Tietosuojaseloste

Effective from 13 September 2026

1. Data Controller

The data controller responsible for the HinausSuomi service is:

KV Collective Oy
Business ID: 3642698-6
Email: [email protected]
Website: https://hinaussuomi.fi

Requests and questions concerning privacy and the processing of personal data may be sent to the email address stated above.

2. Who Does This Privacy Policy Apply To?

This Privacy Policy applies to the following groups:

visitors to the HinausSuomi website
contact persons of towing and roadside assistance companies
persons submitting an application to join the service
persons verifying ownership of an existing business listing
users of the company dashboard
representatives of customers and business partners
other persons who contact HinausSuomi.

Using the service to find a towing or roadside assistance company does not require the creation of a user account or registration.

3. What Personal Data Do We Collect?

3.1 All Website Visitors

When you visit the HinausSuomi website, we may automatically collect the following information:

pages visited
date and time of the visit
device type, such as a mobile phone, tablet or computer
a hashed identifier generated from the IP address
technical information about the browser and device, such as the user agent
information about the website or page from which the user arrived at HinausSuomi, known as referrer data
logs relating to website use, security and technical operation.

The raw IP address is not intended to be retained for visitor tracking. Instead, a hashed identifier is generated from it. However, the hashed identifier may still constitute personal data if it makes it possible to distinguish the same device or user from other users.

If you consent to analytics cookies, we also use Google Analytics to understand website traffic and use. Non-essential cookies and similar tracking technologies are used only with your consent.

3.2 Clicking a Telephone Number

If you click the telephone number of a listed location, we record the click event. The following information may be associated with the event:

the location or telephone number clicked
date and time of the click
page on which the click occurred
device type
a hashed identifier generated from the IP address
technical browser information
referrer data.

Click data is used to measure the operation of the service, prevent misuse and provide reporting and billing between HinausSuomi and the companies participating in the service.

Essential tracking of telephone number clicks does not depend on cookie consent and does not use non-essential cookies. The processing is based on the legitimate interests of KV Collective Oy and the companies participating in the service, as well as the performance of agreements concluded with those companies.

HinausSuomi does not record the content of telephone calls. When you call a telephone number displayed on the website, the call takes place directly between you and the relevant towing or roadside assistance company.

3.3 Use of Location Data

HinausSuomi may request access to the location of the user’s device to display nearby towing and roadside assistance companies.

Location data is used only if the user separately grants permission through their browser or device. The user may prevent the use of location data or withdraw the permission through their browser or device settings.

Location data is used to identify nearby business locations. As a rule, location data is not stored permanently in HinausSuomi’s records. Preventing the use of location data may affect the automatic display of nearby service providers.

3.4 Persons Submitting an Application to Join the Service

When you submit an application for a company to join the service, we may collect:

company name and Business ID
name of the contact person
telephone number and email address of the contact person
company address
description of the company’s service area
freely written company story
message attached to the application
company logo
optional gallery images
other information voluntarily provided in the application.

Using the Business ID, we may also obtain the following public company information from the Trade Register maintained by the Finnish Patent and Registration Office:

official company name
legal form
line of business
registered address
registration for value added tax
registration in the Prepayment Register
registration in the Employer Register
other public register information necessary to verify the company’s status and operations.

If the business is operated by a private trader or sole proprietor, its official name may contain the name of a natural person. In such cases, the name obtained from the public Trade Register also constitutes personal data.

3.5 Verification of Ownership of a Business Listing

When you verify ownership of an existing business listing, we may collect the same contact, company and register information as when an application to join the service is submitted.

The information is used to verify the person’s authority to act on behalf of the company and the connection between the company and the listed location. We may request other reasonable additional information if ownership or the right of representation cannot otherwise be reliably verified.

3.6 Company Dashboard Users

When an account is created for the HinausSuomi company dashboard, we may store:

user’s name
email address
connection between the user account and the company
access rights
password hash
login dates and login history
technical logs relating to account security
information concerning the activation of optional two-factor authentication
changes made through the company dashboard.

Passwords are not stored in plain text. A securely generated password hash is stored instead.

3.7 Publicly Displayed Business Location Information

The following information about an approved business location may be displayed publicly:

company name
address
location on a map
telephone number
Business ID
opening hours
service area
company story and other descriptive content provided by the company
logo
gallery images provided by the company.

If the company is operated by a private trader or sole proprietor, the official company name displayed publicly may contain the name of a natural person.

The company must ensure that it has the right to provide HinausSuomi with the texts, images, logos and other materials submitted for publication. The company must also ensure that the material does not unnecessarily disclose the personal data of other individuals.

3.8 Agreements

An agreement created when a company joins the service may contain:

company name and contact details
Business ID
name and contact details of the person who concluded or accepted the agreement
information about the person’s position or authority to represent the company
content, acceptance date and validity of the agreement
information relating to the performance, billing and amendment of the agreement.

The agreement and related information are stored in the HinausSuomi system for managing the contractual relationship and fulfilling legal obligations.

3.9 Email Notifications

When we send invitations to the company dashboard, confirmations, notifications or other service-related emails, we may store:

recipient’s name and email address
content and type of the message
date and time of sending
information about whether delivery succeeded or failed
technical information related to the processing of the message.

The information is used for customer service, ensuring the delivery of messages and investigating errors and misuse.

4. For What Purposes Do We Process Personal Data?

Personal data is processed for the following purposes:

providing the website and its features
displaying nearby towing and roadside assistance companies
measuring telephone number clicks
contractual reporting and billing
processing applications to join the service
verifying company and business location information
managing company dashboard accounts and access rights
publishing and updating business location information
managing contractual and business relationships
customer communications and email notifications
responding to enquiries
statistical analysis and development of the service
maintaining the security of the website and user accounts
detecting and correcting technical errors
preventing misuse
complying with legal obligations
establishing, exercising and defending legal claims.

5. Legal Bases for Processing Personal Data

Depending on the circumstances, processing is based on one or more of the following legal bases:

Contract and Pre-contractual Measures

Processing is based on a contract or measures taken before entering into a contract, for example when:

a company submits an application to join the service
ownership of a business listing is verified
a user account is created for a company
the company’s business location information is published
telephone number clicks are processed for company billing
agreements, billing or business customer relationships are managed.

Legitimate Interests

Processing may be based on the legitimate interests of KV Collective Oy or a company participating in the service when processing is necessary for purposes such as:

ensuring the operation of the website
measuring and verifying telephone number clicks
verifying the accuracy of company information
managing customer service and business relationships
maintaining information security
preventing errors and misuse
protecting legal interests.

Consent

Consent is used as the legal basis for processing, for example:

when using Google Analytics and other optional analytics technologies
when using non-essential cookies
when using the precise location of the user’s device
when another voluntary processing activity requires consent.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

Legal Obligation

Personal data may be processed to comply with accounting obligations, requests from public authorities and other legal obligations.

6. Where Do We Obtain Personal Data?

Personal data is obtained from:

the data subject
the company represented by the data subject
application and verification forms
use of the company dashboard
enquiries submitted by email or other means
the user’s browser and device
the website’s technical systems
the public Trade Register maintained by the Finnish Patent and Registration Office
company websites and other public sources of company information
analytics and error-monitoring services as described in this Privacy Policy.

7. Recipients of Personal Data and Service Providers

KV Collective Oy may use external service providers to process personal data. Data may be processed by or transferred to the following parties:

Finnish Patent and Registration Office

HinausSuomi may use a company’s Business ID to conduct a public Trade Register search through the Finnish Patent and Registration Office. Information obtained from the Finnish Patent and Registration Office is used to verify the company’s details and registrations.

Google Analytics

Google Analytics is used to analyse website use and traffic only if the user has consented to analytics cookies.

Google may process information such as pages visited, time of the visit, device type, browser, approximate location and how the user arrived at the website.

Sentry

Sentry is used to detect and investigate technical errors on the website. Technical information relating to an error may be sent to Sentry, including the type of error, time of the event, browser and device used, and the page on which the error occurred.

The contents of applications, agreements or other forms, passwords or other unnecessary personal data are not intentionally sent to Sentry.

Other Service Providers

Personal data may also be processed by service providers used by KV Collective Oy for:

website hosting and maintenance
email and communications
maps and location services
user authentication and access management
information security, backups and IT services
billing and accounting.

Service providers may process personal data only for the purpose of providing the agreed services and in accordance with the instructions of KV Collective Oy.

Personal data is not sold to third parties.

Data may also be disclosed to a public authority or another party if the disclosure is required by law, an official order or the protection of the legal interests of KV Collective Oy.

8. Reporting Click Data to Companies

A company participating in the service may receive billing and usage reports concerning its own business location. These reports may include:

number of clicks on the location’s telephone number
date and time of the clicks
billing period
events on which the billing is based.

As a rule, the company does not receive the website visitor’s name, email address, raw IP address or other unnecessary identifying information.

9. Transfers of Personal Data Outside the European Economic Area

Some of our technical service providers, such as Google or Sentry, may process data outside the European Union or the European Economic Area.

Transfers are carried out using the transfer mechanisms and safeguards required by applicable data protection legislation. These may include an adequacy decision adopted by the European Commission or the European Commission’s Standard Contractual Clauses.

10. Retention of Personal Data

Personal data is retained only for as long as necessary for its purpose, contractual obligations, billing, legal claims or compliance with legal obligations.

Retention periods are determined according to the following principles:

technical visitor and log data is retained only for as long as necessary for the operation, statistical analysis and security of the service
telephone number click data is retained for as long as necessary for reporting, billing, verifying invoices and resolving possible disputes
application data is retained while the application is processed and, for an approved application, for the duration of the customer relationship
rejected or discontinued application data is retained only for as long as necessary to process the application and any related follow-up questions
business location information is retained for as long as the location remains in the service or there is another justified reason for retaining it
company dashboard account data is retained for the duration of the relevant access rights and customer relationship and for a necessary period after they have ended
login and security logs are retained only for as long as necessary for information security and the investigation of misuse
agreements and billing data are retained for the duration of the contractual relationship and for the periods required by accounting, limitation and other applicable legislation
emails and delivery logs are retained for as long as necessary for customer service, management of the contractual relationship or investigation of errors
cookie retention periods depend on the cookie used and are stated, where possible, in the website’s cookie settings.

When there is no longer a lawful basis for retaining the data, it is deleted or anonymised.

11. Cookies and Analytics

HinausSuomi uses cookies and similar technologies that are necessary for the operation of the website, including security, login functionality, sessions and implementation of the user’s choices.

Google Analytics and other non-essential cookies are used only with the user’s consent. Non-essential cookies are not loaded before consent has been given.

Users may accept or reject optional cookies and change their choices through the website’s cookie settings.

The event tracking required for billing telephone number clicks is implemented without non-essential cookies. This tracking is based on the operation of the service, performance of agreements and legitimate interests, rather than consent to analytics cookies.

12. Protection of Personal Data

Personal data is protected through appropriate technical and organisational measures. Access is limited to persons whose duties require them to process the data.

Protective measures may include:

restricting access rights
secure password hashing
offering two-factor authentication
encrypted communications
system updates
logging and technical monitoring
backups
data-processing agreements and internal instructions.

13. Rights of the Data Subject

Under applicable data protection legislation, the data subject has the right to:

receive information about the processing of their personal data
access the personal data concerning them
request the correction of inaccurate or incomplete data
request the deletion of personal data
request the restriction of processing
object to processing based on legitimate interests
withdraw consent
receive data they have provided in a machine-readable format in certain circumstances
lodge a complaint with a supervisory authority.

These rights are not absolute in every situation. Fulfilment of a request may be affected by the legal basis for processing, contractual obligations, the need to verify the accuracy of billing and the legal obligations of KV Collective Oy.

Requests concerning the exercise of data-subject rights may be sent to [email protected]. The identity of the person making the request may be verified before the request is fulfilled.

The Finnish supervisory authority is:

Office of the Data Protection Ombudsman
Website: https://tietosuoja.fi/en
Email: [email protected]
Postal address: PO Box 800, FI-00531 Helsinki, Finland

14. Automated Decision-Making

Personal data is not used for automated decision-making or profiling that produces legal effects concerning the data subject or similarly significantly affects them.

The service may arrange or display business locations based on the user’s location, search criteria and information provided by the companies. This is a search function and does not constitute automated decision-making concerning the user.

15. Amendments to This Privacy Policy

KV Collective Oy may update this Privacy Policy if the operation of the service, the systems used, the processing of personal data or applicable legislation changes.

The current Privacy Policy is published on the HinausSuomi website. The latest effective date or revision date is stated at the beginning of the Policy.