This policy explains how personal data is processed when you visit veridexaa.com or correspond with Veridexaa Analytics. It is issued under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.
1. Controller
The controller is Veridexaa Analytics Group, which operates Veridexaa Analytics as an independent analytical publication at Linnoitustie 6–9, 02600 Espoo, Finland. Privacy and data protection matters: privacy@veridexaa.com.
2. Scope
This policy covers the website veridexaa.com in all language editions and email correspondence sent to any veridexaa.com address. It does not cover third-party websites or services referred to in our content.
3. Legal framework
Processing is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act (1050/2018). Storage of information on your device is governed by the Finnish Act on Electronic Communications Services (917/2014), which implements Article 5(3) of Directive 2002/58/EC.
4. Data we process
Correspondence data: the name, organisation, role, email address and message content that you choose to send us by email, including messages prepared with the inquiry form. Technical data: IP address, date and time, requested address, referring page and browser user agent, recorded in server logs by our hosting provider. Consent record: your cookie choice and the time it was made, stored only in your own browser's local storage and not transmitted to us. The inquiry form does not send data to this website; it opens your own email client with a pre-filled message.
5. Purposes and legal bases
Answering inquiries and technical audit requests: legitimate interests (Art. 6(1)(f)) in responding to correspondence, or steps taken at your request before entering into a contract (Art. 6(1)(b)). Operating and securing the website through server logs: legitimate interests (Art. 6(1)(f)) in availability and security. Remembering your consent choice: compliance with a legal obligation (Art. 6(1)(c) together with Art. 7(1)). Optional analytics, if enabled in future: your consent (Art. 6(1)(a)). Accounting records for any contracted work: legal obligation (Art. 6(1)(c)) under the Finnish Accounting Act (1336/1997).
6. Sources of data
Correspondence data is received directly from you. Technical data is generated automatically when your browser requests pages from our server. We do not buy personal data or enrich it from third-party sources.
7. Recipients and processors
Personal data is disclosed only to service providers that process it on our behalf under agreements meeting Article 28 GDPR, namely our hosting provider and our email service provider. Fonts are delivered by Google Fonts (Google Ireland Limited), which receives your IP address when the font files are requested. We do not sell personal data. Data may be disclosed to authorities where we are legally required to do so.
8. International transfers
We aim to process personal data within the European Economic Area. Where a processor transfers data outside the EEA, the transfer relies on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on standard contractual clauses under Commission Implementing Decision (EU) 2021/914, together with an assessment of the transfer.
9. Retention
Correspondence is retained for up to 24 months after the last exchange, unless it becomes part of a contract, in which case it is retained for the duration of the contract and the applicable limitation period. Server logs are retained according to the hosting provider's configuration and are not used for profiling. Accounting records are retained for the periods required by the Finnish Accounting Act. The consent record remains in your browser until you clear it or change your choice.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
11. How to exercise your rights
Send your request to privacy@veridexaa.com. We respond within one month of receipt; this period may be extended by two further months for complex or numerous requests, in which case we will inform you within the first month (Art. 12(3)). We may ask for information needed to confirm your identity.
12. Security
The website is served exclusively over encrypted HTTPS connections. Access to correspondence is restricted to the personnel who handle it. The website itself does not store form submissions, and we apply data minimisation to the information we request.
13. Personal data breaches
If a personal data breach occurs, we notify the supervisory authority within 72 hours of becoming aware of it where required by Article 33, and inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34).
14. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects (Art. 22).
15. Children
The website is a business-to-business publication and is not directed at children. We do not knowingly process personal data of children.
16. Obligation to provide data
You are not obliged to provide personal data. Without contact details we cannot reply to an inquiry.
17. Supervisory authority
You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland (www.tietosuoja.fi) or with the supervisory authority of your habitual residence or place of work in the EU or EEA.
18. Changes and contact
We update this policy when our processing changes; the date of the current version is shown above. Questions: privacy@veridexaa.com, Veridexaa Analytics Group, Linnoitustie 6–9, 02600 Espoo, Finland.