Privacy policy

1. Data controller

Invoicing service:

Eezy Oyj
Business ID: 2078119-5
Postal address: Siltasaarenkatu 12, 00530 Helsinki

Contact person for data protection matters:
Väinö Tiiri, info@digilap.io

2. What personal data do we collect?

2.1 Contact form

We only collect the information necessary to handle your contact request:

We do not collect: phone numbers, addresses, dates of birth or any other unnecessary data.

2.2 Automatically collected data

NOTE: The IP address is collected automatically into the server log files when you visit the site. This information is used only for technical maintenance and security, not for marketing or profiling.

3. Why do we process your data? (Legal basis)

We process your personal data on the following grounds under the EU General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a)): When you submit the contact form, you give your consent to the processing of your data.
• Legitimate interest (Art. 6(1)(f)): Storing the IP address to prevent misuse and to ensure technical operation.

4. How long do we keep your data?

You can request deletion of your data at any time (see section 8).

5. Who do we share your data with?

We do not sell, rent or disclose your data to third parties for marketing purposes.

Your data is processed by the following subcontractors:

Formspark (form service)

• Purpose: Processing the contact form and sending email
• Location: EU (Germany)
• Data protection: GDPR-compliant
• Retention: Form data is kept in the Formspark service until you delete it manually or request deletion
• Privacy policy: https://formspark.io/legal/privacy-policy/

Spaceship (hosting service)

• Purpose: Website hosting and technical operation
• Location: USA
• Data protection: Uses appropriate technical and organisational safeguards
• Data collected: IP address (server logs), user agent, time of request
• Retention: Log data 30 days
• Note: The hosting server stores only technical log data. The site is static (HTML/CSS/JS), so no personal data is stored permanently on the server.

Eezy Oyj (invoicing service)

• Purpose: Invoice handling (if a customer relationship arises)
• Location: Finland (EU)
• Data protection: GDPR-compliant

Cookiebot ApS (cookie management)

• Purpose: GDPR-compliant cookie management
• Location: EU (Denmark)
• Data protection: GDPR-compliant

6. International data transfers

Data transfer outside the EU (USA)

Our website hosting server (Spaceship) is located in the USA, which means that technical log data (IP address, user agent, time of request) is transferred outside the EU. The transfer is based on the following safeguards:

1. Data minimisation: Only technically necessary data (IP address, user agent) is transferred to the server.
2. Limited retention: Log data is deleted automatically after 30 days.
3. Encryption: All data transfer takes place over an encrypted connection (HTTPS/TLS 1.3).
4. No marketing use: The IP address is used only for technical maintenance and security, not for marketing or profiling.
5. Static site: The site does not store personal data in a database. All personal data (contact form) is processed within the EU (Formspark).

NOTE: The contact form data (name, email, message) is not transferred to the USA but is processed entirely within the EU through the Formspark service.

7. Data security

We protect your data with the following measures:

• SSL/TLS 1.3 encryption: All data transfer is encrypted at the highest security level
• HTTPS enforced: The site does not work without encryption
• Restricted access: Only authorised persons process the data
• Backups: Regular backups in case of data loss
• Firewalls: Automatic DDoS protection in the hosting service
• Data minimisation: We only collect necessary data
• Automatic deletion: Old log data is deleted after 30 days
• No database: The site is static and does not store data on the server

8. Your rights

You have the following rights regarding your personal data:

Right of access (Art. 15)

You can request a copy of all data stored about you.

Right to rectification (Art. 16)

You can request correction of incorrect data.

Right to erasure (Art. 17)

You can request deletion of all your data ("right to be forgotten"). We carry out the request within 30 days.

Right to restriction of processing (Art. 18)

You can request restriction of the processing of your data in certain situations.

Right to data portability (Art. 20)

You can request your data in a machine-readable format (e.g. JSON, CSV).

Right to object (Art. 21)

You can object to the processing of your data in certain situations.

Right to withdraw consent

You can withdraw your consent to the processing of your data at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

Right to lodge a complaint (Art. 77)

If you believe that we process your data unlawfully, you can lodge a complaint:

Exercise your rights

Send your request by email: info@digilap.io
We reply within 30 days.

9. Cookies

Currently we only use necessary cookies that are needed for the basic functions of the site.

Necessary cookies (no consent required)

In the future: If we add analytics or marketing cookies (e.g. Google Analytics), we will ask for your separate consent through the cookie banner.

You can manage your cookie settings by clicking the "Cookie settings" link at the bottom of the site.

10. Changes to this privacy policy

We reserve the right to update this privacy policy as needed. We will announce significant changes on our website.

Last updated: 17 February 2026

11. Contact details

If you have questions about our data protection or want to exercise your rights, please contact us:

We reply to all data protection requests within 30 days.