Privacy Policy

Effective: version 2

This Privacy Policy describes how Talvea Oy (Business ID 2639415-9) processes personal data in the Digitaalinen Yrityskauppa (DIYK) service at undefined. The Service is a B2B business acquisition platform.

1. Data controller

Talvea Oy
Pakkahuoneenkatu 12 B 19
90100 Oulu, Suomi
Email: diyk-admin@diyk.fi

2. Privacy contact

-
Email: diyk-admin@diyk.fi

3. Personal data processed

Account: name, email, optional phone, avatar, locale, roles, strong-auth identifiers (FTN), terms acceptance timestamps and versions.

Deal/marketplace data: buyer/seller profiles, interest messages, deal invitations, participant details, contract/document metadata, billing details (company name, business ID, address), payment records (Stripe IDs, amounts).

Support: ticket subject/description, consent timestamp, optional browser metadata, IP in support events.

Technical: session tokens, cookies, security/audit logs, rate-limit counters.

Public chat (Apuri): messages are not stored server-side; PII filtering blocks sensitive submissions.

Contact form: name, email, message — emailed to operations, not stored in database.

4. Purposes and legal bases

Processing is based on contract performance (Art. 6(1)(b)), legal obligation (6(1)(c)), legitimate interests such as security (6(1)(f)), and consent for marketing/analytics cookies (6(1)(a)).

5. Retention

Account data: active period plus up to 24 months after deactivation unless law requires longer. Deal data: duration of deal plus up to 10 years for legal claims. Invoices: minimum 6 years per accounting law. Support tickets: 24 months. Security logs: 12 months. Sessions/magic links: up to 30 days / single use.

6. Processors and transfers

Stripe (payments), Resend (email), AWS S3 (files, EU), Signicat (strong auth), Google Gemini (AI), Supabase/PostgreSQL (database). We do not sell personal data.

7. Your rights

Access, rectification, erasure (subject to legal retention), restriction, portability, objection, consent withdrawal, and complaint to the Finnish DPA (tietosuoja.fi).

8. Exercising rights

1. Email diyk-admin@diyk.fi with subject "Privacy request"
2. While logged in: Settings → Privacy section or Support → "Legal / compliance"

We respond within 30 days. Identity verification may be required. Erasure requests follow account deactivation and retention schedules.

9. Cookies

Essential cookies always active; analytics/marketing only with banner consent.

10. Security

Encryption (AES-256-GCM for sensitive data in production), access control, audit logging, rate limits, private S3 storage.

11. Changes

We update this policy as needed and notify users of material changes via the Service or email.