Privacy policy
This policy was updated on 2 September 2026. In case of any discrepancy, the Finnish version of this policy applies.
Controller and contact person
HK-Säätö Oy · Business ID 0872658-6 · Kilonkallio 3 A, 02610 Espoo, Finland · 010 325 4300 · hksaato@hksaato.fi
Contact person for data protection matters: Kari Malinen, Managing Director · kari.malinen@hksaato.fi · 010 325 4301
Data protection requests can also be sent to gdpr@hksaato.fi.
What data we process and why
| Situation | What data | Why and on what basis | For how long |
|---|---|---|---|
| Contact and survey request | name, phone, email, address or name of the building, message | replying to the contact and agreeing on a survey; preparation of a contract | until the matter is handled, or for the duration of the customer relationship |
| Work order | details of the work and the building, contact persons on site, orderer and invoicing details | carrying out and invoicing the ordered work; performance of a contract | for the duration of the customer relationship and after it for the period required by the Accounting Act (6 years from the end of the financial year) |
| Kiinteistöpilvi demo credentials | name, company or housing company, role, email, phone | delivering the credentials and guiding their use; preparation of a contract and legitimate interest | for the duration of the demo and at most 12 months after it ends |
| Customer relationship | name, position, work email and phone of the customer organisation's contact persons; contract, invoicing and maintenance data | performance of a contract, invoicing, maintenance and alarm monitoring; legitimate interest in managing the customer relationship | for the duration of the customer relationship and after it for the period required by the Accounting Act; alarm and maintenance history for the life cycle of the device |
| Marketing | name, position, work email and phone of contact persons at potential customers | contacting housing companies, property managers and property owners; legitimate interest | until you prohibit direct marketing or the data becomes outdated |
| Recruitment | application, CV, contact details, references with consent | preparation of an employment contract; consent | for the duration of the recruitment and at most 12 months after it ends, unless the applicant gives permission for longer |
| Personnel | data needed to manage the employment relationship | performance of the employment contract and statutory obligations | for the duration of the employment and the period required by law after it |
We receive the data mainly from you: from a form, by phone, by email or in connection with a contract. Contact details of potential customers may also be obtained from public sources, such as companies' own websites and the Trade Register.
We do not process personal identity codes other than in payroll for our personnel. We do not make automated decisions and we do not carry out profiling.
Visitor data on the website
The site hksaato.fi is built so that it collects as little as possible about the visitor.
Visitor counts. We use Cloudflare Web Analytics, which counts page loads and page load speed. It does not use cookies or browser storage, does not create an identifier for an individual visitor and does not follow the visitor between sites. We see page-level visitor counts, country, browser type and device type as an aggregate, not individual users.
Forms. Form data is forwarded as email to HK-Säätö's mailbox and is not stored on the site or on its server. The forms are protected by Cloudflare's Turnstile check, which distinguishes a human from an automated sender. Turnstile processes technical data about the sender's browser for the duration of the check and does not set cookies.
Video. The Kiinteistöpilvi presentation video is played from Cloudflare Stream. The player is loaded only when the video becomes visible, and it does not set tracking cookies.
Weather panel. The “right now” panel on the front page shows the outdoor temperature for the visitor's municipality. The municipality is determined on the server from the coarse location that Cloudflare derives from the IP address. Neither the location nor the IP address is stored, and only the name of the municipality and the temperature are sent to the browser. If the municipality cannot be determined, the panel shows Espoo.
Server logs. The site runs on Cloudflare's network. Cloudflare processes technical data about requests, such as the IP address, to ensure security and the functioning of the service. This data is not used to identify the visitor and is not combined with other data.
The site has no other third-party scripts, ad networks, social media buttons or tracking. Fonts and images are served from the site's own server.
Cookies
The site does not set cookies and does not store data in your browser. The only exception is the site's own light and dark theme choice, which is stored in the browser's local storage only if you change the theme yourself; that information never leaves the browser. Because there is no tracking and no non-essential storage, the site does not ask for cookie consent.
The Kiinteistöpilvi service (kirjaudu.kiinteistopilvi.fi) is a separate application in which signing in requires a session cookie. Its data protection is described in the service's own policy.
Who the data is disclosed to
The data is processed by HK-Säätö's own employees according to their duties. In addition we use service providers who process data on our behalf and in accordance with our agreement:
- Cloudflare (website, forwarding of forms, visitor counting, Turnstile and video playback)
- Microsoft (email and office systems)
- a financial administration and invoicing service provider
- technical maintenance of the Kiinteistöpilvi service, when the customer uses Kiinteistöpilvi
We do not sell or rent personal data. We disclose data to the authorities only when required by law.
Transfers outside the EU
Data is stored primarily within the EU. Cloudflare and Microsoft are United States companies whose services may also process data outside the EU. Both have committed to the EU–US Data Privacy Framework, and in addition the standard contractual clauses approved by the European Commission are used in transfers.
How the data is protected
The data is in electronic form and only those employees whose duties require it have access. Connections are encrypted. Form data is not stored on the website at all, so a data breach of the site cannot expose it.
Your rights
You have the right to
- be told what data we process about you, and to receive a copy of it
- ask for incorrect data to be corrected or incomplete data to be completed
- ask for your data to be erased, when there is no longer a basis for processing
- prohibit direct marketing at any time
- object to processing or ask for it to be restricted, when processing is based on our legitimate interest
- withdraw your consent, if processing is based on it
- receive the data you have given in a machine-readable form for transfer elsewhere.
Requests: kari.malinen@hksaato.fi or by post to Kilonkallio 3 A, 02610 Espoo, Finland. We reply within one month. We may ask you to confirm your identity before disclosing data.
If you consider that we process your data unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman: tietosuoja.fi.
Changes to this policy
We update this policy when our operations or legislation change. The version in force is always on this page, and the date of the update is at the top of the page.