Privacy & Data Protection

01Data controller

The data controller for this website and the Struxiva service is:

Struxiva Oy
Business ID / Y-tunnus: 3621299-6
Helsinki, Finland

For all data-protection matters, contact info@struxiva.com.

02Data we collect

We collect only personal data that is necessary to operate our services, manage business relationships, respond to enquiries, or that you provide voluntarily.

Contact & enquiry data

• Email address provided through the contact form or by direct email
• Name and organisation name when provided
• Content of messages and relevant scoping-call or business communication notes

Event & trade-fair contact data

When Struxiva participates in trade fairs, exhibitions, conferences, networking events or similar events, we may collect your contact information when you voluntarily provide it to us.

Where an event provides a badge, QR-code or similar contact-scanning system, we may receive information associated with your event registration after you permit us to scan your identifier. Depending on the event system and the information you have provided to the event organiser, this may include:

• Name
• Email address
• Phone number
• Organisation or company
• Job title or position
• Date or time of the contact or scan
• Information you voluntarily provide during our discussion or through an event form

We use this information to record your interaction with Struxiva, respond to your request, provide information you asked for, and, where permitted, follow up with you after the event regarding Struxiva's products, services, pilots or potential collaboration.

Building & operational data (pilot customers)

• Building documents, such as drawings, energy certificates and BMS exports. These primarily concern buildings rather than individuals.
• Anonymised sensor time-series, such as energy, temperature and CO₂ measurements.
• Relevant operator or customer-organisation contact details.

If building or operational datasets contain personal data, that information will be processed in accordance with applicable data-protection requirements and the relevant customer agreement.

Technical & analytics data

• Server access logs, including IP address, browser type and referring URL, retained for 30 days and then deleted.
• Cookie-based analytics as described in Section 05.

03Legal basis for processing

Depending on the context, processing is based on one or more of the following grounds under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): for non-essential cookies, marketing communications where consent is required, and other processing for which we specifically request consent. You may withdraw consent at any time.
• Contract performance (Art. 6(1)(b)): where processing is necessary to enter into or perform a pilot, service or other agreement.
• Legitimate interests (Art. 6(1)(f)): for appropriate business communications, responding to business enquiries, maintaining professional relationships, service improvement and security, where our interests do not override your rights and interests.
• Legal obligation (Art. 6(1)(c)): where applicable law requires us to process or retain information.

For event and trade-fair contacts, the legal basis depends on the particular interaction and subsequent use of the information. Where we ask for consent to collect or use your contact information for a particular purpose, processing is based on that consent. Appropriate individual business follow-up may also be based on our legitimate interests where permitted by applicable law.

04Finnish social security numbers (henkilötunnus)

If Struxiva later introduces functionality requiring identity verification or processing of Finnish personal identity codes, this policy and the relevant collection notices will be updated before such processing begins.

Any processing of Finnish personal identity codes will comply with the GDPR, the Finnish Data Protection Act (1050/2018), including Section 29 where applicable, and other applicable Finnish legislation.

Appropriate technical and organisational safeguards will be implemented according to the sensitivity and purpose of the processing.

05Cookies & tracking

We follow applicable Finnish and EU requirements concerning cookies and similar technologies, including applicable Traficom guidance.

Strictly necessary

Technologies necessary for operation of the website, such as storing language preferences or cookie-consent choices, may be used without consent where permitted by law.

Analytics

Where consent is required, analytics technologies are activated only after the required consent has been obtained. Basic usage analytics may include information such as page views and session duration and are used to understand and improve the website. We do not intentionally use analytics for cross-site tracking or browser fingerprinting.

06Data transfers & processors

We use a limited number of service providers and processors to operate our website and services. Where required, processors are subject to appropriate contractual and data-protection obligations. These may include:

• Google Cloud Platform (GCP) — infrastructure and storage, including services hosted in EU regions where configured.
• Google Gemini API — AI-assisted document analysis. Building documents may be transmitted for processing in accordance with the applicable service configuration and contractual terms.
• FormSubmit — delivery of information submitted through website contact or newsletter forms to Struxiva.

We aim to avoid intentionally transmitting unnecessary personal data through building-document analysis workflows.

Where personal data is transferred outside the European Economic Area, Struxiva will use a lawful transfer mechanism where required, such as an adequacy decision or Standard Contractual Clauses.

Event organisers and their technology providers may separately process participant information according to their own privacy notices. Once Struxiva receives personal data for its own purposes, Struxiva is responsible for its processing as described in this Privacy Policy.

07Retention periods

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law. Our current retention practices include:

• Contact & enquiry data: generally up to 2 years from the last meaningful contact unless a customer or continuing business relationship is formed.
• Event & trade-fair contact data: generally up to 2 years from the last meaningful interaction where retention remains relevant to the business relationship, unless consent is withdrawn earlier or another retention period is required by law or the applicable event arrangement.
• Customer relationship data: for the duration of the contractual relationship and thereafter as necessary to meet legal, accounting or legitimate business requirements.
• Building documents: for the duration of the pilot or service agreement and deleted according to the applicable customer agreement, generally within 30 days after the relevant service or pilot ends unless continued storage has been agreed or is legally required.
• Server access logs: 30 days.
• Cookie-consent records: generally 12 months before consent is requested again, where applicable.

Event-platform data may be subject to shorter retention periods imposed by the event organiser or event-platform agreement. For example, where an event agreement requires deletion of information obtained through the event platform within a specified period, Struxiva will comply with that requirement. Any information subsequently retained by Struxiva for its own lawful purposes will be handled independently under this Privacy Policy and the applicable legal basis.

08Your rights

Under the GDPR and applicable Finnish data-protection legislation, depending on the circumstances, you may have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate or incomplete personal data (Art. 16).
• Request erasure of personal data where the applicable conditions are met (Art. 17).
• Restrict processing in circumstances specified by the GDPR (Art. 18).
• Receive certain personal data in a structured, commonly used and machine-readable format where the right to data portability applies (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Object at any time to processing of your personal data for direct marketing.
• Withdraw consent at any time where processing is based on consent (Art. 7(3)), without affecting the lawfulness of processing carried out before withdrawal.

Requests can be sent to info@struxiva.com with the subject "Data Subject Request". We will respond within the time limits required by the GDPR. We may request information necessary to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

09Security

Struxiva implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

These measures include access controls, authentication mechanisms, encrypted communications and restrictions on access to production systems. Access to personal data is limited to persons who require it for legitimate business or operational purposes.

Where Struxiva is required under the GDPR to notify a personal data breach to the competent supervisory authority, notification will be made in accordance with GDPR Article 33. Where GDPR Article 34 applies, affected individuals will also be informed without undue delay.

10Event and exhibition privacy information

When you meet Struxiva at an exhibition, conference or other professional event, you are not required to allow us to scan your badge or provide your contact details. Before scanning an event badge or similar identifier, we will request your permission.

If you permit the scan, Struxiva may receive the contact information made available through the event platform. We use that information for the purposes described in Section 02, including recording your interaction, responding to requests and, where legally permitted, following up regarding Struxiva's services, products, pilots or potential collaboration.

You may ask us at the event how your information will be used and may access this Privacy Policy before providing your information.

If you subsequently do not want Struxiva to use your contact information for direct marketing, you can object at any time by contacting info@struxiva.com. Where processing is based on consent, you can withdraw that consent at any time.

11Contact & data-protection responsibility

Struxiva Oy does not currently have a designated Data Protection Officer. Data-protection responsibilities are managed internally.

For data-protection enquiries, requests or complaints:
Email: info@struxiva.com
Phone: +358 44 982 2227
Post: Struxiva Oy, Helsinki, Finland
Business ID / Y-tunnus: 3621299-6

We may update this Privacy Policy to reflect changes in our services, processing activities or applicable law. The current version and its last-updated date will be published on this page.