Privacy Policy

1. Data controller

The controller of your personal data is Latysh Development, a Finnish sole trader (toiminimi), Business ID (Y-tunnus) 3568226-7, Finland.

The official address of the business is given on the Legal Information page.

2. Contact information

For any question about this notice or your personal data, write to contact@ladev.fi. There is no separate data protection officer; the sole trader handles these matters personally.

3. Categories of personal data

Depending on how you contact us, we process:

• Contact form: your name, your email address, your company (optional) and the content of your message. Please do not include sensitive information (for example health data) in the message.
• Added by the system: a randomly generated request ID (UUID), the time the request was received, a handling status and the date of the last contact with you. The request ID is personal data when it is linked to you.
• Email: if you write to contact@ladev.fi, your email address, any name in it, and the content of the message.
• Technical data: when you visit the site or submit the form, our servers necessarily handle your IP address, the time, the requested address (URL) and browser information. The form service uses your IP address in memory to limit abuse (rate limiting); it is not stored with your request in the database. The web server and the form service may also write ordinary access and system logs containing this data. These technical logs are kept for about 30 days. [TO BE CONFIRMED: the 30-day log retention is configured on the Amsterdam server]

The form also contains a hidden anti-spam field that people do not fill in. It is not used for any other purpose. Providing the form details is voluntary, but name, email address and message are needed so that we can reply.

4. Purposes of processing

We process personal data in order to:

• reply to your enquiry and discuss your needs;
• prepare quotations and, if we agree on an assignment, carry it out;
• keep the website and the form service secure and protect them from spam and abuse;
• handle your data protection requests and meet our legal obligations (for example bookkeeping, if you become a customer).

We do not send marketing emails or newsletters, we do not build marketing lists from contact details, we do not profile you and we make no automated decisions about you.

5. Legal bases

The legal basis depends on the enquiry, not on one rule for all of them:

• Taking steps at your request before a contract (GDPR Article 6(1)(b)): when you ask for a quotation or for work to be done and you are, or represent, a party to the possible contract.
• Our legitimate interest (Article 6(1)(f)): answering business enquiries that do not (yet) lead to a contract, running our business and keeping the website and form service secure. You can object to this, see section 10.
• Legal obligation (Article 6(1)(c)): keeping accounting records and similar information if you become a customer.

We do not rely on consent for processing the contact form and we ask for no consent to marketing.

6. Retention periods

An enquiry is kept for 12 months from the last contact with you, after which it is due for deletion. Enquiries that have led to a customer relationship are kept for as long as the relationship and our legal obligations (for example accounting rules) require. Data may also be kept longer where needed to establish, exercise or defend legal claims.

Expired enquiries are not removed by an automatic process. We review the stored enquiries and delete the expired ones by hand at least once a month, so a record may remain for a short time after its 12 months have passed.

Deleted data may still exist in backup copies until they are overwritten: local database backups are rotated within about 14 days; we do not keep offsite copies of the database.

Emails sent to contact@ladev.fi are forwarded to our Gmail mailbox and are handled there on the same 12-month schedule. [TO BE CONFIRMED: that mailbox messages and Brevo notifications are deleted after 12 months] Server logs: see section 3.

7. Recipients and processors

We do not sell personal data. We use the following service providers, who process data on our behalf:

• Vultr (VPS hosting): the website, the form service and the database run on a server rented from Vultr and located in Amsterdam, the Netherlands (see section 8). Vultr acts as our processor. [TO BE CONFIRMED: data processing agreement with Vultr (reply from Vultr pending) and completion of the move of the production server to Amsterdam]
• Brevo (transactional email): when a request arrives, Brevo delivers an automatic notification to our own mailbox. The notification contains only the request ID and the time of the request, together with our own mailbox address. It does not contain your name, email address, company or message. Brevo may keep its own technical delivery logs: [TO BE CONFIRMED: Brevo log retention].
• Cloudflare: manages our domain name (DNS) and, through Email Routing, forwards emails sent to contact@ladev.fi to our mailbox. Cloudflare acts as our processor for this. [TO BE CONFIRMED: whether Cloudflare also proxies web traffic]
• Google (Gmail): the mailbox that receives forwarded emails and the automatic notifications. [TO BE CONFIRMED: contractual terms between us and Google for this mailbox]

Authorities receive data only where the law requires it.

8. International transfers

The server that stores the contact requests (including names, email addresses and messages) is located in Amsterdam, the Netherlands, in the EU. The location of a server does not mean that all personal data stays in the EU/EEA: where data is physically stored and who can access it are separate questions. Our providers may be established outside the EU/EEA or have staff or subprocessors there, and remote access from a third country can be a transfer of personal data under GDPR Chapter V.

Vultr, Cloudflare and Google are US companies; Cloudflare and Google process emails sent to contact@ladev.fi. Brevo is established in France; its notifications contain only a request ID and a time. A transfer to a country outside the EU/EEA requires a safeguard provided for in the GDPR, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. [TO BE CONFIRMED: for each of Vultr, Cloudflare, Google and Brevo: the data processing agreement, whether data is transferred outside the EU/EEA (including by remote access or subprocessors), the transfer mechanism and the transfer assessment; the reply from Vultr is pending]

9. Data security

We protect personal data with measures suited to the risk: encrypted connections (HTTPS), restricted access to the server and the database, limits against automated abuse, and keeping the contents of your message out of email notifications. No online service can be made completely risk-free.

10. Your rights

You have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased in the situations set out in law (Article 17);
• restrict processing (Article 18);
• object to processing that is based on our legitimate interest (Article 21);
• receive data you provided in a machine-readable format where the processing is based on a contract or steps before one (Article 20).

To use these rights, email contact@ladev.fi. We may need to verify your identity. We reply without undue delay and in any case within one month; the request is normally free of charge.

11. Right to lodge a complaint

If you think we process your personal data unlawfully, you may complain to the supervisory authority: the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi. You may also complain to the supervisory authority of the EU/EEA country where you live or work.

12. Cookies and tracking

This website sets no cookies and stores nothing in your browser’s local or session storage. It has no analytics, advertising or other tracking tools, no social media plugins and no third-party scripts. Fonts are served from the site’s own address. Consequently no cookie banner is needed.

The form request is sent without cookies and without referrer information.

13. Changes to this notice

We may update this notice, for example when our services or providers change. The current version is always on this page, and the date below shows when it was last changed.

14. Effective date

Last updated: [TO BE CONFIRMED: date of publication]