Privacy notice

What this notice covers

This privacy notice covers the Ideapark Seinäjoki website, forms, newsletter subscriptions, the tenant portal and personal data processing related to website content management.

Data controller

The data controller is Kiinteistö Oy Seinäjoen Ideapark, Suupohjantie 57, 60320 Seinäjoki, Finland. Its Business ID is 2879120-3. Requests concerning privacy on this website can be sent to infoseinajoki@ideapark.fi.

Personal data we process

Contact and feedback forms process information supplied by the user, such as name, email address, optional telephone number and company name, as well as the subject and content of the message. Newsletter subscriptions process the email address and subscription status. The tenant portal processes the user's name, verified email address, sign-in and user identifiers, role, permitted stores or restaurants, email-notification preference, the content of change requests and offers, uploaded images, and submission, review and decision data. Technical operation and security may involve processing an IP address and browser information. Cookiebot stores cookie choices, and Google Analytics 4 processes website usage data according to the user's consent choices. Sanity content-management users' account, role and sign-in data are also processed.

Purposes and legal bases for processing

Contact details are used to respond and handle the matter. Newsletter data is used to send the newsletter on the basis of the user's consent. Tenant-portal data is used to identify users, restrict access, publish website changes and offers, maintain approvals and processing history, send notifications selected by the user, and prevent misuse. Google Analytics 4 measurement cookies are used only according to the user's cookie choices. Technical data is processed to ensure service operation and security. Depending on the situation, other processing may be based on steps before or performance of a contract, the controller's legitimate interests or a legal obligation.

Service providers

The technical solution uses Vercel for hosting and server-side forms, Sanity for content management and encrypted tenant-portal access and change-request data, Clerk for tenant-portal sign-in and user identification, Cookiebot for cookie choices, Liana for newsletter subscriptions, Resend for forwarding contact messages and optional tenant-portal notifications, and Google Tag Manager and Google Analytics 4 for tag management and analytics. Form messages are routed by topic to recipients appointed by Ideapark Seinäjoki; advertising and promotion matters are also routed to the appointed partner Bauer Media Outdoor.

Data may also be processed outside the EU/EEA under providers' data-processing agreements and applicable transfer mechanisms. Resend stores submitted form-message content and delivery logs in the United States. According to Resend, transfers are protected by the EU Standard Contractual Clauses included in its data-processing agreement.

Data retention

Newsletter subscription data is retained until the subscription is cancelled or the data is removed from Liana. Contact messages remain in recipients' email under Ideapark's processing and retention practices. Resend retains sent-email data for 30 days by default. Active tenant-portal access is retained while the person needs it for their duties and is disabled without undue delay when the need ends. Disabled access and the processing history of requests and decisions are retained only as long as needed to verify access, published changes and any subsequent investigations. Unpublished images are retained only while a request is processed; published images and content while they remain necessary on the website. Google Analytics 4 user and event data is set to a 14-month retention period; aggregated reports may remain longer. Cookiebot maintains consent-log data according to the service settings. Technical-log retention depends on provider settings.

Your data protection rights

Data subjects have the right to receive information about the processing of their personal data, request access to and correction or deletion of their data, restrict or object to processing, and withdraw consent when processing is based on consent. They also have the right to lodge a complaint with the supervisory authority.