Privacy Policy

Regenia Matrix Oy Ltd · EU General Data Protection Regulation 2016/679 · Version 1.1 · 8 October 2026

As a Finnish company, Regenia Matrix Oy has originally drafted this privacy policy in Finnish. Any other language version is a translation. In the event of any conflict or inconsistency between the Finnish original and a translation, the Finnish original version is legally binding and shall prevail.

1. Controller

• Name: Regenia Matrix Oy Ltd
• Business ID: 3622671-4
• Address: c/o Kirurgikonsultointi Kallio Oy, Kalevankatu 9 A 74, 60100 Seinäjoki, Finland
• Domicile: Seinäjoki, Finland
• Email: helpdesk@regeniamatrix.com

2. Contact person for matters concerning the register

• Ali Laitasaari
• Email: ali.laitasaari@regeniamatrix.com
• Mobile: +358 50 3000 533

All requests concerning the rights described in section 11 should be addressed to this contact person in writing.

3. Name of the register

Customer and stakeholder register of Regenia Matrix Oy, together with the visitor and enquiry data of the website regeniamatrix.com.

4. Purpose and legal basis of processing

Personal data is processed for the following purposes, each on its own legal basis:

• Responding to enquiries and preparing offers. Legal basis: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b)), and the legitimate interest of the controller in business communication (Article 6(1)(f)).
• Maintaining customer relationships, delivering services and invoicing. Legal basis: performance of a contract (Article 6(1)(b)) and compliance with a legal obligation such as the Accounting Act (Article 6(1)(c)).
• Measuring the use of the website with analytics. Legal basis: the consent of the data subject (Article 6(1)(a)), given through the cookie banner and withdrawable at any time.
• Securing the website and its technical operation, including the prevention of abuse. Legal basis: the legitimate interest of the controller in protecting its systems (Article 6(1)(f)).

Submitting the contact form does not require consent to cookies, and the form works normally even when all optional cookies are declined.

5. Personal data processed

The following data may be processed:

• Data given by the data subject: first name and surname, email address, telephone number, postal address, the organisation represented, the person's position, and the content of the message sent.
• Data related to the customer relationship: ordering of services, correspondence, and invoicing data.
• Technical data collected automatically by the server: IP address, time of the request, the page requested, the referring page, and browser and device information.
• Cookie consent data: the choice made in the cookie banner, the time it was given, and a consent identifier.
• Analytics data: pseudonymised information about the use of the website, such as pages visited, approximate region, device type and the source of the visit. This data is not combined with a named person and cannot be used to identify an individual visitor.

No special categories of personal data as defined in Article 9 of the GDPR are collected, and the website is not directed at children.

6. Sources of data

Personal data is collected as a rule from the data subjects themselves through the contact form, by email, by telephone or in the course of other communication. Technical data is generated automatically when the website is used. Data may in addition be collected from public registers, such as the Finnish Trade Register or company websites.

7. Cookies

Cookies are small text files stored on the visitor's device. The website uses cookies that are strictly necessary for its technical operation, and — only with the visitor's consent — analytics cookies.

Consent is requested through a cookie banner the first time the site is visited. Analytics and any other optional cookies are not set before consent is given. Consent can be changed or withdrawn at any time from the cookie settings link in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

A detailed, automatically updated list of the cookies in use — including their purpose and lifetime — is available in the cookie settings of the website.

8. Retention periods

Personal data is retained only for as long as is necessary for the purposes described above, or for as long as legislation requires:

Backups are used solely for restoring the system in the event of a malfunction. They are not used for any other purpose, and data erased from the active systems disappears from the backups as they are overwritten.

9. Processors, disclosures and transfers outside the EU and EEA

Personal data is not sold, and it is not disclosed to third parties for their own purposes. Data is processed on the controller's behalf by the following service providers, each of which is bound by a data processing agreement under Article 28 of the GDPR:

• Hosting provider — servers, databases and email. Servers located in Finland.
• Technical maintenance and development of the website — a service provider established in Finland.
• Analytics service (Google) — measurement of website use. Data may be transferred outside the EU and EEA; the transfer is based on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
• Cookie consent management service — recording and storing consents.
• Website security service — protecting the site against abuse. Data may be transferred outside the EU and EEA on the basis described above.
• Accounting firm — processing of invoicing data in connection with a customer relationship.

Data may in addition be disclosed where legislation or a request from an authority so requires.

10. Principles of protecting the register

The company does not maintain manual registers. Data processed electronically is protected by technical measures in line with industry standards: encrypted connections, personal user accounts, strong passwords and firewalls. Access rights are granted only to those persons whose duties require the processing of personal data, and they are reviewed when duties change.

Everyone processing personal data is bound by a duty of confidentiality. Where data is processed by a person through a subcontracting or other contractual relationship with another company, that contract secures confidentiality and secrecy on terms comparable to the employment relationships of the company's own personnel.

11. Rights of the data subject

Under the General Data Protection Regulation, the data subject has the right to:

• Obtain confirmation as to whether their personal data is being processed, and to receive a copy of that data (right of access).
• Require the rectification of inaccurate or incomplete data.
• Require the erasure of their personal data (the "right to be forgotten"), subject to the exceptions described in section 12.
• Require the restriction of processing, or to object to processing carried out on the basis of a legitimate interest.
• Receive the data they have provided in a machine-readable format and to have it transmitted to another controller (right to data portability).
• Withdraw a consent given at any time, for example consent to analytics cookies.

A request should be made in writing to the contact person named in section 2. The identity of the person making the request will be verified before the request is processed. A response is given within one month of receiving the request; where a request is complex, the period may be extended by two months, in which case the data subject will be informed. Processing a request is free of charge.

Analytics data cannot be connected to a named person, and the controller is therefore unable to identify an individual visitor from it. Such data cannot be delivered in response to a request for access, nor erased individually. A visitor can prevent the collection of analytics data entirely by declining analytics cookies.

If a data subject considers that their personal data has been processed unlawfully, they have the right to lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

12. Exceptions to the right of erasure

Where an enquiry leads to a customer relationship, invoicing and accounting records must be retained for the period required by the Finnish Accounting Act (1336/1997), which is a minimum of six years from the end of the financial year in which the financial period ended. Such records cannot be deleted on the basis of an erasure request, and the request will be refused to that extent, with reasons given.

Data not subject to a statutory retention obligation is erased upon request. Data is erased from the active systems without undue delay; it is removed from backups as those backups are overwritten in the normal rotation described in section 8.

13. Changes to this policy

This privacy policy is updated as the operations of the company or the technical implementation of the website change. The version number and date of the current policy are shown at the beginning of this page. Where changes are material, data subjects will be informed on the website.