Privacy Notice

This privacy notice explains how the Hilavitkutin.fi website processes personal data under the EU General Data Protection Regulation (EU) 2016/679 (GDPR) and the Finnish Data Protection Act (1050/2018). Last updated 19 October 2026.

1. Controller

Origodesign Oy
Iso Roobertinkatu 15 B 8, 00180 Helsinki, Finland
Business ID 0799689-1
Phone +358 9 8561 9410
Email: erkki@origodesign.fi

2. Contact person for privacy matters

Erkki Kirjalainen, erkki@origodesign.fi, phone +358 9 8561 9410. Origodesign Oy has not appointed a separate data protection officer; privacy matters are handled by the contact person above.

3. What data we process and why

Reader tips (“Send us your gadget” form). We process the name or nickname, email address, link, description of the tip and whether you made the gadget or own the rights to the photos, as well as the time of submission and technical data (such as your IP address) to prevent spam. Purpose: assessing the tip, possibly publishing it under your nickname and contacting you about it. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time. Your email address is not used for a newsletter or for marketing. Tips are stored in the site’s administration (Jetpack Forms) and forwarded to the editor-in-chief at erkki@origodesign.fi. We do not publish your photos or your name without your separate permission.

Email enquiries. If you email us, we process your name, email address and the content of your message in order to reply. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f)).

Visitor statistics (Jetpack Stats). We collect statistics on how the site is used, such as pages viewed, referring sites, browser type and approximate location, to improve our content. The statistics service is provided by Automattic Inc. We only use visitor statistics if you have accepted analytics cookies in the cookie banner. Legal basis: your consent.

Spam protection (Akismet). Form submissions are checked by Automattic Inc.’s Akismet service to detect spam. The content of the submission and technical data such as your IP address and browser user agent are sent to the service. Legal basis: our legitimate interest in protecting the site from spam.

Security and server logs. The site’s server and security services (Jetpack Protect) record technical log data, such as IP addresses and login attempts, to keep the site running and secure. Legal basis: our legitimate interest.

Comments. Comments on articles are currently switched off. If we enable them, we will process the name, email address, comment and IP address you submit in order to publish the comment and prevent spam; your email address will not be published.

Newsletter. The site does not currently have a newsletter. If we introduce one, subscribing will be based on your consent, and you can unsubscribe using the link in every message.

Embedded content. Articles contain embedded YouTube videos. A preview image may be loaded from YouTube’s servers, and the video itself is only loaded from Google’s service when you start it; Google may then process your data under its own policies. Author profile pictures may be loaded from Automattic Inc.’s Gravatar service.

4. Cookies

The site uses necessary cookies that are required for the site to work, for security and to remember your cookie choices. These do not require consent. We only use analytics and marketing cookies if you give your prior consent in the site’s cookie banner (CookieYes). Declining does not prevent you from using the site. You can change or withdraw your consent at any time via the cookie settings on the page, and you can also delete cookies in your browser settings. The use of cookies is governed by Section 205 of the Finnish Act on Electronic Communications Services (917/2014).

5. Recipients and transfers outside the EU/EEA

We do not sell personal data or share it with third parties for marketing. We use the following service providers, who process data on our behalf:

  • Website hosting: New Dream Network, LLC (DreamHost), United States
  • Jetpack (forms, statistics, security), Akismet and Gravatar: Automattic Inc., United States
  • YouTube embeds: Google Ireland Ltd / Google LLC, when you start a video

Because some of these providers are located in the United States, data is transferred outside the EU and EEA. These transfers are based on the EU–U.S. Data Privacy Framework.

6. Retention periods

  • Reader tips and related correspondence: 12 months from receipt, or sooner on request
  • Email enquiries: 12 months from the last message
  • Comments (if enabled): for as long as the comment is published
  • Visitor statistics, spam protection and server logs: according to the provider’s (Automattic, DreamHost) retention policies
  • Cookies: for the lifetime stated in the cookie banner

7. Your rights

Under the GDPR you have the right to:

  • access your data (Art. 15)
  • have inaccurate data rectified (Art. 16)
  • have your data erased (Art. 17)
  • restrict processing (Art. 18)
  • object to processing based on legitimate interest (Art. 21)
  • data portability for data you have provided (Art. 20)
  • withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7)
  • lodge a complaint with a supervisory authority (Art. 77)

You can make a request by email to erkki@origodesign.fi. No signed letter is needed, although we may ask for additional information to verify your identity. We respond free of charge and within one month at the latest.

8. Complaints to the supervisory authority

If you believe that the processing of your personal data infringes data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: PL 800, 00531 Helsinki, Finland
Email: tietosuoja(at)om.fi
Switchboard: +358 29 566 6700
tietosuoja.fi
You can also complain to the supervisory authority in your own EU country of residence.

9. Security

We protect personal data with appropriate technical and organisational measures, such as encrypted connections (HTTPS), personal user accounts, restricted access rights and backups. Only people who need the data for their work have access to it.

10. Automated decision-making and changes

We do not use personal data for automated decision-making or profiling. We will update this notice when needed; the current version is always on this page.