Last updated October 9, 2026․
1. Controller and scope
1.1 Oiketos Oy is the controller for the personal data described in this policy․ Contact us at privacy [at] oiketos [dot] com about your data or this policy․
1.2 This policy covers website visits, inquiries, business relationships, customer administration, billing, marketing and Oiketos Insights subscriptions․
1.3 Personal data processed on a customer’s behalf is described in Data Protection․ The customer’s instructions and applicable data processing agreement govern that processing․
2. Website visits and inquiries
2.1 The web server processes connection and request information, including your IP address and the page requested, to deliver the website and maintain its operation․ Our legitimate interest is operating and securing the website․
2.2 When you contact Oiketos, we process your email address, other contact details you provide and the content of your message to respond and manage the discussion․ Our legitimate interest is communicating with people who inquire about our work․
3. Cookies and analytics
3.1 The website uses cookies․ A necessary first-party cookie named oiketos_cookie_consent records your cookie choices for 182 days, unless you update them sooner․
3.2 With your consent, we use self-hosted Umami to understand website visits, content interactions and campaign traffic․ We collect page views, browser and device information, approximate country and website performance measurements․ We use this information to improve the website and its content․
3.3 Umami’s analytics tracker uses no cookies․ We keep the analytics on Oiketos’s infrastructure and use rotating pseudonymous session identifiers․ We do not add your email address or a personal account identifier to website analytics․ URL fragments and query parameters other than selected campaign identifiers are excluded․
3.4 Analytics starts after you allow it․ You can reject optional analytics and change or withdraw your choice through Cookie settings․ We also respect your browser’s Do Not Track setting․ Necessary storage remains available for its essential purposes․
3.5 Website analytics is hosted on Oiketos’s infrastructure in the European Union․ Access to its reports is restricted to authorized users․ Umami’s documentation describes the tracker and the data it collects․
4. Business relationships and marketing
4.1 Business contact information may include your name, organization, role, work email and correspondence․ We use it to manage customer relationships, respond to service requests and communicate about relevant Oiketos products․ Our legitimate interest is maintaining B2B business relationships, subject to applicable marketing rules․
4.2 We process billing contact details and transaction records to administer purchases and meet accounting obligations․
4.3 You can object to direct marketing at any time by contacting us․ Newsletter subscriptions follow the consent process in section 5․
5. Newsletter subscriptions
5.1 If you request Oiketos Insights, we use your email address to send a confirmation link․ Your subscription becomes active after you confirm it․ We keep a record of the request and confirmation to document your consent․
5.2 We send the monthly newsletter on the basis of that consent․ You can withdraw it through the unsubscribe link in a newsletter or by contacting us․ Providing your address is voluntary and is needed to receive the newsletter․
5.3 Email images and content links record observed openings and clicks against the message sent to you․ We use their timing to estimate reader interest and order later newsletter deliveries․ Automated email checks can also produce these observations․ Website analytics remains separate from individual newsletter records․
6. Retention
6.1 We retain inquiry and business correspondence for as long as needed to manage the relationship and related obligations․ Financial records follow applicable accounting retention requirements․
6.2 Newsletter addresses remain on the active list until you unsubscribe․ Unconfirmed requests are removed after their confirmation period expires․ Minimal records may remain to respect delivery blocks or earlier withdrawals․ Technical IP address and browser evidence for newsletter observations is removed after seven days․
6.3 We retain only the records needed to document consent, respect an unsubscribe request or meet applicable obligations after a subscription ends․
6.4 Website analytics records are retained for up to 36 months and then removed through scheduled maintenance․
6.5 Restricted database backups support recovery and are replaced within seven days․ Restored data follows the same retention and withdrawal rules․
7. Service providers and international transfers
7.1 Access to personal data is limited to people and service providers who need it for the purposes described here․ Our email delivery providers process recipient addresses and message content to send confirmation messages and newsletters․ We use Telia Finland Oyj’s SMTP service and Postmark․ See Telia’s privacy notice and Postmark’s data protection information for their processing arrangements․ Postmark also processes delivery events․ Oiketos operates the self-hosted analytics service described in section 3․ We do not sell subscriber addresses․
7.2 Postmark hosts its service in the United States․ Its data processing addendum includes standard contractual clauses for international transfers․ Other processing outside the European Economic Area follows the safeguards required by data protection law․ Contact us for information about the providers and safeguards that apply to your data․
8. Your rights
8.1 Under applicable data protection law, you can request access to your personal data and correction of inaccurate information․
8.2 You can request erasure or restriction of processing where the relevant conditions apply․
8.3 You can request a portable copy of data where the right to portability applies․
8.4 You can withdraw consent to processing based on your consent․ Withdrawal leaves earlier lawful processing unaffected․
8.5 You can object to processing based on legitimate interests and ask us to assess your objection․ An objection to direct marketing ends processing for that purpose․
8.6 You can lodge a complaint with a data protection authority, including the Finnish Data Protection Ombudsman․
9. Changes to this policy
9.1 This page carries the current policy and its revision date․ Material changes affecting a newsletter subscription will be communicated to subscribers․