Privacy Policy

Last updated: 21 July 2026

1. Data Controller

Marja Aalto
Website: https://aaltomarja.com
Email: admin@aaltomarja.fi

This Privacy Policy applies to both the Finnish- and English-language content of the website.

2. What personal data do we process?

The website may process the following information:

• website usage data, such as the pages visited, the time of the visit, how the visitor arrived at the website, approximate location, browser and device type
• technical server log data, such as the IP address, time of the visit, requested page, and technical information about the browser and device
• the name, email address and any other personal information included in an email sent to the website owner.

The website does not currently offer comments, contact forms or user accounts for visitors.

3. Why do we process personal data?

Personal data may be processed for the following purposes:

• ensuring the functionality, security and technical maintenance of the website
• detecting technical problems and misuse
• monitoring general website traffic and usage
• improving the website’s content and user experience
• responding to enquiries sent by email.

Personal data is not used for automated decision-making or profiling.

4. Legal bases for processing personal data

The processing of essential technical data and server logs is based on the data controller’s legitimate interest in maintaining the functionality, security and technical operation of the website.

The processing of information submitted by email is based on responding to the enquiry and the data controller’s legitimate interest in managing communications related to the website.

The use of Google Analytics and the placement of related analytics cookies are based on the visitor’s consent. Analytics cookies are not activated without the visitor’s consent. Consent may be withdrawn at any time through the website’s cookie settings.

5. Google Analytics

The website uses Google Analytics 4 to monitor website traffic and usage. The service may collect information such as the pages visited, duration of the visit, how the visitor arrived at the website, and the device and browser used.

Google Analytics is activated only after the visitor has accepted analytics cookies. The information produced by Google Analytics is primarily viewed in aggregated form, and it is not used to identify individual visitors.

Further information about the cookies used on the website and their duration is available in the website’s Cookie Policy.

6. Recipients of personal data and service providers

External service providers are used in the operation of the website and may process personal data to provide their services. These include, in particular:

• the website hosting and technical service provider
• the email service provider
• Google Ireland Limited as the provider of Google Analytics.

Service providers process data in accordance with their own terms and privacy policies. Personal data is not sold to third parties.

7. Transfers of personal data outside the EU and EEA

Google and other technical service providers may also process personal data outside the European Union or European Economic Area.

When personal data is transferred outside the EU or EEA, the transfer is carried out in accordance with applicable data protection legislation and appropriate safeguards, such as an adequacy decision by the European Commission or the European Commission’s standard contractual clauses.

8. How long do we retain personal data?

Data collected by Google Analytics is retained in accordance with the retention period configured for the service. The duration of individual cookies is described in more detail in the website’s Cookie Policy.

Technical server logs are retained only for as long as necessary to maintain the website’s functionality and security, investigate technical problems and prevent misuse.

Email correspondence is retained for as long as necessary to respond to the message and deal with the matter concerned. Information may be retained for longer where this is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

9. Cookies

The website uses cookies that are essential for its operation. The use of essential cookies does not require separate consent.

Analytics cookies are used only with the visitor’s consent. Visitors can accept or reject optional cookies and change their choices later through the website’s cookie settings.

Further information about the cookies used on the website is available in the Cookie Policy.

10. Your data protection rights

Depending on the circumstances and the legal basis for processing, you may have the right to:

• obtain confirmation as to whether your personal data is being processed
• request access to your personal data
• request the correction of inaccurate or incomplete personal data
• request the deletion of your personal data
• request the restriction of processing
• object to processing based on legitimate interests
• withdraw your consent at any time
• receive personal data you have provided and, in certain circumstances, have it transferred to another service provider.

The applicability of these rights depends on the purpose and legal basis of the processing. Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Requests concerning your personal data can be sent to admin@aaltomarja.fi. You may be asked to verify your identity where necessary.

11. Right to lodge a complaint

If you believe that your personal data has been processed in breach of applicable data protection legislation, you have the right to lodge a complaint with a supervisory authority.

The supervisory authority in Finland is:

Office of the Data Protection Ombudsman
https://tietosuoja.fi/en

12. Changes to this Privacy Policy

This Privacy Policy may be updated if the website’s operation, the services used or the processing of personal data changes. The current version will always be available on this page.