Articles 13 and 14 of the EU General Data Protection Regulation (2016/679). Updated 6 October 2026.

1. Controller

Loopshore Oy, Hämeenkatu 13 A 5, 33100 Tampere, Finland. Business ID 2950802-7.

Data protection matters: info@loopshore.com

2. What we use personal data for and on what basis

Purpose	Legal basis
Managing orders, rental agreements and the customer relationship	contract (6.1 b)
Invoicing and accounting	legal obligation (6.1 c)
Providing the service: the details given when a device is registered (building, room)	contract (6.1 b)
User accounts of the service (users in customer organisations)	contract (6.1 b), or legitimate interest (6.1 f) when the contract is with the user's employer
Carrying out research and development projects and reporting to funders	legitimate interest (6.1 f)
Recruitment	steps prior to an employment contract (6.1 b)
Marketing to our customers	legitimate interest (6.1 f)
Contacting representatives of organisations whose work our service relates to	legitimate interest (6.1 f)
Responding to the contact form on the website	legitimate interest (6.1 f) or steps prior to a contract (6.1 b)
Visitor statistics of the website	legitimate interest (6.1 f)

Our legitimate interest is to offer our service to organisations whose operations it relates to, and to reach the person whose work the matter concerns. We send marketing by email only to people whose work our service relates to. We do not use tracking pixels in our messages, and we do not profile.

3. What data we process

• Customers: name, organisation, work contact details (email, phone, address), order and invoicing details, location of the device (building, room).

• Representatives of organisations we contact: name, job title, organisation, work email, the source of the information and the date it was collected, and any objection to marketing.

• Users of the service portal (people in customer organisations): name, work email and organisation, and information related to their use of the portal.

• Contact persons of project partners: name, organisation, work contact details, role in the project.

• Job applicants: the information given in the application and in interviews.

• People who send the contact form: the information given on the form. The content of the form is not stored on the website’s server but is forwarded to email and our messaging service. The visitor statistics record the outcome of the submission and the page the form is on, together with the same day’s visitor hash. The submission can therefore be linked to page loads of the same day, and the link remains for as long as the statistics are kept. The IP address is used to limit the number of submissions, only in the server’s memory, and it is not stored.

• Website visitors: the visitor statistics use no cookies, and nothing is stored in your browser. We do not use third-party analytics such as Google Analytics. For each page load we store the time, the page address, the language, the server’s response code, the domain of an external referring website, campaign link identifiers (utm parameters), the device type and the name of the browser. IP addresses are not stored. Visits on the same day are linked with a hash whose key changes daily. The key is kept in backups for 30 days, after which the visits of the same visitor can no longer be linked.

Measurement data is processed in accordance with the data terms of use.

4. Where the data comes from

• from the person themselves (orders, enquiries, events)

• from organisations’ own websites and from public registers

• from earlier correspondence or through a recommendation

In our first message we tell you where we got your contact details.

5. Who the data is disclosed to

We do not sell data or disclose it to others for marketing. The data is processed on our behalf only by the service providers we need for our operations:

• email, office applications and messaging: Google Workspace and Slack

• customer register: Loopshore’s own system on our own server in Finland; backups to Google Workspace

• invoicing and accounting: the Procountor financial management system and our accounting firm

• website: Hetzner, server in Helsinki; backups of the visitor statistics to Google Workspace

• carriers: only the information needed for the delivery

Google Workspace and Slack may also process data in the United States. The transfer is based on the EU-U.S. Data Privacy Framework, in which Google and Salesforce, the owner of Slack, participate.

Google APIs

We use the Google Ads API to read keyword and campaign data of our own advertising account. Through the API we do not process other people’s data, and we do not pass on data we receive from Google.

6. How long the data is kept

• Representatives of organisations we contact: the data is deleted 12 months after the last message if the contact does not lead to a conversation or a customer relationship. If no message has been sent, the data is deleted 24 months after it was collected or, if the collection date has not been recorded, after it was added to the register.

• Objection to marketing: we keep the email address and the date of the objection for as long as we do direct marketing, so that the objection stays in effect.

• Customers: for the duration of the customer relationship and 2 years after it ends, except for accounting records (below).

• Accounting records: for the period required by the Finnish Accounting Act.

• Backups: deleted data disappears from the backups within 30 days.

• Event logs of our systems: 12 months. The logs may contain the data mentioned above, and they are needed to investigate security incidents and errors.

• Users of the service portal: for the duration of the customer relationship and 2 years after it ends.

• Project contacts: for the duration of the project and 5 years after it ends.

• Job applicants: 12 months after the application period ends, unless the applicant agrees to a longer period.

• Visitor statistics of the website: 2 years.

7. Your rights

You have the right to:

• know what data we process about you and get a copy of it

• ask for incorrect data to be corrected

• ask for data to be erased or its processing to be restricted

• object to processing based on legitimate interest

• prohibit direct marketing at any time: reply to our message or write to unsubscribe@loopshore.com. The prohibition is absolute, and we comply with it without delay.

• receive the data you have given on the basis of a contract in a machine-readable format

• lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi) if you consider that we process your data unlawfully

Requests: info@loopshore.com. We reply within one month.

8. Automated decisions

We do not make automated decisions, and we do not profile.

9. Data security

The data is processed only by people whose work requires it. Our systems are accessed with personal credentials.