Privacy policy

VarikkoPro Oy
Updated 31 August 2026

This statement explains how we process personal data on the public website varikkopro.fi, in the application app.varikkopro.fi, and in related registration, communications, and support.

1. Data controller

VarikkoPro Oy
Business ID: 3596886-3
Kenttätie 2 B 25, 03250 Ojakkala
Email: eero@varikkopro.fi
Phone: +358 45 333 7885

For privacy matters, you can contact us at the same email address. We do not have a designated data protection officer.

2. Two different situations: our data and your data

VarikkoPro is a service intended for businesses. Personal data is processed in two different roles.

A. VarikkoPro Oy as data controller We ourselves process, for example:

• technical data of website visitors and, if you have accepted it, visitor analytics
• contact details of the person registering
• contact details of customer company contacts for managing the customer relationship
• service messages (email and text message) to contact persons
• security and usage logs

B. Customer company as data controller, VarikkoPro Oy as processor When you use VarikkoPro in your own operations, you decide what data is stored in the service. In that case, the customer company is typically the data controller for, for example:

• employee and user account data
• working hours, shifts, maintenance and fault records
• your own customer and work site data
• reports and signatures
• equipment location data, if tracking is in use
• manuals and AI queries

VarikkoPro processes this data on your behalf to provide the service. We do not use it for our own marketing purposes.

If you are an employee or other user whose employer has adopted VarikkoPro, your employer is the primary contact for requests concerning your data. You may still contact us, and we will forward the request if necessary.

When we process personal data on a customer's behalf, the GDPR requires a written data processing agreement. If one has not yet been signed, it will be prepared separately.

3. What data is used for

3.1 Website, registration and customer relationship (VarikkoPro as data controller)

| Purpose | Examples of data | Legal basis |
| --- | --- | --- |
| Registration and account creation | name, email, phone, address, company, business ID, industry, website | Performance of a contract or steps prior to it |
| Customer relationship management and support | contact details, company details | Contract |
| Service-related emails and text messages | recipient contact details, message content | Contract |
| Security, fault correction and prevention of misuse | IP address, browser and request data, event logs | Legitimate interest (protecting the service and users) |
| Accounting and statutory obligations | data required for invoicing and accounting | Legal obligation |
| Voluntary website visitor analytics | cookie-based identifiers and usage data | Consent |

The website and registration can be used without analytics consent.

3.2 Service content (customer as data controller)

We process data stored in the service on your behalf so that VarikkoPro works: user accounts, employees, working hours, shifts, customers, work sites, maintenance, fault reports, reports, PDF files, manuals, and other data you enter.

The legal basis for this data is the responsibility of the customer (typically the employer). Our task as processor is to process data only to provide the service and in accordance with the customer's instructions.

4. What personal data is processed

We process only data that the service or website actually uses. Typically:

• name, email, phone number
• company, job role and user account details
• address, if provided (for example in registration)
• working hours, shifts and other work-related records
• customer and work site contact details, if entered in the service
• signatures in reports, if the feature is in use
• messages and AI queries, if manual search is used
• equipment location, device identifier and time, if tracking is enabled
• IP address and technical log data
• analytics data only if you have accepted analytics

We do not collect special categories of personal data (such as health data) as part of the service's core functions. Do not enter them in the service or AI queries unless it is necessary and lawful in your own operations.

The service is intended for business use, not for children.

5. Where data comes from

• from you or the company you represent (forms and application)
• from your employer, if it has created a user account for you
• from the browser or device (technical data; analytics only with consent)
• from equipment tracking devices, if tracking has been enabled
• from email and text message services (delivery data)
• from reports compiled from data stored in the service

6. Who data is disclosed to

We do not sell personal data.

To provide the service, we use trusted external service providers who process data on our or the customer's behalf only for the agreed purpose. Such recipient categories include:

• cloud and server infrastructure providers - server maintenance and technical operation of the service
• application platform and database services - the VarikkoPro application and storage of its data
• email relay services - service-related emails to contact persons
• text message relay services - service-related text messages
• AI services - manual search, when the feature is in use
• visitor analytics services - voluntary website visitor analytics, only with consent
• map and location services - map views in the application, when the feature is in use

Data may also be disclosed to authorities if required by law.

Under the GDPR, recipients may be identified either by name or as sufficiently specific recipient categories. This statement uses recipient categories. An up-to-date list of our personal data processors and sub-processors is available on request. For processing on a customer's behalf, the information is also provided in connection with the data processing agreement.

7. Processing outside the EU/EEA

Not all personal data remains in the EU or EEA.

VarikkoPro's own server environment is located in Finland. However, in connection with some external services, personal data may be processed outside the EU or EEA.

In such cases, appropriate GDPR transfer mechanisms and safeguards are used so that the level of data protection remains adequate.

8. Email and text messages

We send service-related messages, for example a welcome message after registration.

Service emails may use technical open and link tracking. This can provide information on whether a message has been opened or a link in the message has been used, along with related technical data (for example time). Tracking is not necessary for message delivery.

Text messages are sent via a text message service to the recipient's phone number.

9. Cookies and analytics

Essential website functions, such as registration, work without analytics.

Voluntary visitor analytics starts only if you accept it in the cookie choice. You may reject analytics. You can later change your choice in the website footer under Cookie settings. Withdrawing consent stops analytics from loading on subsequent visits. We remove from the browser those analytics cookies that we can technically remove.

Analytics is not a requirement for using the service. Ad personalisation is not enabled in our website settings.

Cookies related to login in the application (app.varikkopro.fi) are necessary for the service to function.

10. AI (manual search)

VarikkoPro uses an external AI service for manual search. If the feature is in use:

• technical manuals may be sent to the AI service for search
• the user's written question is sent to the AI service for processing
• the question may contain personal data if the user enters it
• data may be processed outside the EU or EEA with appropriate safeguards

Do not enter unnecessary personal data in AI queries (names, contact details, customer data or other identifiers) unless they are necessary for the answer.

11. Equipment location

If a customer enables equipment tracking, the system stores the location of the device linked to the machine (location coordinates and time) and the device identifier. A responsible driver may be assigned to the machine.

VarikkoPro does not track individuals as a separate personal tracking service. The system tracks equipment location. Depending on the customer's use, location may be linked to a user or driver if a person is linked to the machine.

Map views in the application may use an external map and location service.

The employer is responsible for informing employees about the use of location data as required by law.

12. Retention periods

We retain data for as long as needed for the purposes described in this statement, for managing the customer relationship, and for statutory obligations.

In practice:

• Customer and user account data is retained until the account or customer relationship is terminated and the data is deleted on request or when the agreement ends. There is not yet an automatic deletion schedule for all data categories.
• Registration and onboarding data on the server is retained until manually deleted. The login link is not stored in plain text after successful sending.
• Service usage logs are typically retained for about two weeks.
• Accounting records are retained in accordance with accounting legislation (vouchers generally at least 6 years from the end of the financial year; financial statements and accounting records at least 10 years).
• Analytics data: until you withdraw consent; the analytics service may additionally retain measurement data according to its own settings.
• The email relay service may retain message content and events in its own systems for a limited time.

When the customer relationship ends or you request deletion, we delete or return data in our possession as processor, unless the law requires longer retention.

13. Data subject rights

You have the following rights under the GDPR:

• access to your data
• rectification of inaccurate data
• erasure
• restriction of processing
• objection to processing where it is based on legitimate interest
• data portability, where applicable
• withdrawal of consent (analytics) without affecting the lawfulness of processing before withdrawal
• lodge a complaint with the Office of the Data Protection Ombudsman

Rights are currently implemented manually. There is no automatic data export or deletion tool. Account deletion instructions are on the page Delete account.

Requests: eero@varikkopro.fi.

If data is processed on a customer company's behalf, we may need to forward the request to the customer.

Complaint: Office of the Data Protection Ombudsman.

14. Automated decision-making

We do not make decisions based solely on automated processing within the meaning of Article 22 of the GDPR that produce legal effects concerning you or similarly significant effects.

Manual search and possible maintenance-related notices are support tools. They are not used to make automatic employment or contract decisions.

15. Data security

We use technical and organisational safeguards, such as:

• encrypted data transmission
• limitation of access rights
• logging related to service maintenance and security
• separate storage of secrets in maintenance

This is not a security certification, and no system is completely risk-free.

16. Changes

We update this statement when processing or legislation changes. The current version is on this page.

A separate terms of use page has not yet been published. This document is the privacy statement.

17. Contact details

VarikkoPro Oy
eero@varikkopro.fi
+358 45 333 7885