Privacy policy

Sun-Laatukatto Oy

Updated 19 October 2026. Based on the Finnish privacy policy updated on 14 October 2026.

Sun-Laatukatto Oy respects the privacy of its customers and website users. This privacy policy explains what personal data we collect, why we use it, how it is retained and what rights data subjects have.

Personal data is processed in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish legislation.

1. Data controller

Sun-Laatukatto Oy

Business ID: 3548651-4

Email: info@skatto.fi

Phone: 040 858 9667

Website: https://www.skatto.fi

Please contact us by email if you have questions about data protection.

2. What personal data do we process?

We process information necessary for the customer relationship, a quote request or the delivery of our services. This may include:

• Name, phone number and email address.
• Address, work-site location and property details.
• Enquiries, messages and the content of quote requests.
• Information entered into website forms and calculators.
• Photos, drawings, PDF files and other attachments supplied by the customer.
• Quotes, contracts, invoicing and payment information.
• Information relating to the delivery and documentation of work, warranties and complaints.
• Technical information from the website and systems used, such as IP addresses, browser information and event logs, to the extent that these are processed.

Information is obtained primarily from customers themselves through contact forms, email, phone or other communication channels. During work, we may also collect and retain information and photographs relating to the property.

3. Purposes and legal bases for processing

We process personal data for the following purposes:

Enquiries and quotes

We respond to enquiries, assess properties and prepare quotes. Processing is based on taking steps at the customer's request before entering into a contract or, depending on the circumstances, the controller's legitimate interests.

Customer relationships and delivery of work

We use information to plan and carry out work, communicate with customers and fulfil contractual obligations. Processing is based on the performance of a contract or on legitimate interests where, for example, the contracting party is a company and we process its contact person's information.

Invoicing and accounting

We process invoicing, payment and accounting information to fulfil contracts and comply with legal obligations.

Warranties, complaints and documentation of work

We may retain property information and photographs to demonstrate the quality of work, handle warranties and complaints, and establish, exercise or defend legal claims. Depending on the circumstances, processing is based on a contract, legitimate interests or a legal obligation.

Website operation and security

Technical information may be processed to ensure website functionality, deliver forms, prevent misuse and maintain security. Processing is based on legitimate interests or an applicable legal obligation.

We do not sell personal data or disclose it for other companies' own marketing purposes.

4. Online forms and electronic services

Our website and business operations may use external technical service providers. These include, for example:

• Netlify: website hosting, maintenance, technical operation, form-processing functions and security.
• Resend: sending email notifications relating to website enquiries and quote requests.
• Google Workspace: business email and other electronic working tools.
• Google Drive: storing documents, photographs and other work-related files supplied by customers, together with technical records needed for file delivery and recovery.
• Cloudflare Turnstile: preventing automated form submissions by processing technical request information when this protection is enabled.
• Other necessary service providers: for example, providers involved in invoicing, accounting, file processing, technical maintenance and security.

The website contact forms use Netlify Functions to process enquiries. Google Drive stores attachments and the request, attempt and receipt records needed to resume interrupted uploads, prevent duplicate sending and confirm email delivery. Resend sends the form notification by email.

Service providers may process personal data to the extent necessary to provide their services. Applicable legislation and the data protection arrangements agreed with service providers are followed.

5. Disclosure of personal data

Personal data may be disclosed or made available for processing only when necessary to provide the service appropriately or comply with a legal obligation. Recipients may include:

• Company employees to the extent necessary to carry out the work.
• Accountants and financial administration service providers.
• Providers of website, email and other information systems.
• Public authorities where disclosure is required by law.

Data is not unnecessarily disclosed to outside parties.

6. Data retention

We retain personal data only for as long as required by its purpose, contractual obligations, possible legal claims or legislation. The retention period depends on the purpose:

• Quote requests and enquiries: for as long as necessary to handle the matter and any further negotiations.
• Customer relationships and contracts: for the duration needed to manage the relationship and contractual obligations and, where necessary, resolve later claims.
• Work photographs and project documents: for as long as necessary to handle the work, warranties, complaints or possible legal claims.
• Invoicing and accounting information: for the period required by accounting and other applicable legislation.
• Technical logs and delivery records: for as long as required for system functionality and security, in accordance with service providers' retention practices and applicable legislation.

When information is no longer needed and there is no other basis for retaining it, it is appropriately deleted or anonymised.

7. Cookies and website technical information

The website does not use its own tracking cookies for advertising targeting.

Technical operation, security and functions such as submitting forms and files may require the processing of technical information or the use of necessary storage technologies. Submission recovery may use browser session storage (sessionStorage) to retain a recovery token and upload progress, but not the contents of attachments.

Service providers may process, for example, IP addresses, basic browser information and technical event logs.

If analytics, marketing or other tracking technologies requiring consent are introduced, the necessary consent will be requested and the privacy information updated.

8. Processing outside the EU and EEA

We use international cloud and online service providers. Depending on the service and its technical implementation, personal data may also be processed outside the European Union or the European Economic Area.

In these situations, we ensure that there is a basis for the transfer under data protection law and that applicable data protection requirements are met. Transfers may be based, for example, on a European Commission adequacy decision or Commission-approved standard contractual clauses and any necessary supplementary safeguards.

Further information about service providers' data protection arrangements can be requested from the controller.

9. Protection of personal data

Personal data is handled confidentially. Appropriate technical and organisational measures are used to protect it, including user accounts, restricted access rights and service providers' security features.

Access is limited to people and services that need the information for their work duties or to provide the service.

10. Your rights

Under applicable data protection legislation, you have the right to:

• Receive information about processing and request access to your personal data.
• Request correction of inaccurate or incomplete information.
• Request erasure when the conditions for erasure are met.
• Request restriction of processing in certain circumstances.
• Object to processing based on legitimate interests on grounds relating to your particular situation.
• Receive information you have supplied in a portable format where applicable.
• Withdraw any consent given for processing at any time.

Not all rights apply in every processing situation. For example, statutory retention obligations may prevent immediate deletion.

You can exercise your rights by contacting info@skatto.fi. We respond within the time limit required by the GDPR.

11. Right to lodge a complaint

If you believe that your personal data has been processed contrary to data protection legislation, you may contact the supervisory authority. In Finland, the competent authority is:

Office of the Data Protection Ombudsman
https://tietosuoja.fi/en/home

We recommend contacting us first so that any uncertainty can be resolved.

12. Updates to this privacy policy

We may update this privacy policy if our operations, the services we use or applicable legislation change.

The current English privacy policy is available at https://www.skatto.fi/en/privacy-policy. The Finnish privacy policy is also available on our website.

Privacy-related questions and requests: info@skatto.fi.