How we handle personal data

Controller

Refinite Oy, Business ID 3651856-5, Helsinki, Finland. For privacy matters, contact privacy@refinite.fi.

This website

Cookies and analytics

This website does not use cookies, local or session storage, advertising pixels, or cross-site tracking.

Visitor statistics

We use Plausible Analytics, which processes visitor data in the EU, to understand how the site is used and improve it. Our legal basis for processing personal data for this purpose is our legitimate interest in understanding and improving the website (GDPR Article 6(1)(f)).

Plausible processes your IP address and browser information to derive approximate location and device statistics and to generate a daily visitor identifier. It does not store raw IP addresses or raw browser user-agent strings. The identifier is specific to this website, and the salt used to generate it is rotated and deleted every 24 hours. It cannot recognise the same visitor across days or websites. We receive aggregate statistics, including page views and referral sources, rather than identified visitor profiles. See Plausible's data policy.

Daily identifier rotation does not delete historical statistics. Plausible stores event and session records to produce those statistics; deleting our site data or account instructs Plausible to delete the associated statistics under its data processing agreement. We keep website statistics for up to three years, the retention period of our Plausible plan, after which Plausible deletes them.

Hosting

Hostinger hosts this site on servers in the EU and processes technical request data such as your IP address, the requested page, browser information, and the time of the request. The purpose is to deliver the site, diagnose errors, and protect it against misuse. The legal basis is our legitimate interest in operating a secure, working website (GDPR Article 6(1)(f)).

Hostinger keeps these logs only as long as needed for security and troubleshooting, under its data processing addendum.

Business contacts and prospects

We contact managers and experts at industrial companies whose work relates to process performance, to offer our process-optimisation services.

What data we process

Name, job title, employer and work location; work email address and phone number; professional profile links such as LinkedIn; and notes on our contacts with you, including messages you send us and any wish not to be contacted. We do not seek private contact details or special categories of personal data.

Where it comes from

Your employer's public website, annual reports and press releases; professional networks such as LinkedIn; industry events; and you, when you reply to us or meet us. We may form your work email address from your employer's standard address format.

Purposes and legal bases

We research professional contacts and carry out permitted business marketing on the basis of our legitimate interest in finding business customers for our process-optimisation services (GDPR Article 6(1)(f)). We contact you only if our offer relates to your responsibilities. Where national law requires prior consent for electronic marketing, we do not email you without it; consent-based marketing relies on GDPR Article 6(1)(a).

We answer business enquiries, discuss potential work, and manage relationships with customer and partner organisations on the basis of our legitimate interest in responding to requests and conducting our business (GDPR Article 6(1)(f)). If you personally enter into a contract with us, processing needed to take steps at your request before that contract or to perform it relies on GDPR Article 6(1)(b). We retain records required by accounting and other applicable law to comply with our legal obligations (GDPR Article 6(1)(c)).

You choose whether to provide contact details when you enquire or reply to us. Without the details needed to handle your request, we may be unable to answer it or arrange the work you request. If we enter into a contract, we need the details necessary to perform it and meet any applicable recordkeeping obligations.

Who receives it

We do not sell personal data. Our service providers process data to provide their services to us: Hostinger for website hosting, Plausible for website statistics, and Proton AG for business email. Each receives the data needed for its service, as described in this notice.

Proton processes our email data in Switzerland. The European Commission recognises Switzerland as providing an adequate level of data protection, so that transfer relies on GDPR Article 45. See the Commission's adequacy decisions.

Some of our providers use subcontractors outside the EU/EEA, such as Hostinger's use of Cloudflare, Inc. in the United States. Where a country does not have an adequacy decision, those transfers rely on the European Commission's standard contractual clauses (GDPR Article 46).

How long we keep it

During prospect research, we keep a record while checking the person's role and whether an approach is relevant and permitted. If we decide not to contact you, we delete that prospect record when the assessment is complete.

If you do not reply to our outreach, we delete your prospect data 12 months after our last contact, unless you object sooner. If you reply or send an enquiry without becoming a customer, we retain the correspondence while answering your request, discussing potential work, or completing follow-up you have agreed to. When those discussions and follow-up end, we delete the data unless a specific legal obligation or an unresolved legal claim requires us to retain it.

For customers and partners, we keep ordinary business contact details and correspondence while the relationship is active and until outstanding work, payments, and other contractual obligations are resolved. We then delete them, except for records that must be kept to comply with the law or handle an unresolved legal claim. Records retained for a claim are deleted when it is finally resolved, unless a statutory retention requirement still applies.

Finnish accounting law requires transaction vouchers and related accounting correspondence to be retained for at least six years from the end of the calendar year in which the financial year ended, and financial statements, accounting books, and certain other accounting records for at least ten years from the end of the financial year. These requirements apply to the relevant accounting records, rather than all prospect or business correspondence. See the Accounting Act, Chapter 2, Section 10. Where a longer statutory requirement applies to a particular record, we retain that record for the required period.

If you object to marketing, we remove your data from our marketing contacts and keep only the identifiers needed to respect your objection, such as your name and email address, on a do-not-contact list. We use that list only to prevent further marketing, not to contact you. Our legal basis is our legitimate interest in maintaining an effective record of objections (GDPR Article 6(1)(f)). We retain an entry while we conduct outreach that could otherwise include you, and delete it when we permanently stop that outreach and no longer need it to prevent contact.

Your rights

Stop marketing

You can object to our use of your data for marketing at any time, free of charge and without giving a reason. Reply “no” to any of our marketing messages or contact privacy@refinite.fi. We will stop using your data for marketing. You do not have to use any particular wording to object.

Access, correction, and other rights

You can request access to your personal data, its correction or deletion, or the restriction of its processing, subject to the conditions in the GDPR. You can also object, on grounds relating to your particular situation, to other processing based on our legitimate interests. Contact privacy@refinite.fi.

Where processing relies on your consent, you can withdraw that consent at any time by replying to us or contacting privacy@refinite.fi. Withdrawal does not affect the lawfulness of processing before you withdrew consent. Where the conditions in GDPR Article 20 are met, you can also receive the data you provided in a structured, commonly used, machine-readable format and request its transfer to another controller. This applies to automated processing based on consent or a contract; it does not apply to our processing based on legitimate interests.

We normally respond to rights requests within one month and without charge. If a permitted extension is needed, we will explain it within that first month. You can read more about the conditions for these rights in the European Data Protection Board's guide.

Complaints

You have the right to lodge a complaint with a competent data protection authority, in particular in the EU country where you live or work, or where you believe an infringement occurred. In Finland, this is the Data Protection Ombudsman (tietosuoja.fi).