Privacy Policy
Last updated: 1 July 2026
1. Data controller
Vexallio is a brand operated by ะะะขะะะ ะะ ะฃะ (Netpeak Group), a company registered in Sofia, Bulgaria, with its registered office at j.k. Lozenets, bul. "Cherni vrah" 43, et. 2, 1407 Sofia, Bulgaria. It is the controller of the personal data processed via vexallio.com. You can reach us at privacy@vexallio.com.
2. Legal framework and national law
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable national law in each market we serve: the Finnish Data Protection Act (1050/2018), the Swedish Data Protection Act (2018:218), the Norwegian Personal Data Act (via the EEA) and the Danish Data Protection Act.
3. Personal data we collect
We collect data you provide directly โ such as name, email, company, and message content from contact and newsletter forms and meeting bookings โ and technical data generated automatically, such as IP address, device and browser information, and interactions with our website.
4. Sources of data
Most data comes directly from you. Some technical data is generated automatically when you use our website. We may supplement business contact data from publicly available professional sources where lawful.
5. Purposes and legal bases
We only process personal data where we have a lawful basis under Article 6 GDPR:| Processing activity | Purpose | Legal basis |
|---|---|---|
| Contact forms | Responding to enquiries | Legitimate interests โ Art. 6(1)(f) |
| Newsletter | Marketing communication | Consent โ Art. 6(1)(a) |
| Meeting scheduling | Service delivery | Contract โ Art. 6(1)(b) |
| Accounting records | Legal compliance | Legal obligation โ Art. 6(1)(c) |
| Website analytics | Improving the service | Consent โ Art. 6(1)(a) |
6. Recipients and processors
We share data only with trusted service providers acting as processors under Article 28 GDPR โ for example hosting, email and analytics providers โ bound by written data processing agreements. We do not sell personal data.
7. International transfers
Where data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) together with a transfer impact assessment and supplementary measures where required.
8. Retention
We keep personal data only as long as necessary for the stated purpose. Enquiry data is kept up to 24 months; newsletter data until you unsubscribe; accounting records for seven years as required by law.
9. Your rights
Under Articles 15โ22 GDPR you have the right of access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent at any time without affecting prior processing.
10. How to exercise your rights
To exercise any right, contact privacy@vexallio.com. We respond within one month as required by Article 12 GDPR. We may ask you to verify your identity before acting on a request.
11. Security
We apply appropriate technical and organisational measures under Article 32 GDPR, including TLS 1.3 encryption in transit, access controls, least-privilege principles and regular review of our processors.
12. Personal data breaches
In the event of a breach likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours under Article 33, and affected individuals without undue delay under Article 34 where required.
13. Automated decision-making and profiling
We do not make decisions producing legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR. Where AI supports a decision, a human remains responsible.
14. Children
Our services are directed at organisations, not children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, contact us and we will delete it.
15. Changes to this policy
We may update this policy to reflect changes in law or our practices. The latest version is always published here with an updated date at the top.
16. Supervisory authority
You have the right to lodge a complaint with a supervisory authority โ in Finland the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu), in Sweden IMY, in Norway Datatilsynet, and in Denmark Datatilsynet.
17. Contact
For any privacy question, contact us at privacy@vexallio.com. We are happy to help.