This Privacy Policy has been prepared in accordance with the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (1050/2018), Sections 10 and 24 of the Personal Data Act, and the Act on the Protection of Privacy in Working Life (759/2004).

At Kimbtron Oy, we value privacy and strive to provide everyone with a safe and pleasant user and service experience. At the same time, we aim to understand our customers’ needs, create engaging content, and serve our customers as effectively as possible. By collecting information from various sources and using it responsibly, we can improve the user experience and the quality of our services.

Please note that this privacy statement applies only to the processing of personal data carried out by Kimbtron Oy. It does not apply to the processing of personal data by third parties, and Kimbtron Oy is not responsible for the data processing activities of third parties.

Last updated: 29.12.2025

1. Data Controller

Kimbtron Oy (hereinafter referred to as “Kimbtron” or “we”)
Business ID 2776397-2
Okeroistentie 1
15800 Lahti

2. Contact Person Responsible for the Register

Kimmo Palo
kimbtron@gmail.com
+358 45 673 5484

3. Purpose and Legal Basis for the Processing of Personal Data

The primary basis for processing personal data is the customer relationship between Kimbtron and the customer, an assignment, or the customer’s consent to the processing of personal data. Kimbtron processes personal data in order to fulfill its contractual obligations towards its customers and to comply with applicable legislation.

In addition, we process personal data to develop our business and may collect technical information about users of our website in connection with website visits.

Personal data may be processed by Kimbtron for the following purposes:

• Providing, delivering, producing, and designing Kimbtron’s services and products
• Managing and maintaining the customer relationship between Kimbtron and the customer
• Implementing, developing, and monitoring customer service and related communications and marketing
• Conducting customer feedback and opinion surveys
• Collecting, monitoring, and analyzing customer satisfaction data

Personal data is also processed for the purposes of orders, invoicing, contact requests, customer transactions, recruitment, reporting, and business development.

Technical information may be used to analyze website functionality and to improve services.

4. Content of the Register

We collect personal data necessary for the delivery of services from private customers using Kimbtron’s services, job applicants, employees, and partners. In addition, we may collect technical data from users of our website in connection with website visits.

For example, we may collect and process the following personal data when delivering services and from job applicants and employees:

• First and last name
• Contact details (address, phone number, and email address)
• Gender
• Date of birth
• Language skills
• Customer number
• Information provided by customers when evaluating our services or giving feedback

In connection with the use of our website, we may collect the following technical data, for example:

• Duration and time of website visits
• Actions taken on the website
• Information describing browsing behavior
• IP address, operating system, and internet service provider

5. Regular Sources of Information

We collect personal data only in connection with providing services and through the use of our website, directly from the customer or user.

The data stored in the register is obtained from our customers. Sources of information include messages sent via web forms, email, telephone, social media services, agreements, customer meetings, and other situations in which a person provides their information.

6. Cookies

We automatically collect information about how Kimbtron’s websites are used. In our digital services, we may collect behavioral data using cookies and other similar technologies (such as web beacons, pixels, and tags).

A cookie is a small file stored on the user’s device that contains an anonymous numerical identifier used to distinguish and count different browsers visiting the website. Cookies and similar technologies do not harm the user’s device or files, do not enable the spread of viruses, and do not provide access to data stored on the user’s device.

We use cookies and similar technologies to develop our services. Information collected through cookies may be combined with personally identifiable information, such as name and email address, but the data is typically anonymized or pseudonymized.

Kimbtron uses the Google Analytics analytics tool to measure website usage. Information collected through Google Analytics (such as pseudonymized IP addresses) is transmitted to and stored on Google’s servers around the world, and therefore data may also be processed outside the EU or EEA.

More information about Google Analytics’ privacy practices:
https://support.google.com/analytics/topic/2919631?hl=fi&ref_topic=1008008

You can prevent the use of Google Analytics by installing a browser add-on available at:
https://tools.google.com/dlpage/gaoptout

7. Disclosure of Data

We share personal data only within Kimbtron’s organization and only to the extent necessary to provide and develop our services.

We do not disclose personal data to third parties outside Kimbtron’s organization unless one of the following conditions applies:

• Advertising: Anonymous data related to website use may be shared with advertisers and partners.
• Implementation of the purposes of this Privacy Policy: Third parties may be granted access to personal data where necessary for the performance of services. Kimbtron ensures through contractual and organizational measures that data is processed lawfully and only for defined purposes.
• Authorities: Personal data may be disclosed to competent authorities in accordance with legal obligations.
• Corporate transactions: In connection with business arrangements, personal data may be disclosed confidentially to buyers and their advisors.
• Consent: Personal data may be disclosed to third parties with the explicit consent of the data subject.
• Debt collection and legal claims: Data may be disclosed for the purpose of collecting receivables or preparing, presenting, or defending legal claims.

8. Transfer of Data Outside the EU or EFTA

As a rule, Kimbtron does not transfer personal data outside the EU or EEA.
Exceptions include third-party analytics and cloud services (such as Google Analytics), where data may be transferred in accordance with protection mechanisms approved by the EU.

9. Principles of Register Protection

Due care is observed in the processing of the register. Digital personal data is stored on secure servers, and manual materials are kept in locked facilities. Access to data is restricted to persons who have the right to process it based on their work duties.

10. Data Retention Period

Kimbtron does not retain personal data longer than necessary for the purpose of processing or to fulfill statutory obligations. The retention period is determined based on the nature of the data and its intended use.

11. Rights of the Data Subject

The data subject has the right to inspect the data recorded about them, request the correction of inaccurate data, and otherwise exercise their rights provided by law. The processing of personal data is based on the data subject’s consent. In accordance with Articles 18 and 21 of the EU General Data Protection Regulation, the data subject has the right to restrict or object to the processing of their data or to request the deletion of their data from the personal data register.

A data subject wishing to inspect, correct, or delete their data must submit a written request to the data controller in a personally signed or otherwise equivalently verified document. Identity will be verified from an official identity document or by another verified and secure method before data is disclosed. The right of access may be denied on statutory grounds. The right of access is free of charge once per year.

The customer may give Kimbtron consent for direct marketing in accordance with Section 26 of the Act on Electronic Communications Services or prohibit the processing of their personal data for direct marketing in accordance with Section 30 of the Personal Data Act. The right to object does not apply to customer communications, advertising included in services, or communications forming part of the customer relationship.

Right of access
The data subject may verify the personal data we have stored.

Right to rectification
The data subject may request the correction of inaccurate or incomplete data concerning them.

Right to object
The data subject may object to the processing of personal data if they believe that the data has been processed unlawfully.

Right to prohibit direct marketing
The data subject has the right to prohibit the use of their data for direct marketing purposes.

Right to erasure
The data subject has the right to request the deletion of personal data concerning them from the register (“right to be forgotten”). Data subjects also have other rights under the EU General Data Protection Regulation, such as the right to restrict processing in certain situations. Requests must be sent in writing to the data controller. The data controller may request the applicant to verify their identity if necessary. The data controller will respond within the time limit set by the EU General Data Protection Regulation (generally within one month).

12. Automated Decision-Making

The register is not used for automated decision-making or profiling (Article 22 of the EU General Data Protection Regulation). Any personal data breaches affecting data subjects will be reported to the data subjects and authorities in accordance with applicable regulations.

13. Updating the Privacy Policy

We continuously develop our services and may amend this Privacy Policy. Changes may also be based on legislative amendments. The current version is available on our website.

14. Contact

If you have additional questions regarding our data protection practices, you may contact us at:
kimbtron@gmail.com