Privacy notice

Last updated: 10 October 2026.

Who is responsible for processing personal data

Biss Oy (BISS), Finland, is the data controller. To ask about the processing of your data or exercise your rights, email info@biss.fi.

What data is processed and why

Website visits. Your browser sends technical information needed to deliver pages and secure the connection, such as your IP address and technical request headers. BISS does not use this information for advertising profiling. The website infrastructure is hosted by Hetzner Online GmbH in the European Union. The provider may process technical data to provide the infrastructure service and for its own purposes under its terms and privacy policy.

Contact form. When a form submission succeeds, BISS receives the name, email address, service selected, website address if supplied, and description of your needs. The form sends this information to BISS over a secure connection so the enquiry can be received and handled. We use it to reply, assess the request and, where appropriate, prepare an offer. Do not include passwords, payment details or special-category personal data in the form.

Email and business correspondence. If you email BISS, the company processes the sender’s address, name and information in your message to reply, discuss your request and, if needed, prepare or perform an agreement. BISS uses Gmail. Google may process email content and metadata; access to or processing of data outside the European Economic Area (EEA) may occur under the terms and settings of the email service. BISS is responsible as controller for processing business correspondence. Google provides the Gmail email infrastructure and processes data under its service terms.

Do not email passwords, payment details, special-category personal data or information that is not needed to respond to your request.

Browser settings and optional services

The website stores the categories you select in your browser for 180 days. Contact form contents are not stored in the website’s localStorage or in a cookie. The technologies in use and how to change your choice are described on the cookies page. If the server does not confirm a submission, the website displays an error; the completed fields remain on the open page so that you can try again.

Legal bases for processing

When you contact BISS in your own name, processing the necessary information is based on steps taken at your request before entering into a contract or on performance of a contract (Article 6(1)(b) of the GDPR). If you represent an organisation, processing your business contact details is based on BISS’s legitimate interest in conducting business correspondence and discussing services with that organisation (Article 6(1)(f)). Information required for accounting and other statutory purposes is processed to meet legal obligations (Article 6(1)(c)). Limited processing of technical data may be necessary to operate and protect the website and is based on BISS’s legitimate interest in ensuring its availability and security (Article 6(1)(f)). If consent is requested for optional analytics or advertising, that processing starts only after you select the relevant category. You can withdraw your consent in the cookie settings.

Recipients and international transfers

Data is received only by service providers that need it for the purposes described: Hetzner Online GmbH for the website infrastructure and Google in connection with Gmail. Only authorised people who need the information for BISS’s work can access enquiries. Optional services, their purposes and consent controls are listed on the cookies page.

The website runs on Hetzner Online GmbH infrastructure in the European Union. Use of Gmail may allow Google to access data or process it outside the EEA. Google states that it uses applicable transfer mechanisms, including the EU–US Data Privacy Framework and, where necessary, standard contractual clauses. More information about these mechanisms and how to request a copy of safeguards is available in Google’s information on international data transfers and Google’s privacy policy. The website being hosted in the EU does not by itself mean that all data remains within the EEA in every processing situation.

Information about infrastructure data processing is available in Hetzner’s privacy policy. You can ask BISS about recipients and applicable safeguards using the email address above.

Retention periods

Business enquiries and correspondence are retained for up to 12 months after the last substantive contact. If the discussion continues, the period runs from the last substantive contact. Correspondence may be retained for longer when necessary to perform an agreement, meet mandatory accounting obligations, or establish, exercise or defend legal claims. In that case, the data is deleted when the need ends.

Technical data transmitted to deliver pages is processed as part of the infrastructure service. The website server does not keep visitor request logs. Any logs or other data that the infrastructure provider may retain are subject to its practices and service settings.

Information you must provide and automated decisions

To contact BISS using the form, you must provide your name, reply email address and a description of your needs. Without these details, you cannot submit an enquiry through the form. Selecting a service and providing a website address are optional. BISS does not make automated decisions based on form data that produce legal or similarly significant effects, and does not use the data for advertising profiling.

Data security

Form data is transmitted over HTTPS. Access to enquiries is restricted to authorised people, and processing is limited to information needed for the request. Do not provide website or account credentials through this form; their transfer is agreed separately.

Your rights and complaints

Where the law allows, you may request access to your data, its correction or deletion, restriction of processing, object to processing, receive data you provided in a portable format, and withdraw your consent. Withdrawal does not affect the lawfulness of processing carried out before it. BISS may ask you to verify your identity so it can locate the data and respond to your request. We respond without undue delay and usually within one month. Where necessary, the period may be extended by up to two further months; we will explain the reasons as required by Article 12 of the GDPR.

Send your request to info@biss.fi. You may also complain to Finland’s supervisory authority, the Office of the Data Protection Ombudsman. Its role and contact details are available on its official website.

Changes to this notice

If the purposes of processing, contact methods, service providers or technologies change, BISS will update this page and state the update date.