Information and terms
Privacy policy
This policy explains how Östman Group Oy Ab processes personal data on this website and in customer relationships under the EU General Data Protection Regulation (GDPR).
Updated 16.8.2026
Controller
Östman Group Oy Ab, business ID 2789342-7
Törmäniityntie 15 C 36, 02170 Espoo, Finland
Contact person: Kevin Östman, kevin.ostman@ostmangroup.fi, 050 344 0512
What data we process
We only process data you provide or that arises from using the site:
- Contact form data: name, email, phone, company, topic and message
- Consent record and the time of submission
- Technical data: browser information and an anonymised IP identifier to prevent abuse
- Customer relationship data: agreements, orders and invoicing details
- Analytics data about site usage, collected with your consent
Purposes and legal basis
- Answering enquiries and preparing quotes — legitimate interest and consent
- Managing the customer relationship, delivery and invoicing — contract
- Accounting and statutory obligations — legal obligation
- Improving and measuring the website — consent (analytics cookies)
- Preventing abuse and spam — legitimate interest
Retention
Enquiries are kept for up to 24 months unless a customer relationship begins. Customer data is kept for the duration of the agreement and the six years required by accounting law. Analytics data is kept for up to 14 months.
Recipients and processors
Only people who need the data for their work can access it. We use the following categories of processors, each under a data processing agreement (GDPR Art. 28):
- Website, database and form storage — application platform and database service within the EU
- Handling of enquiries — Östman Group's own customer management (Östman Group Business Platform), where form data is transferred for processing within the group
- Email and communication — email service provider
- Accounting and invoicing — accounting firm and finance system
- Analytics with consent only — Google Ireland Limited (Google Analytics 4)
Transfers outside the EU/EEA
We keep processing inside the EU/EEA wherever possible. If data is transferred outside that area, for example in connection with analytics, the transfer relies on the European Commission's standard contractual clauses together with supplementary safeguards. We never sell or rent personal data, and we do not use it for automated decision-making or profiling.
Abuse prevention
When a form is submitted we store browser information (user agent) and a hash of the IP address that cannot be reversed to the original address. These are used only to prevent spam and abuse and to rate-limit submissions. The legal basis is legitimate interest (GDPR Art. 6(1)(f)).
Security
Data is stored in protected systems requiring personal credentials with role-based access, and traffic to the site is encrypted (HTTPS). Personal data breaches are reported to the supervisory authority within 72 hours, and to affected individuals where the breach poses a high risk.
Your rights
You have the right to:
- access your data and receive a copy
- have inaccurate data corrected or erased
- restrict or object to processing and withdraw consent at any time
- receive your data in a machine-readable, portable format
- lodge a complaint with the supervisory authority
How to exercise your rights
Send your request by email to kevin.ostman@ostmangroup.fi with the subject "Data protection request". Tell us which right you wish to exercise and which enquiry or customer relationship it concerns.
We verify your identity before disclosing data, where necessary by asking for confirmation from the same email address the data was submitted with. We respond within one month; for unusually extensive requests we may extend this by two months and will tell you if we do. Requests are free of charge.
You can withdraw cookie consent yourself at any time from the Cookie settings link in the footer.
If you are not satisfied with our processing, you can lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, Finland — tietosuoja.fi.
Changes to this notice
We keep developing our services, so this notice may change. We announce material changes on the site and ask for cookie consent again if our use of cookies changes. This version was updated 16.8.2026.