Privacy Policy

1. Data Controller

Nameto Oy
Business ID: 3385131-1
Address: Kruunuvuorenkatu 2 C 12, 00160 Helsinki
Email: [email protected]

2. Data Protection Officer

Postal address:
Data Protection Officer / Nameto Oy
Kruunuvuorenkatu 2 C 12
00160 Helsinki

3. Register Name

Nameto Oy Personal Data Register

4. Purpose and Legal Basis of Processing Personal Data

The Data Controller processes personal data for the following purposes:
— Maintaining customer relationships;
— Marketing purposes, including direct marketing;
— Improving customer service and business operations;
— Analysis and statistical purposes;
— Monitoring website traffic;
— Enhancing website user experience;
— Measuring the performance of the website and of DNS resolution for website visitors;
— Protecting the website and its contact forms against misuse and automated attacks.

The primary legal basis for processing personal data is the consent given by the data subject or the legitimate interest of the Data Controller. Analytics and performance measurement technologies on the website are used only with the data subject’s consent (see section 9).

If we want to use your information for any other purpose, we will ask you for consent and will use your information only on receiving your consent and then, only for the purpose(s) for which you grant consent unless we are required to do otherwise by law.

5. Data Content and Categories of Personal Data in the Register

The register may contain information about the contact persons of the Data Controller’s customers, companies, and partners, as well as the contact persons of potential customers and partners, and users of the Data Controller’s website. The register may process the following information about data subjects:
— Name and position;
— Contact details (phone number, email address);
— Company details (countries of operation, company’s contact information, amount of subscribers);
— Information related to online behavior;
— Technical information, such as IP address, browser type and version, device platform, network operator and the DNS resolver used by the data subject’s device, and data stored in the data subject’s browser, including cookies.

6. Regular Sources of Information for the Register

Information is regularly collected directly from the data subject with their consent. It may also be collected when subscribing to newsletters, downloading guides, submitting contact requests, or engaging in online activities on the Data Controller’s website and social media channels. Information may be updated from other registers of the Data Controller, the registers of partners, and authorities, within the limits set by the law.

7. Storage of Personal Data

Personal data is stored only for as long as necessary for the purposes defined in this Privacy Policy, taking into account legal restrictions. Due to legal obligations, some information may be retained for a longer period than mentioned above. Outdated and unnecessary information is appropriately disposed of. Personal data is recorded in the register as provided by the data subject, and updates are made based on information provided by the data subject.

8. Disclosures and Transfers of Personal Data

The Data Controller may use subcontractors and service providers for technical maintenance, customer service, user data management and analysis, research, customer communication, or the implementation of various campaigns. Personal data may be disclosed to subcontractors and service providers only to the extent that they participate in the provision of the Data Controller’s services and the realization of the purposes described in this Privacy Policy. These third parties are not allowed to use your information for purposes other than those described in this Privacy Policy.

On the website, the Data Controller uses the following service providers: Cloudflare, Inc. (content delivery, security, Cloudflare Turnstile bot protection and Cloudflare Web Analytics) and Google Ireland Limited (Google Analytics, only with consent), as well as hosting and email service providers. Section 9 describes the data processed on the website.

The Data Controller uses service providers for data processing who may have access to data from outside the EU/EEA, such as the United States. The Data Controller ensures the proper and lawful implementation of transfers in accordance with data protection legislation.

Personal data may be disclosed to competent authorities in accordance with their requirements and legal conditions.

9. Cookies and Similar Technologies

The Data Controller uses cookies and similar technologies on its website. Cookies are small text files stored on the user’s computer or other device, and they do not harm the user’s device. Necessary technologies are always active. Analytics and performance measurement technologies are used only if the user consents to them in the cookie banner. The user can change or withdraw consent at any time using the Cookie settings link at the bottom of every page of the website. Withdrawing consent does not affect processing carried out before the withdrawal.

Necessary technologies

The cookie nameto_consent stores the user’s consent choices and a random consent identifier for one year. To be able to demonstrate consent, the website records each choice together with this identifier, the time and the version of the consent text. These records contain no IP address and are deleted after two years. To prevent misuse of this recording, the website keeps a keyed hash of the IP address for 10 minutes.

When the user submits a contact form, the website sets the cookie __Host-nameto-contact-guest. It contains a random security token, is used only to protect the form against misuse and expires after two days. The contact forms are protected by Cloudflare Turnstile, which processes technical data such as the IP address and browser characteristics to tell people apart from automated programs. To limit misuse, the website also stores keyed hashes of the user’s IP address (for IPv6 addresses, of the /64 network prefix) and of the email address entered in the form, together with request counters; these entries expire after 10 to 30 minutes. Contact requests are delivered to the Data Controller by email and are not stored in the website database.

The website is delivered and protected by Cloudflare, Inc., which processes IP addresses and other technical request data for content delivery and security. Cloudflare Web Analytics compiles aggregated statistics on page views and page load performance without using cookies.

Analytics (only with consent)

With the user’s consent, the Data Controller collects statistical information based on Google Analytics services, provided by Google Ireland Limited, for website development. Google Analytics cookies (_ga and _ga_*, stored for up to 400 days) store information such as the source through which users accessed the site (search engine, direct link, etc.), pages visited, and the time users spent on each page. This information helps us further develop our website and monitor the success of new developments. Statistics on user numbers, country of use, usage time, browser used, and visited content are recorded.

Performance measurement (only with consent)

With the user’s consent, the website runs a DNS performance measurement (DNS RUM) in the user’s browser. The browser resolves a few unique, randomly generated hostnames under the domain dnsrum.dnstele.com and loads a small test image from each of them. The following results are sent to our measurement service at rum.dnsrum.dnstele.com: DNS and connection timings, browser type and version, device platform, the website on which the measurement was made, and the time of the measurement. To analyse the results, the service also processes the user’s IP address to determine the network and network operator, and the IP address of the DNS resolver used by the user’s device. The measurement does not store cookies or other data on the user’s device. In the measurement database, raw measurement data is deleted after 24 hours and DNS server logs after 7 days; measurement results are kept for up to 180 days.

Users can also block or delete cookies in their browser settings. If this function is turned off, it may slow down the operation of some websites or prevent access to certain websites altogether.

10. Retention of Your Information

We will retain your personal information with us for 90 days to 2 years after users terminate their accounts or for as long as we need it to fulfill the purposes for which it was collected as detailed in this Privacy Policy. We may need to retain certain information for longer periods such as record-keeping / reporting in accordance with applicable law or for other legitimate reasons like enforcement of legal rights, fraud prevention, etc. Residual anonymous information and aggregate information, neither of which identifies you (directly or indirectly), may be stored indefinitely. Retention periods of the website technologies are described in section 9.

11. Rights of Data Subjects

Right to inspect

Data subjects have the right to inspect the information stored about them in the Data Controller’s marketing register. The right to inspection is generally free of charge.

Right to object and restrict processing

Data subjects have the right to object to the processing of their data at any time if they believe that the Data Controller has processed the data unlawfully or has no right to process the data. However, there is no right to object to the extent that the processing of data is necessary to fulfill a legal obligation or for other legal reasons.

Right to erasure

Data subjects have the right to have incorrect information corrected or incomplete information supplemented, as well as the right to request the deletion of their data from the Data Controller’s register. However, there is no right to erasure to the extent that the processing and retention of data in the register are necessary to comply with a legal obligation or for other legal reasons.

Right to data portability

To the extent that the data subject has provided information to the Data Controller’s marketing register based on the data subject’s consent or assignment, the data subject has the right to receive this information in a machine-readable format and the right to transfer this data to another data controller.

Right to opt-out of direct marketing

Data subjects have the right to object to the processing of their data for direct marketing purposes at any time.

Right to complain

Data subjects have the right to lodge a complaint with the relevant supervisory authority if the Data Controller has not complied with applicable data protection regulations.

Other rights

If data is processed based on the data subject’s consent, the data subject has the right to withdraw their consent at any time by notifying the Data Controller as described in section 12 of this Privacy Policy. Consent to cookies and similar technologies can also be withdrawn using the Cookie settings link at the bottom of every page (see section 9).

12. Contact Information

Data subjects should send requests regarding their rights in writing or by email to the address mentioned in section 2.

The Data Controller may ask the data subject to clarify their request and verify their identity before processing the request. The Data Controller may refuse to fulfill the request on the basis of applicable law.

The Data Controller will respond to requests within one (1) month of receiving the request, unless there are specific reasons to extend the response time.

13. Automated Decision-making and Profiling

Data in the register is not used for automated decision-making or profiling of data subjects.

14. Principles of Register Protection

Protecting the personal data of data subjects is important to the Data Controller. Data is stored in electronic systems protected by firewalls, passwords, and other appropriate technical solutions. Access to the register is only granted to employees of the Data Controller and other specified persons who need the information in their duties. All persons using the register are bound by a duty of confidentiality.

15. Changes to the Privacy Policy

The Data Controller continually develops its business and reserves the right to change this Privacy Policy by notifying it on its website. Changes may also be based on changes in legislation. The Data Controller recommends that data subjects regularly review the content of the Privacy Policy.