Privacy Policy
Who Is Responsible
LOUPA, a Finnish sole trader (yksityinen elinkeinonharjoittaja), Business ID 3598985-9, is responsible for the personal data processed through the LOUPA corporate website. For privacy enquiries and requests concerning your data, contact info@loupa.fi. LOUPA has not formally appointed a Data Protection Officer. The privacy contact is a channel for enquiries and rights requests, not a designated DPO.
Scope and Sources
This notice covers visits to https://loupa.fi and enquiries sent to LOUPA. We receive the information you provide and technical request data needed to serve and protect the website. This notice is not a privacy notice for customer exchanges through Secure.
Your Enquiries
The form requires name, email address and message. It also sends context about your enquiry: language, time, source page, enquiry type and any selected plan or billing preference. We use the information to answer your enquiry and discuss the requested services. We rely on our legitimate interest in responding to communications you initiate and conducting our business (Article 6(1)(f)). Article 6(1)(b) applies only to necessary steps you request before a contract to which you will personally be a party; it does not automatically cover an employee contacting us for an employer. Ordinary general and commercial enquiries are kept for no longer than twelve months after the last relevant communication and are deleted earlier when no longer needed. If a message forms part of a legal or accounting record, only the information needed for that obligation is retained for the applicable period. For rights requests, we keep the information needed to complete the request and deal with a related review or dispute; identity documents and copies prepared for disclosure are removed when their purpose ends. Spam is deleted periodically, normally aiming for thirty days. Deletion from the mailbox does not mean immediate removal from every recovery copy.
Website Operation
Technical request data, including IP address, time and request details, are used to serve and protect the website. The website server does not keep an access log of ordinary visits. The website’s WordPress service and database do not retain a history of ordinary technical errors; their diagnostic output is not stored persistently. If information needs to be retained for a specific incident, it is limited to what is necessary to investigate, resolve the incident and handle a related claim. Its necessity is reviewed when the incident is closed, and it is removed when those purposes end unless a legal obligation requires further retention. The form checks submissions to prevent abuse. After a successful submission, it uses an IP hash to limit repeat submissions for ten minutes. This hash remains personal data. We rely on our legitimate interest in keeping the website available and secure (Article 6(1)(f)). These checks do not create advertising profiles. Hosting and email providers may also keep technical records for the purposes described below.
Website Statistics
To understand demand for the corporate website and improve it, we count normal requests to selected commercial pages, validated enquiry forms and message submissions accepted by the email provider. We store only daily totals by page, language and event type. The counters do not store visitor identifiers, IP addresses or IP hashes, user agents, referring pages, raw URLs or query strings, or enquiry content. They do not use analytics cookies or browser tracking code, identify unique visitors or create advertising profiles. Provider acceptance does not establish delivery or reading. We keep daily totals for the current and previous calendar month, using Finnish time. Older totals are removed when a new event is counted or the report is read; if neither occurs, removal waits until the next such action. Removal does not mean immediate erasure from recovery copies. We rely on our legitimate interest in assessing demand and improving the website (Article 6(1)(f)). This measurement does not cover exchanges in LOUPA Secure.
Recipients and International Transfers
Recipients include the people handling the enquiry, providers of website hosting, email delivery and mailbox services, and administrators or backup services supporting those systems. Information may also be disclosed to authorities or professional advisers where necessary for a legal obligation or a specific claim. Hetzner provides website hosting, Louhi provides the mailbox service, and Mailgun delivers form messages through its EU service configuration. Hetzner and Louhi process data on LOUPA’s behalf to provide hosting and mailbox services, respectively. An EU service region is not a guarantee that every provider operation stays within the European Economic Area. Mailgun’s published terms refer to the Sinch Data Processing Agreement, which provides standard contractual clauses for restricted international transfers. Mailgun/Sinch acts as an independent controller for communications transmission, spam and fraud prevention, network security and maintenance, business management and legal compliance. Ask info@loupa.fi for details of relevant recipients and applicable transfer safeguards.
Providing Information
Name, email address and message are required to handle a form enquiry. Without them, the form cannot be submitted. Do not send passwords, identity documents or sensitive material in an initial enquiry. The corporate website has no newsletter subscription or behavioural advertising. Sending an enquiry does not constitute consent to marketing. Form validation and antispam checks do not make decisions producing legal or similarly significant effects about you.
Your Rights
We process information needed to handle your rights request to meet our GDPR obligations (Article 6(1)(c)). Depending on the processing and the conditions in the GDPR, you may request access, rectification, erasure, restriction or portability of your data. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Write to info@loupa.fi; we request additional identity information only where reasonably necessary. We respond without undue delay and normally within one month. If a permitted extension is needed, we explain it within that month. You may lodge a complaint with Finland’s Office of the Data Protection Ombudsman at tietosuoja.fi, or another competent supervisory authority.
Cookies and Updates
See Cookie Information for browser storage. We update this notice when our processing changes. Version: 10 October 2026.