1. General
We want you to know how we process your information openly and securely. This page explains what information our website may process, how it is used, and what rights you have.
We respect your privacy and always process personal data in accordance with good data protection principles.
2. Data Controller
| Name: | Rafly Oy |
| Email: | contact@rafly.io |
The data controller is responsible for the processing of personal data and for complying with applicable data protection legislation.
3. Why We Process Personal Data and on What Legal Basis
We process personal data so that we can:
- respond to enquiries, requests for quotations, project requests and other messages
- understand the user’s needs and the content of their enquiry and manage communications
- maintain and develop customer and business relationships
- provide services requested by the user and prepare for a possible agreement or cooperation
- maintain and develop the functionality, usability and technical quality of the website
- ensure the secure and uninterrupted operation of the website
- prevent spam, misuse and information security threats
- monitor and analyse website usage and traffic in accordance with the user’s cookie settings and consents
- process responses voluntarily provided through interactive elements on the website and create aggregated or anonymised results from them
- use interactive responses provided within a short period of time as possible additional context for a later enquiry
Depending on the situation, the processing of personal data is based on the performance of a contract or measures requested by the user prior to entering into a contract, the legitimate interests of the data controller, compliance with a legal obligation, or the user’s consent.
The legitimate interests of the data controller may include, for example, responding to enquiries, maintaining customer and business relationships, taking previous communication history into account, developing services, and maintaining the operation and security of the website.
If a user submits multiple enquiries using the same email address, a new enquiry may be associated with previous enquiries submitted using the same email address. This may be used to understand the overall communication history and to manage the customer relationship. However, the content of a previous enquiry is not automatically considered to be part of a new project or enquiry.
If information has been submitted through a contact form, the data controller may, after the enquiry and with the customer’s consent, create a user account where necessary for use of the website or for maintaining the customer relationship.
The user will be informed separately if an account is created. Information associated with the user account is processed to technically enable the operation of the website and user management.
4. What Information May Be Collected
The website may process information such as:
- name, email address, telephone number, company name and other contact details provided by the user
- the content of enquiries, requests for quotations, project requests and other messages
- information voluntarily provided by the user regarding a project, goals, needs, budget, schedule or other matters related to an enquiry
- responses given to interactive questions, surveys and similar elements on the website
- the question associated with an interactive response, the time of the response and, where necessary, the page or context in which the response was given
- a random and temporary identifier that may be used to associate interactive responses provided within a short period of time with a later enquiry
- previous enquiries and their dates where the enquiries have been submitted using the same email address
- IP address and browser information for spam prevention, prevention of misuse and information security purposes
- cookie settings and consents through Cookiebot
- page views and device information for analytics purposes in accordance with the user’s cookie settings
- technical and administrative information related to a user account where an account has been created for the user
- information stored on the website by a logged-in user, such as text, images and other content
Interactive Questions and Responses
The website may contain voluntary questions, surveys or other interactive elements. Responses provided by users may be used to develop the website’s content and services and may also be shown to other users as aggregated or anonymised results.
For example, the website may show how many users, or what percentage of users, selected a particular option or what general views or themes appear in the responses.
Information provided by users is not generally displayed to other users in its original form. Responses to interactive questions may, however, be used as aggregated or anonymised results in a way that is not intended to identify an individual respondent. Content that can be linked to an identifiable individual will not be published to other users without the user’s explicit consent.
An interactive response may be temporarily stored in association with a random identifier. If the user submits an enquiry or project request within 30 minutes of providing the response, responses associated with the same temporary identifier may be attached to that enquiry as possible additional context.
A response previously given elsewhere on the website is not automatically interpreted as a requirement or confirmed project detail relating to a later project request. The response may have been provided, for example, out of general interest, in relation to another need, or while exploring the website’s content.
If an enquiry is not submitted within the specified period, the temporary responses will not be associated with an identified enquiry and the temporary connection to any possible later enquiry will end.
If the user later submits a new enquiry using the same email address, the system may recognise that the same email address has previously been used to contact us. Previous enquiries will nevertheless remain separate enquiries, and their content will not automatically be transferred into the details of a new project.
Information Added by Logged-In Users
A logged-in user may choose to store content on the website, such as text or images. Such information is processed to enable the operation of the website, provide services requested by the user, support shared objectives and maintain the customer relationship.
Information added by a logged-in user may be visible to Rafly Oy personnel who require access to it for their work, as well as to website administrators. The website administrator or the company may also access the information where necessary to maintain the website, ensure its technical operation or protect its security.
Information added by users is not shared with other users in its original form without the user’s explicit consent. An exception applies to the aggregated or anonymised results of interactive questions described above, which may be displayed to other users of the website.
5. Cookies and Analytics
The website uses cookies so that it functions correctly and so that we can continue to improve it. Cookiebot manages cookie consents and prevents non-essential cookies from being used before consent has been given. Google Analytics collects anonymous information about how the website is used — for example, which pages are visited, where visitors come from and what types of devices are most commonly used. This information is used to develop the website, improve usability and identify technical problems. The information is not used to identify individual users. Users may choose to block analytics through their browser settings or cookie preferences.
6. Where the Information Comes From
Information is obtained primarily from the user directly, for example through a contact form or when logging in, as well as automatically through cookies and analytics tools.
7. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected and processed.
Information relating to enquiries, requests for quotations and project requests that do not result in a customer relationship may normally be retained for up to two years from the most recent communication. If further communication takes place during this period, the retention period may be calculated from the most recent interaction.
This retention period allows us to respond to follow-up enquiries, understand previous communications and recognise previous enquiries submitted using the same contact details.
Where an enquiry develops into a customer, contractual or other ongoing business relationship, relevant information may be retained for the duration of that relationship and for a reasonable period afterwards where necessary for customer relationship management, contractual matters, the establishment, exercise or defence of legal claims, or other legitimate business purposes.
Information that forms part of accounting, taxation or other records that must be retained by law may be stored for the periods required by applicable legislation.
Interactive responses may be temporarily associated with a random identifier for up to 30 minutes for the purpose of connecting them with an enquiry submitted during that period. If no enquiry is submitted within that period, the temporary association with a possible later enquiry expires.
If interactive responses are attached to an enquiry submitted during the 30-minute period, they may thereafter be retained as part of that enquiry in accordance with the retention periods applicable to the enquiry.
Information associated with a user account is retained for as long as the account remains active or for as long as the information is otherwise necessary for the purposes described in this privacy notice.
Personal data may be deleted or anonymised earlier where it is no longer necessary for the purpose for which it was collected.
8. Data Security
Information is processed in secure systems, and access is restricted to individuals who require the information for their work. The website database and technical environment are located on servers managed by the web hosting provider, which is responsible for server security and maintenance.
9. Transfers of Data Outside the EU/EEA
In connection with certain services, such as Google Analytics and Google Fonts, information may be transferred outside the EU. Such transfers are based on the EU-U.S. Data Privacy Framework or other legally recognised safeguards.
10. Your Rights
You have the right to:
- request access to the personal data stored about you
- request correction of inaccurate personal data
- request deletion of your personal data (“right to be forgotten”)
- restrict or object to the processing of your personal data
- withdraw your consent at any time
If you wish to exercise these rights, you may contact the data controller by email. Information may nevertheless be retained where this is necessary to comply with legal obligations or for the maintenance of the website.
11. Right to Lodge a Complaint
If you believe that there are shortcomings in the processing of your personal data, you may lodge a complaint with the Office of the Data Protection Ombudsman, Ratapihantie 9, 00520 Helsinki, Finland, www.tietosuoja.fi