This policy explains how Granespo Oy processes your personal data in connection with the website and the contact form. The policy has been drawn up in accordance with the EU General Data Protection Regulation (GDPR).
Updated 10 August 2026.
1. Data controller
Granespo Oy (Business ID 3632267-7)
Tiistinniityntie 6, 02230 Espoo, Finland
Contact person for data protection matters: Markku Määttälä
Email: tietosuoja@granespo.fi
2. What data we process and where it comes from
We only process data that you provide to us yourself:
- Contact form: name, email, phone number, subject and content of the message.
- Orders and quote requests: name, contact details, delivery address and the contents of your order or quote request, plus any additional information you provide.
- Customer relationship: communication related to quotes, orders and invoicing.
3. Purposes and legal bases of processing
- Responding to quote requests and orders and fulfilling them – preparation and performance of a contract (GDPR Art. 6(1)(b)).
- Customer communication and managing the customer relationship – legitimate interest (GDPR Art. 6(1)(f)).
- Accounting and other statutory obligations – legal obligation (GDPR Art. 6(1)(c)).
We do not use your data for direct marketing and we do not carry out automated decision-making or profiling.
4. Retention periods
- Order and invoicing data: as required by the Finnish Accounting Act (6 years from the end of the financial year).
- Contacts and quote requests that do not lead to an order: no longer than 2 years.
5. Recipients of data
We do not sell or disclose your personal data to third parties for marketing purposes. Data is processed on our behalf only by our technical service providers (including website hosting and email services), with whom agreements required by the GDPR have been concluded. Data may be disclosed to authorities where required by law.
6. Transfers outside the EU/EEA
As a rule, data is not transferred outside the EU or EEA. If a transfer is necessary due to a technical service provider, we ensure its lawfulness, for example through the European Commission’s standard contractual clauses.
7. Data security
Data is stored in protected systems accessible only to persons who need it for their work. The website uses an encrypted HTTPS connection.
8. Your rights
You have the right to:
- access the data concerning you,
- request rectification or erasure of your data,
- request restriction of processing or object to processing,
- receive your data in a portable format where processing is based on a contract.
Requests should be sent by email to tietosuoja@granespo.fi. We respond within one month. If you consider that we process your data unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
9. Cookies
The website’s use of cookies is described in a separate cookie notice.
10. Changes to this policy
We update this policy as needed, for example when our services or legislation change. The current version is always available on this page.