Privacy policy

Updated 28 August 2026

This policy describes what personal data Selecto Oy processes on the selecto.fi website and in its services, what the data is used for, who it is disclosed to and what rights you have. It follows articles 13 and 14 of the EU General Data Protection Regulation (2016/679).

1. Controller and contact details

The controller of personal data is Selecto Oy. Questions and requests about this policy or about your own data are handled by email.

Controller: Selecto Oy
Business ID: 3358486-6
VAT number: FI33584866
Register: Finnish Trade Register, Finnish Patent and Registration Office
Registered address: Ilokkaanrinne 2 A 1, Tampere, Finland
Email: [email protected]
Phone: +358 44 230 6321

Ilokkaanrinne 2 A 1 is the company's registered address, not a visiting address. Selecto Oy has not appointed a data protection officer, because the conditions in article 37 of the GDPR are not met.

2. What personal data we process

Data you provide on the contact form

name
email address
phone number, optional
company name, optional
topic, meaning the service you are interested in
the text you write in the message field

Name and email address are required, because without them there is no way to reply. Please do not write sensitive data such as health information or a personal identity code in the message field: the form is meant for getting in touch and is not designed for processing sensitive data.

Data generated automatically

IP address, timestamp, the address requested and the browser identifier, in the server logs
page views, referring address, device type, browser and approximate location at country level

Google account data

If you sign in to a Selecto service with a Google account, we process the name, email address and profile picture from that account. Details in section 6.

3. Purposes and legal bases for processing

Replying to your message and preparing a quote. Steps taken prior to entering into a contract, and legitimate interest (article 6(1)(b) and (f) GDPR).
Managing the customer relationship and delivering the service. Performance of a contract (article 6(1)(b)).
Sign-in and user identification in Selecto services. Performance of a contract, and the consent you give when you choose Google sign-in (article 6(1)(b) and (a)).
Site security and troubleshooting. Legitimate interest (article 6(1)(f)).
Measuring and improving the site. Legitimate interest (article 6(1)(f)).
Complying with legal obligations. For example keeping accounting records as required by the Finnish Accounting Act (article 6(1)(c)).

Personal data is not sold, rented or traded. The site performs no automated decision making with legal effects concerning you.

4. Cookies and consent

The site stores data on your device in two cases.

Strictly necessary data

The language you picked and your cookie choice are stored in your browser so the site does not have to ask again. Both are strictly necessary to provide the functions you asked for, so they do not require consent (section 205 of the Finnish Act on Electronic Communications Services 917/2014).

Cookies that require consent

Cookies used for visitor measurement are set only if you consent to them. A cookie notice appears on your first visit where you can accept or reject them. Rejecting is as easy as accepting and does not prevent you from using the site. No script that requires consent is loaded before you have made a choice.

You can change your choice at any time. Open cookie settings, or clear the site data in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

The consent covers visitor measurement.

Fonts are served from the site's own server, so opening a page does not in itself make requests to third party servers.

5. Visitor measurement

We use PostHog (EU region) for visitor measurement. If you accept cookies, measurement uses a cookie and the same visitor is recognised between visits. Otherwise measurement runs cookieless and nothing is stored in your browser.

No individual visitor is identified by name. You can object to processing based on legitimate interest and withdraw consent, see sections 4 and 13.

In some Selecto services you can sign in with a Google account. If you choose that, Selecto receives your name, email address and profile picture, where one exists, from your Google account. We request only these and nothing else.

The data is used solely for authentication and identifying the user.
Data received from a Google account is not used for advertising or ad targeting.
The data is not sold and is not disclosed to third parties.
The data is not used to train language models.
You can revoke Selecto's access to your Google account at any time in your Google account settings at myaccount.google.com/permissions.
When a user account is deleted or access is revoked, the data received from the Google account is deleted from Selecto's systems.

Selecto complies with the Google API Services User Data Policy, including its Limited Use requirements.

7. Server logs

Selecto.fi is a static site running on Selecto's own Easyhost platform. The server logs record ordinary technical data every time a browser requests a page: IP address, timestamp, the address requested and the browser identifier. Log data is used for security and troubleshooting, not for tracking visitors or for advertising.

8. Spam check on the form

The contact form uses Cloudflare Turnstile to tell a person from an automated script. Turnstile processes your IP address and technical signals from your browser for that check. It sets no advertising cookies and does not use the data for targeting. The legal basis is legitimate interest (article 6(1)(f)): the form has to be protected against automated abuse. Cloudflare acts as a processor of personal data on Selecto's behalf.

9. Recipients of the data

The following service providers process data on Selecto's behalf. They act as processors and may not use the data for their own purposes:

SMTP2GO delivers the message you send on the form to Selecto's email.
Easyhost, Selecto's own server platform, which runs the site.
PostHog produces the visitor measurement in its EU cloud.
Cloudflare checks form submissions.
Google provides Google sign-in, if you use it.

Data is disclosed to other third parties only where the law requires it or where an authority demands it on a statutory basis.

10. Transfers outside the EU and the EEA

The contact form data and the visitor measurement data is processed within the EU and the EEA. For Google sign-in, data is also processed in the United States.

Transfers outside the EU and the EEA are based on the standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework, which the companies concerned have joined. You can request further information about the mechanisms used by email.

11. Retention periods

Contact messages. For as long as the customer relationship or its preparation requires. If no customer relationship follows, the message is deleted within 24 months at the latest.
Server logs. 12 months at most.
Visitor measurement data. Events are kept in the PostHog EU cloud for at most 84 months. They do not accumulate into a profile: the identifier changes daily, so events from different days cannot be linked to the same visitor.
Google sign-in data. For as long as the user account exists.
Your cookie choice. 12 months, after which consent is asked again.
Accounting records. For the period required by the Finnish Accounting Act.

12. How the data is protected

The site runs over an encrypted HTTPS connection. The form's recipient address is set in a server environment variable, so it cannot be redirected elsewhere through the form. Access to the email, the server environment and the measurement tools is limited to those people at Selecto who need it for their work, and is protected with personal credentials and multi-factor authentication.

13. Your rights

Requests are handled by email at [email protected]. Making a request is free of charge and we reply within one month.

Right of access. You can find out what data we hold about you and get a copy of it.
Rectification. Incorrect or incomplete data is corrected at your request.
Erasure. You can ask us to delete your data once there is no longer a basis for keeping it.
Restriction of processing. You can ask us to store your data without processing it further while a matter is being resolved.
Right to object. You can object to processing based on legitimate interest on grounds relating to your situation.
Data portability. You can get the data you provided in a machine readable format and transfer it elsewhere.
Withdrawal of consent. You can stop consent-based processing at any time, see section 4.
Right to lodge a complaint. You can complain to the supervisory authority, see the end of this section.

We may ask for further details to verify your identity, so that data is not handed to the wrong person. If you believe your data is processed in breach of the GDPR, you can lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, Finland, tietosuoja.fi/en.

14. AI services and customer data

This section concerns the agent and automation projects Selecto delivers. The agents Selecto builds run on Selecto's own servers or in the customer's own environment. Customer data is not used to train language models. When Selecto processes personal data on a customer's behalf, a separate data processing agreement is made (article 28 GDPR), naming the sub-processors used, such as the language model providers.

15. Changes to this policy

This policy is updated when the site or the processing of data changes. The date at the top of the page shows when it was last updated. If a change requires your consent, it will be requested separately before the change takes effect.