This privacy notice explains how Granitics Oy (Granitics Ltd, hereinafter "Granitics Ltd") processes personal data in its customer and stakeholder relationships and in connection with the use of the granitics.fi website. The notice has been prepared in accordance with the EU General Data Protection Regulation (EU) 2016/679 (GDPR).
This notice does not apply to research data stored in Granitics eCRF. The controller of research data is the customer conducting the study, and Granitics Ltd acts as the processor of that personal data in accordance with the agreement made with the customer.
1. Controller
Controller: Granitics Oy (Granitics Ltd), Business ID 1660905-6
Address: Keilaranta 10 E, 02150 Espoo, Finland
Email: info@granitics.fi
Prepared: 11 February 2026, updated: 22 October 2026
2. Contact details for data protection matters
Any questions and requests concerning the processing of personal data may be addressed to the controller by email at info@granitics.fi or by post to Granitics Ltd, Keilaranta 10 E, 02150 Espoo, Finland. We respond to requests within the time limits required by the GDPR.
3. Purposes and legal basis of processing
Personal data is processed in order to manage customer relationships, respond to enquiries, and plan and carry out sales and stakeholder communications. The data is not used for profiling or automated decision-making.
Processing is based on the controller's legitimate interest in managing its customer and stakeholder relationships, on the performance of a contract within a customer relationship and, where applicable, on consent given by the data subject. Consent may be withdrawn at any time.
4. Personal data processed
We process the following data:
- contact details: name, organisation, job title, telephone number and email address
- content of communications: the subject and content of emails and other messages, and the related history of dealings
- data relating to the customer relationship, such as quotations, contracts and invoicing details
- consents given and objections made by the data subject.
5. Sources of data
Data is obtained primarily from the data subjects themselves, for example when they contact us by email or telephone, attend an event or deal with us during a customer relationship. In addition, data on companies' contact persons may be collected from public sources, such as company websites and business contact databases.
6. Disclosure of data
Data is not disclosed to parties outside Granitics Ltd without the data subject's consent, unless required by applicable legislation. Data is not sold or disclosed for marketing purposes.
7. Processors and transfers of data
Data may be stored in the systems of service providers used by Granitics Ltd, such as email and customer relationship management services. These service providers process the data only on behalf of Granitics Ltd and in accordance with its instructions. If a service provider processes data outside the EU or EEA, the transfer is carried out with the safeguards required by the GDPR, for example by using the European Commission's standard contractual clauses.
8. Retention period
Personal data is retained only for as long as necessary to fulfil the purpose of the processing or to comply with legal obligations, such as those under the Accounting Act. Data based on consent is retained until the consent is withdrawn. Data that is no longer needed is deleted or destroyed securely.
9. Data security
Data is stored in systems protected by firewalls, passwords and other technical safeguards. Access to the data is limited to those Granitics Ltd employees whose duties involve processing the data and who are bound by confidentiality. Each user has a personal user ID. Any paper records are kept in locked premises with restricted access.
10. Rights of the data subject
Under the GDPR, the data subject has:
- the right of access to personal data concerning them,
- the right to request the rectification of inaccurate or incorrect data,
- the right to request the erasure of their personal data,
- the right to request restriction of the processing of their personal data,
- the right to transfer their data from one system to another,
- the right to object to the processing of their data, including direct marketing,
- the right not to be subject to a decision based solely on automated processing,
- the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
- the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the GDPR.
Requests to exercise these rights should be sent to the contact details given in section 2. We may ask the data subject to verify their identity before processing the request.
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. Its contact details are available at tietosuoja.fi.
11. Cookies and technical website data
The granitics.fi website does not use cookies or any analytics or tracking tools, and the website has no forms. The website's fonts and other files are loaded from Granitics Ltd's own server, so no visitor data is passed on to third parties.
To maintain information security, the website's server may record standard technical log data, such as the visitor's IP address, the time of the visit and the page requested. Log data is not used to identify visitors and is deleted regularly.
12. Changes to this notice
Granitics Ltd may update this privacy notice, for example when legislation or its operations change. The current version is always available on this page, and the date of the latest update is given in section 1.