Focca – privacy policy for visitors to this website
Last updated: 16 september 2026
Privacy policy in accordance with the EU General Data Protection Regulation (GDPR).
Data controller
The data controller responsible for the personal data described in this policy is:
Focca
Business ID: 3101516-8
Address: Aleksanterinkatu 20 06100 Porvoo
Email: focca@focca.fi
Tel: 0449800230
This website and its technical platform are provided and hosted on the controller's behalf by Remy App Oy, acting as a data processor. Remy does not process this data for its own purposes.
Name of the register
Focca website contact register.
Legal basis and purpose of processing
We process the personal data you provide via the contact form in order to respond to your enquiry, to communicate with you about it, and to record and manage it in our customer relationship management (CRM) system so that we can follow up on your enquiry. We only process personal data where we have a lawful basis to do so.
Data content of the register
When you submit the contact form, we collect:
Data Purpose Source Name To identify and respond to you Provided by you Email address To reply to your enquiry Provided by you Phone number To reply to your enquiry Provided by you Message content To understand and answer your enquiry Provided by you We may also process limited technical data, such as the time of submission, for security and record-keeping.
Regular sources of data
Data is obtained primarily from you directly, when you send a message via the website contact form.
Data retention period
We do not keep personal data longer than necessary for the purpose for which it was collected, or longer than required by law.
Retention period for contact submissions is until further notice. Where your enquiry leads to an ongoing customer relationship, the data may be retained in the CRM for as long as that relationship continues. After the applicable period the data is deleted or anonymised, unless a longer period is needed to comply with law.
Cookies on this website
Besides the cookies needed to run this website, content and services from the third parties below may be loaded on it, and they may set their own cookies or receive technical data about your visit. Non-essential cookies are loaded only after you accept them.
- Google Maps – embedded maps and directions
- Stripe – payment processing and fraud prevention
- YouTube – embedded videos
Disclosures and transfers outside the EU/EEA
Personal data is processed primarily within the EU/EEA. It is stored and processed on the controller's behalf by Remy App Oy, which provides the website platform and its built-in customer relationship management (CRM) features, together with Remy's infrastructure sub-processors, under written data processing agreements. Where a service provider is located outside the EU/EEA, we ensure the transfer is protected by an appropriate safeguard, such as a European Commission adequacy decision, the EU Standard Contractual Clauses (SCCs), or, for a certified US provider, the EU-US Data Privacy Framework.
Principles of register protection
Data is stored electronically and protected in line with general industry standards. Access is restricted through user-specific logins, passwords and access rights. Only personnel whose duties require it process the data, and it is treated as confidential.
Right of access and other data subject rights
Under the GDPR you have the following rights:
- Access: the right to know whether we process your data and to obtain a copy of it.
- Rectification: the right to have inaccurate or incomplete data corrected.
- Erasure (“right to be forgotten”): the right to have your data deleted where there is no lawful basis to keep it.
- Restriction: the right to request restriction of processing in certain situations.
- Objection: the right to object to processing where it is based on legitimate interest.
- Portability: where processing is based on consent or a contract, the right to receive your data in a commonly used electronic format.
- Withdraw consent: where processing is based on consent, the right to withdraw it at any time.
Requests should be sent in writing to the data controller using the contact details above. The controller may ask you to verify your identity and will respond within the period laid down in the GDPR. If you believe your data is processed unlawfully, you may lodge a complaint with the supervisory authority (in Finland, the Office of the Data Protection Ombudsman).
