Privacy policy

1. Controller

JSP-IT Solutions Oy (Ltd) (Business ID: 2721955-5)
Patruunantie 17 (2nd floor), 62800 Vimpeli, Finland
Get directions
Email:

2. Scope of this policy

This policy explains how we process personal data when you use our website, contact us, order services, or otherwise interact with us as a customer, prospect, partner, or representative.

3. Categories of personal data

We may process identification and contact details, company and role information, customer relationship data, communication history, billing information, and technical usage data such as IP addresses and log entries.

4. Purposes and legal bases

We process personal data to provide and maintain services, manage customer relationships, respond to inquiries, invoice services, improve quality and security, comply with legal obligations, and protect legitimate business interests.

Our main processing purposes and legal bases are:

Processing purpose	Legal basis
Preparing offers and responding to contact requests	Steps prior to entering into a contract and, where applicable, legitimate interest
Delivering services and managing customer relationships	Performance of a contract
Billing, accounting, and statutory reporting	Legal obligation
Service security, abuse prevention, and incident investigation	Legitimate interest
Electronic direct marketing and newsletter-type communication	Consent or legitimate interest where permitted by applicable law
Non-essential analytics cookies and similar technologies	Consent

When processing is based on legitimate interest, our interests include maintaining customer and partner relationships, securing services and systems, preventing misuse, and developing our business operations.

5. Data sources

Data is collected directly from you, your organization, and your use of our services. Where appropriate, we may also collect business contact data from company websites, public business registers, public professional profiles, customers, or cooperation partners.

These external sources are used mainly to keep business contact details up to date, verify company information, and support business-to-business communications.

6. Mandatory data and consequences of not providing data

Providing contact and invoicing details needed to prepare offers, enter into contracts, and deliver services is necessary for those purposes. If required data is not provided, we may be unable to prepare an offer, conclude a contract, provide the requested service, or issue invoices correctly.

Some information is also required by law, for example accounting and taxation documentation.

7. Retention

We retain personal data only as long as necessary for the purpose of processing and statutory obligations. Typical retention periods are:

Contact requests and general inquiries: 24 months from the last interaction.
Customer and contract documentation: for the contract term and up to 10 years after termination when needed for legal claims, liability management, or contractual dispute handling.
Accounting vouchers, invoices, and business correspondence: 6 years from the end of the financial year in which the accounting period ended, per the Finnish Accounting Act.
Accounting books, financial statements, and the chart of accounts: 10 years from the end of the financial year in which the accounting period ended, per the Finnish Accounting Act.
Support and service tickets: 5 years from ticket closure.
Security and system logs: typically 12 months, unless a longer period is required for incident investigation.
Google Analytics event-level data: 2 months.
Google Analytics user-level data: 14 months. For user-level data, the retention period restarts when the user generates new activity.

8. Recipients and processors

Data may be disclosed to trusted subcontractors and service providers that support:

website hosting and infrastructure operations,
email, communication, and collaboration services,
CRM, customer support, and service delivery tools,
accounting, billing, and financial administration,
analytics and security monitoring services.

Data may also be disclosed to public authorities where required by law.

Processing is governed by contractual safeguards and confidentiality obligations.

9. International transfers

If personal data is transferred outside the EEA, we use appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, as required by applicable law.

Some service providers may process data in or from the United States or other third countries under these safeguards. Where available, service providers may also rely on the EU-US Data Privacy Framework.

You may request information about applicable safeguards and how to obtain a copy of them using the contact details in this policy.

10. Data subject rights

You have the right to request access, rectification, erasure, restriction, objection, and data portability as provided by law. You may also withdraw consent at any time where processing is based on consent.

Requests can be submitted to . We normally respond without undue delay and within one month of receiving your request, unless a lawful extension applies.

You also have the right to lodge a complaint with the supervisory authority:

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki, Finland
tietosuoja.fi

11. Automated decision-making

We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.

12. Information security

We apply technical and organizational security controls appropriate to the nature and risk of processing, including access control, secure administration practices, and controlled subcontractor access.

13. Cookies, analytics, and customer-service chat

We use cookies and similar technologies for core functionality and consent management, and—with your consent—for functional services and statistical analytics. The website does not currently use marketing cookies.

Essential cookies are used to provide core site functionality and remember basic technical choices.
Consent-choice cookie (jspit_cookie_consent) records that you have made a cookie choice. It is retained for 180 days.
Analytics consent cookie (jspit_cookie_analytics) stores your analytics choice for 180 days.
Functional-services consent cookie (jspit_cookie_functional) stores your choice concerning the Tawk.to customer-service chat and Google Maps for 180 days.
JSP-Product™ solution advisor: after you accept functional services and open the solution advisor, we store a non-identifying indication of the suitable Expert tier for your device in browser localStorage. The storage key is jsp-solution-advisor-capability-v1, it is retained for no more than 7 days, and the information is not sent to our server. This makes later use of the solution advisor faster by avoiding repeated WebGPU capability checks.
Transferring consent choices when changing language: the Finnish website operates on the jsp-it.fi domain and the English website on the jsp-it.com domain. When you change language after making a cookie choice, we transfer your choices to the destination domain using a server-signed token valid for no more than 15 minutes. The token contains your cookie-category choices and technical validity and destination information, but no direct user identifiers. The destination domain verifies the token, stores the choices in its own consent cookies, and immediately removes the token from the URL through a redirect.
Google Analytics is loaded only with your consent to measure website usage and improve services. It may process page-view, session, browser, device, approximate-location, and client-identifier data. Google Analytics remains unloaded and receives no visit data before analytics consent.
Google Tag Manager is loaded only after statistics consent and is used to manage the Google Analytics tag. In this implementation, Tag Manager does not start or transmit data to Google before statistics consent.
Google Analytics cookies (_ga and _ga_*) may be set after consent to distinguish users and sessions. Their default lifetime is up to 2 years.
Google Analytics data retention: event-level data is retained for 2 months and user-level data for 14 months. The user-level retention period resets upon new activity. The retention controls apply to user- and event-level data and do not shorten the availability of aggregated standard reports in the same way.
Customer-service chat is loaded only with your consent for functional services. The chat service is provided by Tawk.to, which may process technical usage data and information you provide in the chat.
Google Maps is loaded on the contact page only with consent for functional services. Google may then process data such as your IP address, device and browser details, map usage, and may set its own cookies.

Analytics, chat, and map data may be processed in the EEA and, depending on provider configuration, in third countries such as the United States under applicable safeguards.

You can change your optional cookie and service choices at any time:

Change cookie settings

If the button is unavailable in your browser environment, you can clear the consent cookies and refresh the page to show the cookie banner again.