Effective 13 October 2026 · Last updated 13 October 2026

This privacy policy describes how Voltria Oy processes personal data on its website voltria.fi, in its services (such as admin.voltria.fi), in sales and marketing and in the heating optimisation service it delivers to customer properties. Processing complies with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).

1. Data controller

Voltria Oy
Business ID: 3545678-8
Korventie 41 B, 17320 Asikkala, Finland
[email protected]
https://voltria.fi

Contact for privacy matters: Lauri Toikka, [email protected]

For apartment-level indoor condition data in customer properties, Voltria acts as a processor on behalf of the customer property (section 2.5).

2. Personal data we process

2.1 Data provided through contact and booking forms

  • Name
  • Email address
  • Phone number (optional)
  • Name of the property or organisation
  • Content of the message

2.2 Data collected from use of the website

Visitor statistics are collected with Umami, a cookieless analytics service. It stores no cookies or other identifiers on the visitor's device and does not build a persistent profile of any individual visitor. The data collected is anonymised and aggregated: pages visited, time of visit, referring site, browser type, operating system and approximate location at country level. IP addresses are not stored.

In addition, the website's server logs record technical data such as IP address and request time to ensure security and proper operation of the site.

2.3 Sales and prospecting register

Data subjects are board members and deputy board members, property managers and auditors of housing companies and other property companies. We process:

  • name
  • company and role in the company (e.g. board chair, member, deputy member, property manager or auditor)
  • date of birth
  • municipality of residence
  • registration date of the role and whether the role has ended
  • phone number and where it was obtained
  • email address
  • contact history and sales notes
  • any objection to being contacted

We also store the trade register extracts the data was taken from.

The date of birth is used only to identify the right person when several people share the same name, for example when matching trade register data with phone numbers from public directory services. It is not used for marketing targeting and is not disclosed to anyone.

2.4 Customer and service user data

  • Name, contact details and role of customer property contacts
  • Contract, billing and communication records
  • Service user accounts, access rights and login data
  • Service event log: user, action, time and IP address

2.5 Apartment-level indoor condition data in customer properties

In customer properties where the service includes indoor sensors, we process:

  • apartment-level temperature and humidity readings
  • the apartment identifier where the sensor is installed
  • an estimate derived from the readings of whether the apartment is occupied or vacant
  • historical readings transferred from the property's previous system

This data is processed on behalf of the customer property (e.g. a housing company) under our agreement with it. The customer property is the controller. Voltria acts as processor and uses the data for heating control, indoor condition monitoring and savings verification.

2.6 Stakeholder contact data

Name, contact details, organisation and role of contacts at investors, partners and suppliers, together with communication records such as meeting notes.

3. Purposes and legal basis of processing

  • Responding to enquiries and managing the customer relationship: steps prior to entering into a contract and performance of a contract (GDPR 6.1.b) and legitimate interest (GDPR 6.1.f)
  • Marketing communication to those who have contacted us: legitimate interest (GDPR 6.1.f); you may object at any time
  • Sales and marketing to property decision makers (prospecting): legitimate interest (GDPR 6.1.f). Our legitimate interest is offering our service to properties by contacting the people who, according to public registers, are responsible for managing the property. Contacts concern their role in the property. You can opt out of contacts at any time.
  • Delivering the service and managing users: contract with the customer (GDPR 6.1.b) and legitimate interest (GDPR 6.1.f) for customer contacts and users
  • Service security and investigating misuse (event log): legitimate interest (GDPR 6.1.f)
  • Apartment-level indoor condition data: processed on behalf of the customer property and according to its instructions. The property, as controller, is responsible for the legal basis.
  • Communication with stakeholders: legitimate interest (GDPR 6.1.f)
  • Ensuring the operation and security of the website: legitimate interest (GDPR 6.1.f)
  • Visitor statistics using anonymised, cookieless analytics: legitimate interest (GDPR 6.1.f)

4. Sources of data

Personal data is obtained from you (forms, communication and use of the service), from the customer property and its contacts and from measuring devices installed in the property.

Data in the sales and prospecting register is collected from public sources:

  • the Finnish Trade Register of the Finnish Patent and Registration Office (trade register extracts) and the Business Information System YTJ
  • the Ryhti built environment information system and the National Land Survey of Finland (basic property and company data)
  • public directory and number services such as Fonecta and Profinder (phone numbers)

When we first contact you, we tell you where your data was obtained and where this policy can be read.

5. Recipients and transfers of personal data

We use the following service providers that process personal data on our behalf:

  • Amazon Web Services EMEA SARL - hosting, databases and notification emails (EU: Sweden and Germany)
  • Webflow, Inc. - website platform and forms (USA)
  • Tally B.V. - forms (EU)
  • Google LLC - Google Workspace email, files and meeting booking (EU/USA)
  • Umami Software, Inc. - cookieless visitor analytics, anonymised data (USA)
  • Attio Ltd - customer relationship management (United Kingdom)
  • Anthropic PBC - AI assistant for Voltria's internal work, such as processing sales and service data (USA)

We also use accounting, project management, document sharing and meeting note services that process personal data on our behalf.

Personal data may be transferred outside the EU and EEA. Transfers rely on European Commission adequacy decisions (e.g. the United Kingdom and the EU-US Data Privacy Framework) or on Standard Contractual Clauses (SCC) approved by the Commission.

We do not sell personal data to third parties. Data in the sales and prospecting register is not disclosed outside Voltria.

6. Retention periods

  • Data submitted through forms: up to 24 months from the last contact, unless a customer relationship continues
  • Sales and prospecting register: up to 24 months from the last contact or, if no contact has been made, from collection. A person's data is deleted no later than 12 months after the register shows they no longer hold the role. The name and objection of a person who has opted out are kept as long as needed to respect the objection.
  • Customer relationship data: for the duration of the relationship and thereafter as required by the Accounting Act
  • Service user data: while access rights are valid; event log up to 24 months
  • Apartment-level indoor condition data: for the duration of the customer agreement and up to 12 months after it ends, unless otherwise agreed with the customer property
  • Stakeholder contact data: for the duration of the cooperation and up to 24 months from the last communication
  • Server logs: up to 12 months
  • Anonymised visitor statistics: contain no personal data, retained for statistical purposes

7. Cookies

The website does not use analytics or marketing cookies and therefore does not ask for cookie consent. The site uses only technical cookies and browser storage that are strictly necessary for its operation, such as the hosting platform's security cookie and remembering your language preference. These do not require consent.

8. Your rights

You have the right to:

  • access the personal data we hold about you
  • request correction of inaccurate data
  • request erasure of your data ("right to be forgotten")
  • request restriction of processing
  • object to processing based on legitimate interest
  • opt out of direct marketing and sales contacts at any time
  • data portability
  • lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman, tietosuoja.fi)

Requests should be sent to [email protected]. We respond without undue delay and at the latest within one month.

Requests concerning apartment-level indoor condition data are handled by the customer property as controller. You can also send the request to us and we will forward it to the property.

9. Data security

Personal data is treated as confidential. It is protected by appropriate technical and organisational measures such as access control, encryption and training. Access to personal data is limited to those whose duties require it.

10. Changes to this policy

We may update this privacy policy as our operations or legislation change. Significant changes will be announced on the website. For any privacy-related questions, please contact the person named above.