Privacy notice

What data do we collect and where does it come from?

You provide the enquiry data. Technical information is generated when your browser communicates with the website server.

• The name, email address, location and message you enter in the form. Organisation, preferred timing and a photo of the site are optional. We also process your selected area of interest and correspondence language.
• Contact details, messages, attachments and the time of contact when you use email, telephone or WhatsApp. We process your telephone number when you call, use WhatsApp or include it in your message.
• Technical information needed to deliver and secure the site, such as IP address, requested page, request time and device and browser information sent by your browser. Our hosting provider may also process this in technical logs.

Why do we use the data and on what legal basis?

Sending an enquiry does not subscribe you to a newsletter or marketing list. We do not use this data for profiling or decisions based solely on automated processing that have legal or similarly significant effects on you. Automated form checks help prevent invalid submissions and spam.

• Responding to enquiries and planning cooperation: we use contact details, messages and optional photos to answer questions, assess a site and discuss cooperation. For general enquiries and contact persons representing organisations, our legitimate interest is handling communications addressed to us and maintaining business relationships (GDPR Article 6(1)(f)).
• Preparing a quotation or contract: if you request a service for yourself as a prospective contracting party, the basis is taking steps at your request before entering a contract and, where applicable, performing that contract (GDPR Article 6(1)(b)).
• Operating and securing the website: technical data helps deliver pages and the form, investigate errors and prevent spam and misuse. The basis is our legitimate interest in maintaining a working, secure website and communications (GDPR Article 6(1)(f)).
• Data protection rights and legal obligations: we process your request and the information necessary to handle it to meet our legal obligations (GDPR Article 6(1)(c)). Necessary information relating to a legal claim may be retained on the basis of our legitimate interest in establishing, exercising or defending that claim.

Which information is required?

The name, email address, location and message marked with an asterisk are required to submit the form and allow us to handle and answer the enquiry. Providing data is not a statutory obligation, and an enquiry does not require you to enter a contract. You can also contact us directly by email or telephone.

Provide only information needed to handle the enquiry. Do not send a personal identity code, health information or other sensitive data. Avoid identifiable people and unnecessary personal information in site photos. A photo is optional and will not be published on the website merely because you include it with an enquiry.

Who processes the data?

At Blokgarden, data is handled by people who need it to respond to enquiries and deliver services. We use the following technical providers and their subprocessors:

• Vercel: website hosting and delivery, technical processing of form submissions, and operational and security information. Form data passes through the website server before being sent by email.
• Google Workspace: receiving, storing and replying to enquiry messages and attachments in Blokgarden’s email service.

Data may also be disclosed to an authority if required by law, or to a legal adviser where necessary to handle a legal claim. Form data is not used for advertising targeting on the website.

• Vercel data processing terms and subprocessors ↗
• Google Workspace data processing terms ↗

Is data transferred outside the EU or EEA?

Vercel and Google operate international infrastructure. Data may be processed outside the EU and EEA, including in the United States, also by their subprocessors. Storage exclusively in Finland or the EU therefore cannot be promised.

The providers’ data processing terms include the European Commission’s Standard Contractual Clauses as safeguards for transfers outside the EU and EEA. Where applicable, a transfer may also rely on a Commission adequacy decision. You can request information about the applicable transfer basis and safeguards, including a copy, at team@blokgarden.com. The providers’ terms and subprocessor information are available through the links above.

How long is data retained?

Retention depends on the processing purpose and the stage of the enquiry. There is no single retention period for all enquiries. Data should not be retained once there is no longer a basis for processing it.

• Enquiry messages and attachments: retained until the enquiry and necessary quotation preparation or follow-up have been completed. If an enquiry leads to a customer relationship, necessary information is retained for performing the contract. Afterwards, it is retained only to the extent and for as long as a legal obligation or legal claim requires. Other unnecessary data is deleted.
• Form data: the website has no persistent database for unsent messages. Submitted messages are forwarded to email. The form rate limiter uses an IP address in server memory for a ten-minute counting window. An expired entry is removed on the next processed form request or when the server process ends.
• Technical logs: Vercel application-log retention depends on the service plan and optional features; its published periods range from one hour to 30 days. Other provider security and service information is processed under its applicable terms. Necessary incident investigations are retained while the issue is being resolved.
• Deletion and backups: final removal of deleted email data from provider recovery and backup systems follows the service’s deletion procedures. Google Workspace processing terms allow up to 180 days for final deletion after a deletion instruction, unless retention is required by law.

• Vercel application-log retention periods ↗

Cookies, tracking and external services

No visitor analytics, advertising pixels or marketing cookies have been installed on the website. The site does not save form data in browser local storage. Fonts, images and videos are delivered from the website’s own address. Watching videos does not load YouTube or Vimeo embeds.

The WhatsApp button is a link that opens WhatsApp only when you use it. WhatsApp also processes user and communication data under its own terms and privacy policy. External websites, including Kalevan halli, have their own privacy practices. An ordinary external link does not embed that service’s content in this website.

• WhatsApp privacy policy for the European Region ↗

How is data protected?

Website traffic uses HTTPS and email forwarding from the form uses encrypted TLS. The form validates input, limits attachment types and size, and limits submissions to prevent misuse. The website application does not write message contents to its own logs or maintain a separate form-message database.

Provider security measures are described in their processing terms. Do not submit secrets or sensitive personal data through the form.

Your data protection rights

You can request information about processing, access to and a copy of your personal data, and correction of inaccurate information. Where the GDPR conditions are met, you also have the following rights:

• Request erasure or restriction of processing. Erasure may not be possible where, for example, a legal retention obligation or a legal claim requires the data.
• Object to processing based on legitimate interests on grounds relating to your particular situation. We then assess whether the legal conditions for continuing processing are met.
• Receive data you have provided in a machine-readable format and transfer it to another controller when processing is automated and based on a contract or consent.
• Withdraw consent where processing is based on your consent. Withdrawal does not affect the lawfulness of earlier processing. Ordinary enquiry handling described in this notice does not require consent.

How to exercise your rights

Send your request to team@blokgarden.com. Explain which right you wish to exercise and which enquiry it relates to. If needed, we request only the additional information necessary to verify your identity. Do not send a copy of an identity document unless requested.

We respond without undue delay and within one month of receiving your request. If a request is complex or numerous requests are received, this can be extended by up to two further months. We inform you of an extension and its reasons within the first month. Requests are normally handled free of charge.

You have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman if you consider the processing unlawful. You may also contact another competent supervisory authority in the EU or EEA.

• Office of the Data Protection Ombudsman: making a complaint ↗

Changes to this notice

We update this notice when website services or personal data processing change. The current version and its update date are available on this page. If we intend to use data for a new purpose, we provide the required information before that processing begins.