Controller
Atorcom
Business ID: 3010969-9
address: Artturintie 4, 43500 Karstula, Finland
tel. +358 45 882 1525
email: antti.haaraniemi@atorcom.fi
Contact person for data protection matters
Data protection officer
Antti Haaraniemi
tel. +358 45 882 1525
email: antti.haaraniemi@atorcom.fi
Basis and purpose of processing personal data
Atorcom collects the customer data that its business requires and keeps a register of it.
For maintaining and developing the customer relationship, for delivering and developing the services, for invoicing and the measures related to it, and for customer communication.
Regular sources of data
The data entered in the personal data register is obtained, as a rule, from the data subject.
Personal data processed
We collect the following data directly from customers (the customer can partly decide which data to provide). Data relating to the customer relationship and the contractual relationship, and data relating to marketing, such as name, address, email address and telephone number.
Disclosure of personal data
Personal data may be disclosed within the limits permitted and required by the legislation in force, and in order to perform the contract between the parties.
Data may be disclosed, for example, to the authorities on the basis of a statutory requirement.
Security of personal data
We use generally applied security techniques to protect personal data. The data is stored on computer systems and phones to which only we have access, and the systems are protected with passwords. Personal data is retained only for as long as is necessary for the purpose for which it was collected. Records relating to invoicing are retained for the period required by accounting legislation. Data that is no longer needed is deleted, as is data whose deletion the data subject requests.
Profiling
Personal data is not used for profiling or other automated decision-making. If ad targeting is taken into use later, it may involve profiling, and this section is updated before that happens.
Rights of the data subject
Right of access to personal data
The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and, if it is, the right to obtain a copy of that personal data.
Right to rectification
The data subject has the right to request that inaccurate and incorrect personal data concerning them be corrected. The data subject also has the right to have incomplete personal data completed by supplying the necessary additional information.
Right to erasure
The data subject has the right to request the erasure of personal data concerning them if
a. the personal data is no longer needed for the purposes for which it was collected;
b. the data subject withdraws the consent on which the processing of the personal data was based, and there is no other lawful basis for the processing; or
c. the personal data has been processed unlawfully.
Right to restriction of processing
The data subject has the right to restrict the processing of personal data concerning them if
a. the data subject contests the accuracy of their personal data;
b. the processing is unlawful and the data subject opposes the erasure of their personal data and requests the restriction of its use instead; or
c. the controller no longer needs the personal data for the original purposes of the processing, but the data subject needs it for the establishment, exercise or defence of a legal claim.
Right to withdraw consent
The data subject has the right to withdraw the consent given to the processing at any time, without this affecting the lawfulness of the processing carried out on the basis of that consent before the withdrawal.
Right to data portability
The data subject has the right to receive the personal data concerning them that they have supplied themselves in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller.
Right to lodge a complaint with a supervisory authority
The national supervisory authority for personal data matters is the Data Protection Ombudsman, who operates in connection with the Ministry of Justice. You have the right to bring the matter before the supervisory authority if you consider that the processing of personal data concerning you breaches the legislation applicable to it.
Cookies and tracking
A cookie is a small text file that a site stores in your browser. This site has two kinds of cookies. Strictly necessary ones take care of the language choice and the security check on forms, for example; without them the site does not work, so they require no consent. Analytics cookies are set only if you accept them in the cookie banner, and you can withdraw that choice at any time. The site has no advertising cookies.
| Category | In use | What it means |
|---|---|---|
| Necessary | Yes | Language choice, remembering your cookie choice and form security checks. Without these the site does not work, and they require no consent. |
| Functional | Yes | Enables the LinkedIn feed on the front page, loaded through Elfsight. Without this choice the feed does not load. |
| Analytics | Yes | Google Analytics 4 and Ahrefs Web Analytics for visitor counting. Google Analytics sets cookies, Ahrefs does not. Neither loads until you accept this category. |
| Marketing | No | Reserved for ad targeting and its measurement. No advertising tool is in use. |
The site uses no advertising cookies. We do not use Google Tag Manager, the Meta pixel, the LinkedIn Insight Tag or any other ad-targeting tools, and visitor data is not passed on to advertising networks. Visitor measurement uses Google Analytics 4, which does set cookies — it is described below and sits behind the Analytics choice in the cookie banner.
The front page carries a LinkedIn feed loaded through Elfsight. The feed sits behind the Functional choice in the cookie banner: before you accept, the script is not loaded at all and no connection is made to Elfsight or LinkedIn. If you do accept, your browser contacts both: they see your IP address and the address of the page you are on, and may set their own cookies. This is content rather than a tracking tool, but the connection is made all the same — which is why it is stated here. You can withdraw the choice at any time in the banner settings.
The site’s fonts are loaded from Google Fonts, so your browser contacts Google’s servers and Google sees your IP address. Loading the fonts sets no cookies.
Visitor counting uses Ahrefs Web Analytics. It sets no cookies and uses no persistent identifiers, so it does not recognise you across visits or devices — the same person on different days appears as separate visitors in the statistics. The tool tells us page-level visitor counts and where the traffic came from, not who you are.
Visitor measurement also uses Google Analytics 4. Unlike Ahrefs, it sets cookies in your browser whose names begin with _ga. They allow the same browser to be recognised across visits, so that new and returning visitors can be told apart in the statistics. On Google’s default setting the cookies last two years. The data goes to Google, which also processes it outside the EU; the transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework. IP anonymisation and Google’s consent mode are enabled in the settings.
Both analytics tools sit behind the Analytics choice in the cookie banner. Neither script loads at all until you accept that category, and you can switch them off at any time. Cookies already set are removed through your browser’s own cookie settings.
The use of cookies can be blocked in the browser settings. Blocking strictly necessary cookies may break the functionality of the site.
If advertising is taken into use
Ad targeting or analytics that identifies individual visitors may be taken into use later. When that happens, the tools used are named in this policy and the table above is updated before anything is switched on. These terms then apply:
- Consent before anything is set. Advertising and tracking cookies are set only after you have accepted that category in the cookie banner. Without acceptance the scripts are not loaded at all: they are held back and never executed.
- Withdrawal at any time. You can change your choice in the cookie banner settings, after which the scripts stop loading.
- Transfer outside the EU. The most common advertising tools also process data in the United States. The basis for such a transfer is then an adequacy decision by the European Commission or standard contractual clauses, and the basis is recorded here per tool.
- Profiling. Ad targeting may involve profiling. If it does, the Profiling section of this policy is updated at the same time.
Contacting the controller
In all questions relating to the processing of personal data and in situations relating to the exercise of their own rights, the data subject should contact the controller.