Privacy Policy
Tietokettu stores and processes personal data in accordance with the EU GDPR and the current General Data Protection Regulation (2018/1050). This privacy policy has been drafted in accordance with Section 4 of the Personal Data Act.
Updated 30.9.2026
1) Registrar
Tietokettu (HD-decor oy)
Business ID: 0706238-6
Rantaharju 15
37500 Lempäälä
2) Register contact person
Registrar / Data Protection Officer:
Kimi Syrjä
kimi.syrja@tietokettu.net
+358 44 204 2526
3. Purpose of personal data processing
We use personal data for billing, administration and internal marketing. Internal marketing includes our newsletter, if you have subscribed to it.
We verify the identity of all our customers before a service or domain is activated. The data processed in verification includes the image and details of the identity document (name, date of birth, document number and expiry date), a selfie image and liveness check, the face comparison made from them (biometric data), the verification result (approved / rejected / under review), and device and IP data. [In addition, the name may be checked against international sanctions and PEP lists.] The data is processed to verify the customer's identity, to prevent payment fraud and abuse, and to ensure data security.
4. Legal basis for the processing of personal data
Billing and service delivery are based on contract and on statutory accounting obligations. Sending the newsletter is based on consent, which you can withdraw at any time.
eKYC: The processing of identity document data, device and IP data, and the verification result is based on the controller's legitimate interest (fraud and abuse prevention and data security). The biometric face comparison is based on the customer's explicit consent, which the customer gives before verification begins. Consent can be withdrawn, but in that case the service cannot be opened or provided. [If you do not wish to consent to the face comparison, you can request an alternative way to verify your identity through a manual document check.]
5. Data content of the register
Data stored in the register:
- Name
- Personal identity number (required for domain registration by individuals and dedicated server purchases)
- Email address
- Company name (if applicable)
- Address
- Phone number
- IP address history, operator and login history
- Place of residence, province and postal code
- Information collected through browser cookies
- Tax number (if applicable)
- Registration date
- eKYC verification data (see section 3)
A personal identity number is needed for registering certain domain names for private individuals [and for purchasing dedicated servers].
Billing-related data, such as name, email address, company name, address, phone number, residence information, tax number and purchase history, is retained for 10 years for accounting reasons. For this reason, this data cannot be deleted even if the customer requests it.
An inactive customer account, which has not been logged into and has had no purchases for 5 years, is deleted automatically together with the data listed above.
eKYC data retention
- Document images stored on our servers are deleted automatically 90 days after submission.
- The result and time of an approved verification (without document images) are retained for 3 years after the end of the customer relationship, to investigate misuse and payment disputes.
- Rejected verification records are deleted 12 months after the rejection.
- Didit retains data in its own service for 90 days, after which it is deleted.
6. Regular data sources
Information provided by the customer at registration or purchase. In addition, data about the customer is collected automatically when the customer uses our website.
7. Regular transfers of information
We do not disclose data to outside parties without the customer's consent, except to the processors and recipients listed below or where required by law.
Data processors and recipients:
- Didit Identity Spain, S.L. (Barcelona, Spain) acts as a data processor for eKYC verification and processes the data described in section 3 on our behalf. Didit may also use anonymised or pseudonymised data as an independent controller for fraud prevention and security. Processing takes place mainly within the EU/EEA, and any transfers outside the EU/EEA are based on the European Commission's standard contractual clauses. Didit's sub-processors: https://didit.me/terms/sub-processors
- Finnish Transport and Communications Agency Traficom: for .FI domain registration or transfer, we pass data to the agency.
Data is disclosed outside the EU or EEA in the following situations:
- PayPal Holdings, Inc
Purpose of disclosure: payment processing
Data disclosed: first name, last name, email address, payment card details, account number, account holder, necessary browser cookies and IP address
Privacy information: https://www.paypal.com/webapps/mpp/ua/legalhub-full
In other cases, data is not disclosed outside the EU or EEA.
8. Principles of personal data protection
Documents are kept in a locked space to which access is restricted to employees with the highest authorisation to handle the material. Documents are destroyed by shredding and then burning. Data stored on hard drives or other storage devices is destroyed by wiping the drive and then physically destroying the device.
Access to electronic data is restricted to employees who are entitled to it. The controller ensures data security and that the data is not accessible to parties who are not entitled to it. Data is stored on hardware accessible only to those employees who have the right to maintain it. The servers are protected by a firewall, and the hardware cannot be accessed because it is in a locked space with camera surveillance. The servers are located in Lempäälä, where our equipment operates.
Electronically stored eKYC documents are kept in a storage location outside the web-accessible directory [and are encrypted on details]. Access to the data is limited to employees whose duties require it.
9. Rights of the registrant
Right of access (inspection right)
The data subject has the right to check what information about them is stored in the data controller's systems. The right of inspection may be denied on the grounds provided for by law.
Right to demand rectification of data
The data subject has the right to demand that the data controller rectify inaccurate and erroneous personal data concerning them without undue delay. Taking into account the purposes for which the data was processed, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement.
Right to demand erasure of data and the right to withdraw consent given
The data subject has the right to obtain from the controller the erasure of personal data concerning them under certain conditions, such as when the basis for processing the personal data no longer exists or the data subject withdraws their consent to the processing of their personal data. If there is no other legal basis for the processing than consent, the controller must then delete the data subject's personal data.
The right to erasure of data does not apply in certain exceptions provided for by law, for example, when the data is processed for the performance of a legal task.
Data erasure is done by creating a support request on our website (https://tietokettu.net) in which you request the data to be deleted. If this proves difficult, you can ask the data controller for help.
Right to restrict processing
The data subject has the right to demand that the data controller restrict the processing of their personal data, for example, when the data subject is waiting for the data controller's response to a request to rectify or delete their data.
Right to data portability
To the extent that the data subject has personally provided data to the customer register, which is processed on the basis of the data subject's consent or contract, the data subject has the right to receive such data in a structured, commonly used and machine-readable format and to transmit such data to another controller.
Right to object to processing
The data subject has the right to object to the processing of their data on certain grounds, such as profiling and direct marketing.
Right to lodge a complaint with the supervisory authority
The data subject has the right to lodge a complaint with the competent supervisory authority if the data controller has not complied with the applicable data protection regulations in its activities.
The contact person for matters relating to the data subject's rights is the data protection officer, contact details in section 2 of the statement.
Withdrawal of consent
You can withdraw the consent you have given, including consent to the biometric face comparison, by contacting the Data Protection Officer. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, but it may prevent the service from being opened.
Automated decision-making
Limitation on erasure
The result of an eKYC verification may not be erasable immediately if it is needed to investigate misuse.
Contact for data subject rights
