WEBSITE PRIVACY POLICY & DATA PROTECTION NOTICE

Prepared in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the Finnish Data Protection Act (1050/2018)

1. Data Controller & Contact Information

This Privacy Policy describes how personal data is collected, processed, and protected when natural persons ('Data Subjects' or 'Users') visit, register with, or interact with the website operating at www.codfleet.com (the 'Website').

The Data Controller responsible for the processing of personal data under the European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679) and the Finnish Data Protection Act (1050/2018) is:

• Full Legal Name: CODFleet
• Business Identity Code (Y-tunnus): 3613089-4
• Geographical Office Address: Selkämerenkatu 18, 00180 Helsinki, Finland
• Privacy & Data Protection Email: info@codfleet.com
• Customer Support Telephone: +358 44 926 7397
• Data Protection Officer (DPO): Not appointed; requests are handled by our Legal & Privacy Team at info@codfleet.com

2. Statutory Scope & Legal Framework

This Privacy Policy is compiled in accordance with the mandatory data protection laws of Finland and the European Union. Processing activities strictly adhere to the following regulatory instruments:

• EU GDPR: The EU General Data Protection Regulation (GDPR - Regulation EU 2016/679);
• Finnish Data Protection Act: The Finnish Data Protection Act (Tietosuojalaki 1050/2018);
• Electronic Communications Act: The Finnish Act on Electronic Communications Services (Sähköisen viestinnän palveluista annettu laki 917/2014, specifically Chapter 24 regarding direct marketing and cookies);
• EU Digital Services: The EU Digital Services Act (DSA - Regulation EU 2022/2065) and Directive 2000/31/EC where applicable.

3. Core Principles of Processing

In accordance with Article 5 of the GDPR, CODFleet complies with the following mandatory data protection principles:

• Lawfulness, Fairness & Transparency: Personal data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose Limitation: Personal data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data Minimisation: Personal data collection is adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which they are processed.
• Accuracy: Personal data is accurate and kept up to date; inaccurate data is erased or rectified without delay.
• Storage Limitation: Personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the processing purposes.
• Integrity & Confidentiality: Personal data is processed in a manner that ensures appropriate security using technical and organizational measures.

4. Categories of Personal Data Collected

The Data Controller collects and processes personal data belonging to website visitors, registered account holders, customers, and business counterparties across the following categories:

4.1 Account & Contact Data

• First name, last name, business title, company name, postal address, electronic mail address, telephone number, user language preference.

4.2 Technical & Telemetry Data

• Internet Protocol (IP) address, device identification codes, browser type and version, operating system, network connection type, timestamp of access, referring URL, session log files, and interactive clickstream data.

4.3 Customer Relationship & Transactional Data

• Order history, product/service subscriptions, billing details, payment transaction metadata (note: credit card processing is handled securely by PCI-DSS compliant third-party payment gateways; CODFleet does not store raw credit card numbers).

4.4 Communication & Feedback Data

• Records of customer support inquiries, live chat logs, electronic contact form submissions, survey responses, and newsletter subscription preferences.

5. Purposes and Legal Bases for Processing

Personal data is processed strictly for defined purposes backed by a statutory legal basis under Article 6(1) of the GDPR:

6. Cookies & Tracking Technologies

The Website utilizes cookies, local storage objects, and web beacons in compliance with Section 205 of the Finnish Act on Electronic Communications Services (917/2014).

6.1 Classification of Cookies

• Strictly Necessary Cookies: Essential cookies required for transmission of communications or requested service operation (e.g. session authentication, cart items, security CSRF tokens). Processed based on statutory necessity without requiring prior consent.
• Non-Essential Analytics & Marketing Cookies: Cookies used to measure website traffic, visitor interactions, performance metrics, and personalized functional settings. Processed solely based on the user's prior explicit opt-in consent given via the website Cookie Consent Banner.

6.2 Cookie Consent Management

Users can modify or withdraw their cookie consent at any time via the persistent 'Cookie Settings' link available in the Website footer, or by adjusting browser settings to block third-party cookies.

7. Protection of Children's Personal Data

In accordance with Section 5 of the Finnish Data Protection Act (1050/2018), where information society services are offered directly to a child based on consent, processing of personal data is lawful if the child is at least 13 years old. If the child is under 13 years of age, processing is lawful only if consent is given or authorized by the holder of parental responsibility.

The Website is not directed at children under the age of 13. CODFleet does not knowingly collect personal data from minors under 13 without verifiable parental authorization.

8. Data Disclosures & Sub-Processors

CODFleet does not sell, rent, or lease personal data to third parties. Personal data is disclosed only to authorized recipients under the following circumstances:

• Authorized Sub-Processors: Third-party service providers acting as Data Processors under formal Data Processing Agreements (DPAs pursuant to Art. 28 GDPR), including cloud hosting providers, IT infrastructure maintainers, payment gateways, and email delivery platforms.
• Statutory Disclosures: Disclosures to public authorities, tax officials, or law enforcement entities when required by mandatory law, court order, or binding administrative decision under Finnish or EU legislation.
• Corporate Reorganization: In the event of a merger, acquisition, corporate restructuring, or asset sale, data may be transferred to the acquiring entity subject to confidentiality obligations.

9. International Data Transfers Outside the EU/EEA

Personal data is stored primarily within the European Union (EU) and European Economic Area (EEA). If personal data is transferred to sub-processors or servers located outside the EU/EEA, CODFleet ensures an adequate level of data protection by enforcing:

• EU Commission Adequacy Decision: The recipient country has received a formal Adequacy Decision from the European Commission (Art. 45 GDPR); or
• Standard Contractual Clauses (SCCs): Transfers are governed by standard data protection clauses adopted by the European Commission (Standard Contractual Clauses - SCCs pursuant to Art. 46(2)(c) GDPR), accompanied by supplementary technical encryption and security measures; or
• Data Privacy Framework: Transfers to certified organizations in the United States complying with the EU-U.S. Data Privacy Framework.

10. Retention Periods & Deletion Schedule

Personal data is retained only for as long as necessary to fulfill the processing purposes set out in Section 5 or to comply with statutory retention obligations under Finnish law:

• Customer Account & Contract Data: Retained for the duration of the active customer relationship plus 3 years following account deactivation or contract termination.
• Accounting & Billing Records: Retained for 6 years following the end of the calendar year in accordance with Chapter 2, Section 10 of the Finnish Accounting Act (Kirjanpitolaki 1336/1997).
• Website Access Logs & Technical Data: Stored for 6 to 12 months for security auditing, network integrity, and error detection.
• Marketing & Consent-Based Data: Erased immediately upon receipt of a consent withdrawal or objection, unless another statutory legal ground applies.

11. Data Subject Rights Under the GDPR

Under Articles 15 to 22 of the GDPR and the Finnish Data Protection Act, Data Subjects possess the following enforceable statutory rights:

• Right of Access (Art. 15 GDPR): The right to obtain confirmation as to whether personal data is being processed and to receive a copy of personal data undergo processing.
• Right to Rectification (Art. 16 GDPR): The right to obtain without undue delay the rectification of inaccurate or incomplete personal data.
• Right to Erasure / 'To Be Forgotten' (Art. 17 GDPR): The right to obtain the erasure of personal data without undue delay when statutory grounds apply (e.g. data no longer necessary, consent withdrawn).
• Right to Restriction (Art. 18 GDPR): The right to restrict processing while data accuracy or legitimate grounds are being verified.
• Right to Data Portability (Art. 20 GDPR): The right to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object (Art. 21 GDPR): The right to object at any time to processing based on legitimate interest or public task. Data subjects have an absolute, unconditional right to object at any time to direct marketing (including profiling).
• Right to Withdraw Consent (Art. 7(3) GDPR): The right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

11.1 Exercise of Rights & Response SLAs

Data subjects may exercise their rights free of charge by submitting a written request to the Data Controller at info@codfleet.com. The Data Controller will verify the applicant's identity and respond without undue delay, and at the latest within one (1) month of receiving the request. This period may be extended by two (2) further months if necessary due to request complexity.

12. Right to Lodge a Complaint with Supervisory Authority

If a Data Subject considers that CODFleet has infringed their data protection rights under the GDPR or Finnish law, they have the statutory right under Article 77 of the GDPR to lodge a complaint with the competent supervisory authority.

In Finland, the national competent supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):

• Supervisory Authority Name: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
• Visiting & Postal Address: Lintulahdenkuja 4, 00530 Helsinki / PO Box 800, 00531 Helsinki, Finland
• Telephone: +358 29 566 6700 (Switchboard)
• Email Address: tietosuoja@om.fi
• Official Website: https://tietosuoja.fi / https://tietosuoja.fi/en/

13. Data Security & Technical Safeguards

Pursuant to Article 32 of the GDPR, CODFleet implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• TLS 1.3 encryption for all data transmitted across the Website, and AES-256 bit encryption for stored databases and system backups.
• Strict role-based access control (RBAC), multi-factor authentication (MFA) for administrative personnel, and least-privilege security policies.
• Automated event logging, continuous vulnerability monitoring, daily Software Composition Analysis (SCA), and regular penetration testing.
• Routine employee data protection training and documented incident response playbooks guaranteeing 72-hour regulatory breach reporting under Article 33 GDPR.

14. Amendments to this Privacy Policy

CODFleet reserves the right to amend or update this Privacy Policy at any time to reflect changes in legal requirements, technical capabilities, or operational practices.

Material changes will be notified to registered users via email or prominent website banner prior to taking effect. The latest version is always accessible on the Website with its effective date.