Privacy Policy

1. Controller

Hypernova Oy is the controller of the personal data described in this policy. We process personal data in accordance with the EU General Data Protection Regulation (2016/679, "GDPR") and the Finnish Data Protection Act (1050/2018).

Data Protection Officer Lari Taskula. Reach us with the contact form at www.hypernova.fi/contact/ or by post at the address above.

2. What we process and why

We process only personal data that is necessary for the purposes listed below. The legal basis of each processing activity is shown in the table.

3. How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. The main retention periods are:

• Contact and quote requests: 24 months from the last contact, if no customer relationship is established.
• Customer agreements and support requests: for the duration of the customer relationship and 24 months after it ends.
• Server logs: 14 days, unless they are needed to investigate a security incident.
• Language and theme preferences: the language cookie is a session cookie; the theme setting stays in your browser until you clear your browser data.

4. Recipients and processors

We do not sell or rent personal data. We disclose personal data only where necessary, and always under a written data processing agreement (Article 28 GDPR) when a service provider processes data on our behalf.

• Data centre and hosting services: Hetzner Finland Oy (Tuusula, Finland). Our servers and backups are located in the EEA.
• Our own systems: this website, our support and ticketing system (Redmine) and our email run on our own servers in Finland.
• IT support and maintenance partners, bound by confidentiality and data processing agreements.
• Public authorities, such as the tax authority, where we are legally obliged to disclose data.

When you send us a request through the website, the information you submit is stored as a ticket in our Redmine system so that we can handle and follow up on your request.

5. Transfers outside the EEA

We primarily process personal data within the European Economic Area and our data centre is located in Tuusula, Finland. If personal data is transferred outside the EEA, we ensure an adequate level of protection as required by Chapter V of the GDPR, for example by using the European Commission standard contractual clauses together with a transfer impact assessment, or on the basis of an adequacy decision.

6. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15): to know whether we process personal data about you and to receive a copy of it.
• Right to rectification (Art. 16): to have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17): to have your data deleted, for example when it is no longer needed.
• Right to restriction of processing (Art. 18).
• Right to object (Art. 21): you may object to processing based on our legitimate interest.
• Right to data portability (Art. 20): to receive the data you provided in a machine-readable format, or to have it transferred.
• Right to withdraw your consent (Art. 7(3)) at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, use the contact form at www.hypernova.fi/contact/ or write to us at the postal address above. We reply within one month; for complex requests the deadline may be extended by two months (Art. 12(3)). Requests are free of charge, and we may need to verify your identity. We may refuse a manifestly unfounded or excessive request as allowed by Article 12(5).

If you consider that we process your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki, Finland, tel. +358 29 56 6700, tietosuoja.fi. You may also lodge the complaint in the EU member state where you live or work.

7. How we protect data

We protect personal data with appropriate technical and organisational measures, including: encrypted connections (TLS) for all traffic; role-based access control and least privilege for our staff; SSH-only remote access to our servers; daily encrypted backups stored in multiple locations; regular software and security updates; confidentiality commitments for our personnel and partners; and logging that allows us to investigate incidents.

Our servers and backups are located in Finland. If a personal data breach is likely to result in a high risk to your rights, we notify the supervisory authority within 72 hours (Art. 33) and, where required, also you and the other affected people without undue delay (Art. 34).

8. Cookies and device storage

This website does not use advertising or tracking cookies and it does not load content from third-party servers. We store only the following information on your device:

These entries are created only as a result of your own action (switching the language or toggling dark mode). They are not used to identify or track you and are not shared with anyone. Because they are necessary to provide the service you requested, they do not require consent (Act on Electronic Communications Services 917/2014, Chapter 5).

If we later introduce statistics or other cookies that are not strictly necessary, we will ask for your consent before setting them and provide an easy way to withdraw it at any time.

9. Automated decisions and profiling

We do not use your personal data for automated decision-making, including profiling, that would produce legal effects or similarly significantly affect you (Article 22 GDPR).

10. Children

Our website and services are aimed at organizations and professionals, and they are not directed at children. We do not knowingly collect personal data from children. If you believe that a child has submitted personal data to us, please tell us with the contact form at www.hypernova.fi/contact/ and we will delete it.

11. When we process data on behalf of a customer

When we host, maintain or support a library system (for example Koha) or another system for a customer, the customer - for example the library - is the controller of its patron and staff data, and Hypernova Oy acts as a processor. In that role we process personal data only on the documented instructions of the customer, in accordance with a written data processing agreement (Article 28 GDPR).

If you are a library patron and want to exercise your rights, for example to access, correct or delete your borrower data, please contact your library, which is the controller of that data. We assist our customers in responding to such requests, and we never use customer data for our own purposes.

12. Changes and contact

We may update this policy when our services or the legislation change. The version and date at the top of the page show when it was last revised. If a change is material, we will announce it on this page and, where necessary, inform our customers directly.

If you have questions about this policy or about how we process personal data, contact us with the contact form at www.hypernova.fi/contact/ or by post: Hypernova Oy, PL 16, 80101 Joensuu, Finland. We do not publish e-mail addresses on this website, so the contact form and the postal address are how you reach us.