis: Legal obligation (Accounting Act)

4. Data Retention Period

We retain data only as long as necessary to fulfill the defined purposes:

Contact Information: Deleted after 6 months unless the contact leads to an agreement.

Invoicing and Accounting Records: Retained for 6 years from the end of the financial year in accordance with the Finnish Accounting Act.

Private Individual Billing Data: If the order does not proceed, data is deleted without delay.

5. Disclosure of Data

Your data is processed confidentially. We may disclose information to third parties in the following cases:

• Service Providers: We use trusted partners, such as invoicing software, accounting firms, and IT service providers.

• Logistics: Postal address information may be disclosed to transport companies for the delivery of orders or paper invoices.

• Authorities: Statutory information disclosure obligations (e.g., tax authorities).

6. Rights of the Data Subject

You have the right to:

• Access the data stored about you.

• Request the correction of inaccurate data.

• Request the deletion of your data ("right to be forgotten"), subject to legal retention obligations.

• Object to or restrict the processing of your data.

• File a complaint with a data protection authority.

7. Data Protection

We ensure the security of your personal data by using appropriate technical solutions and secure internal procedures in our organization.