Privacy notice

Updated 24 October 2026

This notice explains how Tarumo Oy processes personal data on this website (tarumo.fi), through its contact form, and when you contact us by email.

What this notice covers

This notice covers only this website and enquiries made through it. In the Tarumo service itself, the customer organisation is the controller, and Tarumo Oy processes the data on its behalf under the data processing agreement made with the customer.

Controller

Tarumo Oy (Business ID 3664892-5)
Artturintie 4, 43500 Karstula, Finland
Email: sales@tarumo.fi

Questions and requests about privacy can be sent to the same address.

Why we use the data, and on what basis

• To answer enquiries sent with the form or by email, and to carry on the conversation that follows. The legal basis is our legitimate interest in answering questions sent to us (EU General Data Protection Regulation, Article 6(1)(f)).
• To prevent abuse of the form (spam and floods), on the same legitimate interest.
• To measure how the site is used with analytics, only if you consent (Article 6(1)(a)). See Cookies and analytics.

What we store

The contact form

• your name, email address and message
• your organisation, if you give it
• the language of the form (Finnish or English) and when the message arrived
• a shortened network address: only the start of your IP address (the first three numbers of an IPv4 address, the first 48 bits of an IPv6 address), never the full address
• an identifier computed with a secret key from your IP address (from the first 64 bits of an IPv6 address) (16 characters), from which the address cannot be recovered. It lets us see whether several messages came from the same address.
• the handling status (new, handled or spam), when it was handled and by whom

The form also has a hidden field and a timestamp against spam. If they show that a program sent the message, the message is not stored at all.

Email

A message from the form is forwarded in full (name, email address, organisation, language, time of arrival and the message) by email to our sales mailbox, so that we can answer it directly. When you write to us or we reply to you, the emails and their details (name, address, content) are kept in our email service.

Server logs

The server keeps a technical log of form submissions: the full IP address, the time, the address (/api/contact), the status and size of the response. The log never contains what you typed, your browser's details or cookies. The log is rotated daily and each rotated file is deleted 7 days later, so an entry is kept for at most about 8 days. It is used only to prevent abuse: an address that sends too much again and again can be blocked at the firewall for a while, for at most 7 days. Other page loads of the site are not logged.

How long we keep the data

• Messages from the form are deleted automatically 24 months after they arrived, or sooner if you ask us to delete them. Messages marked as spam are deleted 30 days after they were marked.
• Backups may still hold them for about 35 days after that: our encrypted backups are deleted at the latest 36 days after they were made.
• Server logs are kept for at most about 8 days.
• Emails, including the email forwarded from a form message, are kept as long as the conversation, and any customer relationship that follows from it, requires.

Who processes the data

Only Tarumo Oy's own staff handle the data. We use these service providers:

• UpCloud: servers, database and backups, all in Finland (Helsinki).
• Scaleway SAS: delivers the form's messages by email to our mailbox, in France (Paris, EU).
• Zoho Mail: our mailbox, where we read and answer the form's messages and other email, in an EU data centre.
• Google for analytics, only with your consent (see Cookies and analytics).
• Ahrefs Pte. Ltd. (Singapore) for analytics, only with your consent. Ahrefs acts as our processor under Ahrefs' Data Processing Addendum.

Data from the form and from email is not transferred outside the EU/EEA. Analytics data may be transferred outside the EU/EEA, but only with your consent: Google's under the EU–US Data Privacy Framework, and Ahrefs' to the United States under the EU standard contractual clauses (2021/914/EU). We do not sell the data or give it to anyone else.

Cookies and analytics

We switch analytics on only with your consent. Before you consent, the site sets no cookies and loads nothing from third-party services.

Necessary storage

The site keeps only your analytics choice in your browser's local storage (localStorage): whether analytics is allowed and when you chose. This is not a cookie and is never sent to us. We ask again after 12 months, or when this section changes.

Analytics with your consent

When you allow analytics, the site uses Google Analytics 4 and Ahrefs Web Analytics. We use them to see which pages are read and where visitors come from, so that we can improve the site. Google's advertising features, ads personalisation and Google signals are switched off.

The legal basis for analytics is your consent. You can withdraw it at any time with the Cookie settings link at the bottom of every page, or here: change cookie settings. When you withdraw it, analytics stops and its cookies are deleted from this site.

Your rights

You have the right to

• know what data we hold about you, and get a copy of it
• have wrong data corrected
• have your data erased
• have the processing restricted
• object to processing based on our legitimate interest
• withdraw your consent to analytics at any time.

Send your request to sales@tarumo.fi. We reply within one month. We may ask for something that shows the request comes from you (for example, a reply from the same email address).

Complaints

If you think your data is processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto, tietosuoja.fi).