Privacy policy
This policy explains how personal data is processed in connection with the Live Reporting System (“LRS”, “the Service”), this website, and enquiries you send us. We are committed to processing personal data lawfully, fairly and transparently in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law.
1. Who is responsible for your data
The data controller for this website and for enquiries made through it is Altus Investor Oy, business ID 1959041-8, Suezinkatu 8 C 45, 00220 Helsinki, Finland, email harri.kilpinen@altusinvestor.com, telephone +358 44 507 3179. Data-protection queries can be sent to that address.
When LRS is used to produce reports for a client organisation, that client organisation is the controller of the personal data contained in, or used to operate, its reporting environment (including the accounts of its employees who use the Service). In that context we act as a processor on the client’s behalf, under a written data processing agreement, and process such data only on the client’s documented instructions.
2. The personal data we process
- Enquiries & contact: the name, work email, company (if given) and message content you submit through our contact form or by emailing us.
- Service user accounts: for people who work at our client organisations and use LRS, we process a username, name and email address, and authentication data needed to secure the account (including two-factor login codes). These are business contact details of professional users — not consumers or end customers.
- Technical data: server logs may record IP address, browser type and timestamps for security, troubleshooting and abuse prevention.
We do not intentionally collect special categories of data, and we do not use the Service for advertising or profiling.
3. Why we process it, and our legal basis
- To respond to your enquiry — legal basis: your consent (given when you submit the form) and our legitimate interest in answering prospective and existing clients.
- To provide and secure the Service to our clients and their users — legal basis: performance of a contract with the client, and our and the client’s legitimate interests in a secure service. Where we act as processor, the client’s instructions and agreement govern this processing.
- To meet legal obligations and to establish, exercise or defend legal claims — legal basis: legal obligation and legitimate interest.
4. Cookies
This website uses only strictly necessary cookies; the application uses an essential session cookie to keep you logged in and to protect forms against cross-site request forgery. We do not use analytics, advertising or third-party tracking cookies. See our cookie policy for details.
5. Who we share data with
We share personal data only with service providers who process it on our behalf under appropriate contractual safeguards, and with authorities where legally required. Our key processors are:
- Cloud hosting — Amazon Web Services (data hosted in the EU, Stockholm region).
- Email delivery — Amazon Simple Email Service, used to send login codes and to deliver your enquiry to us.
We do not sell personal data.
6. International transfers
We aim to keep personal data within the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
7. How long we keep it
- Enquiry correspondence: kept only as long as needed to handle your request and for a reasonable follow-up period. We review retained enquiries periodically and delete those no longer needed.
- Service account data: kept for the duration of the client relationship and deleted or returned in line with the client agreement afterwards.
- Security logs: kept for a limited period appropriate to their purpose.
8. Your rights
Subject to the conditions in the GDPR, you have the right to: access your personal data; have inaccurate data rectified; have data erased; restrict or object to processing; data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting prior processing. To exercise any of these rights, contact us at harri.kilpinen@altusinvestor.com. If you are a user at one of our client organisations, please also contact that organisation, as it is the controller of your account data.
9. Complaints
If you believe your data has been handled unlawfully, you have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi. You may also contact the authority in your country of residence or work.
10. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, two-factor authentication for accounts and monitored, cloud-hosted infrastructure.
11. Changes to this policy
We may update this policy from time to time. Material changes will be reflected here with a new “last updated” date.
12. Contact
Questions about this policy or your data? Email harri.kilpinen@altusinvestor.com.