Privacy Policy

Website contact form | Last updated: 11 November 2026

1. Introduction

Aretos Finland Oy ("Aretos," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you submit the contact form on our website, how we use and protect it, and what rights you have under the EU General Data Protection Regulation (GDPR).

2. Data Controller

The controller responsible for the processing of your personal data is:

Aretos Finland Oy
Business ID: 3669400-8
Email: taina@aretosgroup.com

For any questions about this Privacy Policy or the processing of your personal data, please contact us at the email address above.

3. Personal Data We Collect

When you submit the contact form on our website, we collect the following information:

• Name
• Organization
• Email address
• Message: the content you write in the open text field
• Whether you ticked the box to receive our newsletter

We collect this information directly from you. Please do not include sensitive personal data or other people's personal data in the open text field.

Providing this information is voluntary. However, without your name and email address, we cannot respond to your enquiry.

4. Purpose of Processing

We use the information you submit only to contact you: to respond to your message, answer your questions, and follow up on the matter you have raised with us, for example a request for information, a meeting or a potential collaboration.

If you tick the newsletter box, we also save your name and email address to our newsletter list so that we can send you the Aretos newsletter. You can unsubscribe at any time by contacting us.

We do not use your information for automated decision-making or profiling, and we do not add you to marketing mailing lists without your separate consent.

5. Legal Basis for Processing

We process your personal data on the following legal bases:

• Legitimate interest: our legitimate interest in responding to enquiries sent to us and in communicating with people and organizations who contact us.
• Steps prior to entering into a contract: where your enquiry concerns our services or a possible agreement with you or your organization.
• Consent: for the newsletter, when you tick the newsletter box. You can withdraw your consent at any time.

6. Data Sharing and Transfers

We do not sell or rent your personal data. Your information is accessible only to Aretos personnel who need it to handle your enquiry.

We use trusted service providers, such as our website hosting and data storage provider, to operate the website and the contact form. These providers process personal data on our behalf and under our instructions, and are bound by data processing agreements in accordance with the GDPR.

If personal data is transferred outside the European Union (EU) or the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as a European Commission adequacy decision or Standard Contractual Clauses (SCCs).

7. Website Analytics

Our website uses Lovable's visitor analytics to understand how the site is used. It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. It uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Detailed data is kept for 90 days and daily summaries for one year. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

8. Data Retention

We keep your contact form information only for as long as necessary to handle your enquiry and any related follow-up. Newsletter details are kept until you unsubscribe.

9. Data Security

We use appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, including:

• Encrypted transmission of form data (HTTPS).
• Access restricted to authorized personnel only.
• Secure, access-controlled systems for storing communications.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request that we correct inaccurate or incomplete data.
• Erasure: request that we delete your data.
• Restriction: request that we restrict the processing of your data in certain circumstances.
• Objection: object to processing based on our legitimate interest.
• Withdrawal of consent: unsubscribe from the newsletter at any time.

To exercise these rights, please contact us at taina@aretosgroup.com. We will respond to your request within one month.

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with the supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version is always available on our website, and the date of the latest update is shown at the top of this policy.