Privacy Policy

Teemu Neittamo / FinlandHosting Sole trader Business ID: 3547928-5

Miilumäki 7b 02740 Espoo Finland

Email: [email protected] Phone: +358 40 151 7757

FinlandHosting is the name and brand the data controller uses for their services.

Contact person for data protection matters: Teemu Neittamo [email protected]

FinlandHosting may process the following personal data:

• name
• email address
• phone number
• address
• company name and Business ID
• billing and payment information
• purchase history
• IP address and log data
• login and usage times
• customer service messages and support requests
• technical information relating to the use of services.

KYC identity verification

FinlandHosting may require customers to verify their identity before a service is activated, before its use is continued, or in certain situations involving fraud, misuse, security or other risks.

Identity verification uses the service provided by Didit Identity Spain, S.L. (Didit).

Verification may involve processing, for example:

• images and information from identity documents
• name
• date of birth
• document number
• document expiry date
• a selfie image
• information relating to a liveness check
• biometric data generated during facial comparison
• an imageless biometric template generated from a facial image
• the verification result
• potential fraud and risk signals
• device and IP information.

A biometric template is an identifier technically generated from a person's facial features, which can be used to recognise that same person's previous identity verifications. Although the template does not contain the original selfie image, identity document image or video, it is still biometric personal data.

KYC data may be used to:

• verify identity
• prevent fraud
• prevent misuse
• detect multiple customer accounts or accounts created repeatedly
• identify matches relating to previous identity verifications
• assess risks relating to payments and misuse of services
• maintain the security of FinlandHosting's services and infrastructure.

A technical match relating to a previous verification or the same person does not, by itself, mean that the customer has committed fraud or misuse. Such a match acts as a risk signal that may lead to a more detailed assessment of the case where necessary.

FinlandHosting processes personal data for the following purposes and on the following legal bases:

• Creating a customer account, ordering a service and delivering the service: entering into and performing a contract.
• Billing and payment processing: performing a contract and fulfilling legal obligations.
• Accounting: a legal obligation.
• Customer service and support requests: performing a contract and FinlandHosting's legitimate interests.
• Logging, technical monitoring and security: FinlandHosting's legitimate interests.
• Preventing fraud, misuse and repeatedly created customer accounts: FinlandHosting's legitimate interests.
• Risk-based identity verification: FinlandHosting's legitimate interests.
• Processing biometric data to uniquely identify a person and recognise previous identity verifications by that same person: the customer's explicit consent.

For processing based on FinlandHosting's legitimate interests, the necessity of the processing and the balance between FinlandHosting's and the data subject's rights and interests are assessed.

Biometric facial comparison

The processing of biometric data to uniquely identify a person and recognise previous identity verifications by that same person is based on the customer's explicit consent.

Consent covers biometric facial comparison during identity verification, as well as the use of the biometric template created for FinlandHosting to detect fraud, misuse and multiple customer accounts for the retention period specified in this privacy policy.

Giving consent to biometric processing is voluntary, and consent can be withdrawn at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If consent is withdrawn and there is no other legal basis under applicable data protection legislation for retaining the biometric template, the biometric template is deleted.

If a customer does not wish to use biometric facial comparison, FinlandHosting may, where necessary, offer an alternative way to verify their identity.

Reliable identity verification itself may, however, be a prerequisite for activating a service or continuing its use, for example because of a risk of fraud, misuse or a security risk.

Basic information requested when ordering a service, such as a name, contact details and necessary billing information, is generally necessary to enter into a contract and deliver the service.

In certain situations involving fraud, misuse, security or other risks, FinlandHosting may require customers to verify their identity before a service is activated or its use is continued.

If the necessary information is not provided or identity cannot otherwise be reliably verified, FinlandHosting may be unable to activate or continue the service in question.

Participation in biometric processing is not, in itself, mandatory where another reliable identity verification method can reasonably be offered to the customer.

Personal data is retained only for as long as its processing is necessary or required by law.

General data

• Customer data: for the duration of the customer relationship and, where necessary, afterwards for legal claims, contractual obligations or other justified reasons.
• Accounting-related data: for the period required by legislation.
• Log data: usually 6–12 months, unless a longer retention period is necessary, for example to investigate a security incident or misuse.

KYC identity verification data

The actual KYC identity verification data held in Didit's service, such as identity document images, selfie images, liveness material, information extracted from documents and other material belonging to the verification session, is generally retained for up to one (1) month from verification.

FinlandHosting also uses Didit's option to retain a biometric facial identifier, or biometric template, separate from the image after the actual verification session has been deleted.

The biometric template does not contain the original identity document image, selfie image or liveness video.

The biometric template is used only within FinlandHosting's own Didit environment to detect and investigate previous identity verifications by the same person, repeated registrations, multiple customer accounts, fraud and misuse.

The biometric template is retained for up to 180 days from verification.

The biometric template is then deleted automatically, or earlier if:

• the purpose of retaining it ends
• applicable legislation requires earlier deletion
• the data subject's erasure request must be fulfilled by law
• FinlandHosting or Didit explicitly deletes it.

The result and date of an approved or rejected verification, the provider's transaction identifier and other necessary administrative verification data may be retained for up to 3 years after the end of the customer relationship if retention is necessary, for example to investigate misuse, fraud, payment disputes or legal claims.

This longer retention period does not mean that identity document images, selfie images, liveness material or the biometric template are retained for that period.

Data may be retained for longer only where required by law, the investigation of a legal claim or another applicable legal basis.

Personal data may be processed by FinlandHosting's service providers to deliver the services.

These may include, for example:

• Didit Identity Spain, S.L. – identity verification
• payment service providers
• accounting services
• server and data centre service providers
• email and other IT service providers.

Didit Identity Spain, S.L. primarily acts as a data processor for the KYC identity verification used by FinlandHosting and processes verification data in accordance with FinlandHosting's instructions.

Didit may also process certain data for its own legal, security, fraud prevention or other purposes described in its privacy policies, to the extent permitted by applicable legislation and the agreement between FinlandHosting and Didit.

FinlandHosting has disabled the Didit settings that would allow FinlandHosting's verification data to be used to develop or train Didit's models.

The KYC data used by FinlandHosting is processed for identity verification, fraud and misuse prevention, and security purposes in accordance with this privacy policy.

According to Didit, data in the identity verification service used by FinlandHosting is processed and stored within the European Union by default.

If personal data is transferred outside the European Economic Area, the transfer uses a transfer basis and appropriate safeguards in accordance with applicable data protection legislation, such as standard contractual clauses approved by the European Commission where required.

Personal data is not sold to third parties.

Data may be disclosed to authorities if required by law.

Further information about Didit's processing of personal data is available in Didit's own privacy policy and the privacy notice for its identity verification service.

Personal data is protected through appropriate technical and organisational measures.

These may include, for example:

• encrypted connections
• restrictions on access rights
• identification of users and administrators
• firewalls
• logging
• monitoring
• securing servers and systems
• backups
• limiting access rights to people who need the data to carry out their duties.

Technical and organisational security measures provided by Didit are also used when processing KYC data.

Under applicable data protection legislation, data subjects have the right to:

• receive information about the processing of their personal data
• access their personal data
• request correction of inaccurate or incomplete data
• request erasure of personal data
• request restriction of the processing of personal data
• object to the processing of personal data where processing is based on FinlandHosting's legitimate interests
• transfer data from one system to another where applicable
• withdraw their consent at any time
• lodge a complaint with the competent data protection authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

The right to erasure is not absolute. Data may need to be retained, for example where FinlandHosting has a legal obligation to retain it or where retention is necessary to establish, exercise or defend a legal claim.

Data requests can be sent to:

[email protected]

For requests relating to KYC identity verification, FinlandHosting acts as the data controller and is responsible for handling the request to the extent that it concerns personal data processing for which FinlandHosting is responsible.

KYC identity verification may use automated checks, for example to:

• assess the authenticity of an identity document
• perform a liveness check
• compare faces
• identify previous identity verifications
• detect multiple identity verifications by the same person
• assess other risks of fraud and misuse.

A risk signal generated during an automated check, such as a possible facial match relating to a previous verification, a document anomaly or a failed liveness check, does not necessarily lead to denial of a service on its own.

The case may be assessed manually where necessary.

If a decision concerning a person is based solely on automated processing of personal data and produces legal effects or similarly significant effects within the meaning of the GDPR, the data subject has the right, under applicable legislation, to:

• require human intervention in the handling of the matter
• express their point of view
• contest the decision.

If a personal data breach occurs, FinlandHosting assesses the situation and acts as required by the GDPR and other applicable data protection legislation.

Where necessary, the personal data breach is reported to the competent data protection authority and the individuals affected by the breach.

Data subjects have the right to lodge a complaint with the competent data protection authority.

In Finland, the data protection supervisory authority is:

Office of the Data Protection Ombudsman PO Box 800 00531 Helsinki Finland

https://tietosuoja.fi

FinlandHosting may update this privacy policy when its services, personal data processing, service providers, technical systems or legislation change.

The current version is published on FinlandHosting's website.