Privacy policy

1. Data controller

The controller is palvelunyt.fi. For privacy matters you can reach us at tietosuoja@palvelunyt.fi.

2. What data we process

• Account: name, email address, password (stored only as a hash), language, and optionally phone number and postal code.
• Requests: title, description, postal code, preferred date and budget, plus attached photos and PDF files. Do not put unnecessary personal data in a request.
• Quotes, messages and reviews created while you use the service.
• Providers: business name, business ID (Y-tunnus), service area, categories and description. A sole trader's business ID can identify a person.
• Technical data: the sign-in session (cookie), the session's IP address and browser identifier, and short-lived logs for running the service and investigating abuse.

3. Why we process it and on what basis

• To provide the service: account, passing on requests and quotes, messages and reviews (performance of a contract).
• Email: account confirmation, password reset and decisions on a provider application (always), and notifications about new quotes, messages and, for providers, new requests in their area (performance of a contract; you can turn them off in the notification settings of your profile). The emails never contain the content of conversations or the description of a request; an email about a request shows only its title and postal code.
• Security and preventing abuse, such as bot protection and rate limiting (legitimate interest).
• Legal obligations where the law requires it.

4. Who can see your data

We never sell or rent personal data to third parties for marketing.

• Your request, its description and attachments are visible to approved providers whose area and category match, or to the provider you chose directly. Your name is shown once you accept a quote and the conversation starts.
• A provider's business details and reviews are public.
• Administrators see provider applications for approval. They also have read access to accounts, requests, quotes, messages, reviews and attachments, in order to run the service, give support and investigate disruption and abuse. Messages are read only when needed for that purpose.
• Cloudflare is the technical platform provider and data processor (web serving, database, files and bot protection). Emails (confirmation, password reset and notifications) are sent by Brevo (Sendinblue SAS, France) as a data processor, and receive only the recipient's address and the message content. We have, or will have, a data processing agreement with each of them.

5. Transfers outside the EU

The database and files are stored in the EU. Cloudflare is a US group, so data may also be processed outside the EU (for example when a page is served from the nearest data centre). For such transfers we rely on Cloudflare's data processing agreement and the EU standard contractual clauses or another transfer mechanism allowed by the GDPR.

6. How long we keep data

• Account data is kept until you delete your account.
• Sign-in sessions expire automatically, and expired sessions and confirmation links are cleaned up regularly.
• Accounts whose email address was never confirmed are deleted after 30 days.
• Cancelled requests and their attachments are deleted once they are older than 12 months.
• When you delete your account we remove your credentials, sessions, attachments and open requests. Completed jobs stay available to the other party in anonymised form: your name and messages are replaced with "deleted".

7. Your rights

You have the right to access, correct and erase your data, to restrict its processing, to move it to another service, and to object to processing based on legitimate interest.

On your profile page you can download all your data in a machine-readable file and delete your account yourself. An account cannot be deleted while you have a job in progress; finish or cancel it first. For anything else contact tietosuoja@palvelunyt.fi. We answer within one month.

If you believe we process your data unlawfully, you can complain to the Office of the Data Protection Ombudsman (tietosuoja.fi).

8. Cookies and local storage

We use only the session cookie that the service needs to work, and the browser's local storage to remember your language. That is why we do not ask for cookie consent. Forms may use the Cloudflare Turnstile bot check, which does not track you for advertising.

On the public pages of the service (the home page, service pages, the blog and these policies) we measure visitor numbers with Cloudflare Web Analytics. It uses no cookies and no local storage in your browser and does not build profiles of individual visitors: we only see aggregated statistics, such as pages viewed, where the visitor came from, country, device type and page speed. This is based on our legitimate interest in understanding and improving the service. There is no measurement on the pages for signed-in users. If we add marketing tracking or analytics that uses cookies, we will update this policy and ask for your consent.

9. Security

Passwords are stored only as hashes, connections are encrypted and access is limited by role. The service's logs do not contain messages, request text or contact details. We report data breaches to the authority and, where required, to you.

10. Changes

We update this policy when the service or the law changes. We announce material changes in the service or by email.