Home

Keeplio Oy and Omaisuus.com privacy policy

This policy has been effective since 5 June 2025. This is the English translation of the Finnish privacy policy.

1. Introduction

When processing your personal data, we comply with the General Data Protection Regulation (GDPR) and other data protection legislation. We aim to follow good data protection practices and maintain information security. Keeping information secure and available when needed is a priority for us.

This privacy policy describes how we collect, process and protect personal data in the Omaisuus.com system and in Keeplio Oy's business operations generally.

2. Personal data processed and purposes of processing

We collect and use your personal data only for the specific purposes listed below. The types of personal data processed for each purpose are also listed. Some of the personal data processed may fall within special categories of personal data.

Information related to managing, locating, identifying, selling and transferring assets (Omaisuus.com):

  • Name and contact details
  • Telephone number
  • Email address
  • System access rights, user accounts and any log data
  • Asset location information, including coordinates
  • Photographs and video recordings
  • Credit card number or other payment or billing information

Customer and partner information, and handling enquiries:

  • Name
  • Email address
  • Telephone number
  • Any personal data provided in an enquiry

Product and service development:

  • Analytics or statistical information may be used to develop services and processes.

3. Legal bases for processing personal data

Data protection legislation requires all processing of personal data to have a legal basis under the GDPR. We process your personal data on the following bases:

Contract

Performing obligations and tasks related to the service agreement is one of the main legal bases on which we process your personal and asset information. Acceptance of the service agreement also gives consent to the processing of personal data.

Consent

In certain situations we process your personal data only with your prior explicit consent. This may include disclosing the owner's information for an asset reported stolen to its finder, authorities or an insurance company, or for returning or delivering the asset to its owner, including possible finder rewards.

Processing personal data related to newsletter subscriptions is also based on consent.

You can withdraw your consent in the online service.

Legitimate interest

Processing personal data related to handling enquiries submitted through the website and to internal communications.

Legal obligation

Processing may be based on a legal obligation. For example, processing information required for taxation, official activities and financial administration is based on a legal obligation.

4. Sources of personal data

Personal data is mainly collected directly from you when you register to use Omaisuus.com (consumer customers).

Personal data may also be collected through enquiries and to maintain the customer register (business and private customers).

5. Roles of the controller and processor

The Omaisuus.com system serves as a platform and a personal data processor. Each registered user maintains and creates records about their own assets, items or belongings.

Keeplio Oy does not act as controller for personal data other than the information specified above (section 2, customer register and access rights) which it stores to enable the system's functions.

The person or organisation that enters information into the register is responsible for the accuracy of information about products, goods and items and any additional information attached to them. They act as controllers for the asset and item information entered into Omaisuus.com.

Omaisuus.com and Keeplio Oy do not themselves, as controllers, store sensitive personal data in the system, and do not recommend storing such information, including medical or health information, information about financial circumstances or enforcement proceedings.

6. Disclosures and transfers of personal data

We process your information confidentially. We do not sell, rent or otherwise unnecessarily disclose your personal data to outside parties.

When an asset is sold or transferred, your personal data may be disclosed to the new owner with your consent (a trusted marketplace with verified ownership).

Based on your consent, personal data may also be disclosed to insurance companies, financial institutions, machinery or equipment importers, retailers, authorities and maintenance providers. We comply with legal obligations when responding to information requests from authorities.

6.1. Disclosures of personal data

A disclosure occurs when the controller (Keeplio Oy) provides personal data to a third party that uses the data for its own purposes, rather than on behalf of Keeplio Oy. Personal data may be disclosed to:

  • A competent authority, such as the Police, Border Guard, Customs, Tax Administration or National Enforcement Authority, as permitted or required by law, or with your explicit consent.
  • Insurance companies or financial institutions in the financial sector.

6.2. Transfers of personal data

A transfer occurs when the controller provides personal data to a third party to process on the controller's behalf. For example, outsourcing a processing activity such as financial administration or system information to another company usually requires a transfer of personal data.

Some of the information we collect is stored and processed outside the European Economic Area, for example when a service provider we use is located or stores information outside the EEA. Our service provider has contractually committed to ensuring an adequate level of data protection in all processing of your personal data.

7. Protection of personal data

We protect your personal data against loss, unauthorised access and other misuse through appropriate technical and organisational security measures. These include firewalls, encryption, backups and secure cloud services.

Internal access to personal data is restricted by two-factor authentication and access management and monitoring practices. Only people whose work requires it may process your personal data.

8. Automated decision-making

An automated decision is a decision made entirely automatically (for example by an algorithm) without human involvement. Our processing of your personal data does not include automated decision-making.

9. Retention periods

We retain personal data only as long as necessary to fulfil the purposes for which it is processed, unless the law requires longer retention.

The person who registered asset information decides whether identifiable asset information remains in the register and may delete items through the user interface. Personal data is removed from the system 24 months after it is deleted.

After the retention period ends, information is either removed by overwriting it in backups and system background data after a waiting period, or anonymised by irreversibly changing it so that an individual person or asset can no longer be identified.

Typical retention periods are listed below. A retention period may be calculated, for example, from the creation of the personal data or the end of an employment relationship.

  • Personal and asset information registered by users and provided with their consent is retained for two years after their access rights end.
  • Personal data submitted through the contact form is retained for two years.
  • Personal and contact information used to support sales and marketing is retained for two years.

10. Rights of data subjects

10.1. Right to information about processing

You have the right to receive information about the processing of your personal data in a concise, transparent, accessible and easily understandable form, using clear and plain language. This policy aims to fulfil that right and help you understand how and why we process your personal data. If this policy does not answer your question, contact us using the details in the contact section.

10.2. Right of access

You have the right to receive confirmation of the personal data we process about you. This allows you to assess and verify whether the processing is lawful. You also have the right to request and receive a copy of the personal data we process. Instructions for making a request are provided in the section “Exercising your rights”.

10.3. Right to data portability

In certain situations, you have the right to have the personal data you provided to us transferred directly to another controller in a commonly used, machine-readable format. This right applies when we process the data based on your consent or a contract and the processing is automated (digital).

10.4. Right to rectification

We aim to keep your personal data up to date and, where necessary, remove or supplement inaccurate, incomplete or incorrect information without delay. You may also require us to correct inaccurate or incorrect personal data about you, or complete incomplete data.

10.5. Right to restriction of processing

Restriction means that, apart from storage, the restricted personal data may only be processed:

  • With your consent
  • To establish, exercise or defend legal claims
  • To protect the rights of another natural or legal person, or
  • For reasons of important public interest of the European Union or a Member State.

This right applies when:

  • You contest the accuracy of your personal data, for the time needed to verify its accuracy.
  • Processing is unlawful but you do not want the information deleted.
  • We no longer need the data and would otherwise delete it, but you need it to establish, exercise or defend legal claims.
  • You have objected to processing based on the controller's legitimate interests, pending verification of whether the controller's interests override yours.

10.6. Right to object

In certain situations, you have the right to object to processing of your personal data, meaning that you may ask for it not to be processed at all. If we process your data to perform a task in the public interest, exercise official authority or pursue legitimate interests, you may object on grounds relating to your particular personal situation.

In that case, processing must stop unless:

  • We can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or
  • Processing is necessary to establish, exercise or defend legal claims.

When personal data is processed for direct marketing, you may always object without giving a reason. After you object, your personal data may no longer be processed for direct marketing.

10.7. Right to erasure and to be forgotten

In certain cases, you have the right to be forgotten, meaning that some personal data we process must be completely deleted. This generally applies, for example, when processing was based on consent and you withdraw that consent, when the processing was unlawful from the outset, or when lawfully collected personal data is no longer needed for its original purpose or any other acceptable purpose, such as a legal retention obligation.

10.8. Right to withdraw consent

When we process personal data based on your explicit consent, you may withdraw your consent at any time. If you withdraw consent, processing and retention will not continue unless another legal basis, such as a legal obligation, requires continued processing.

10.9. Right to complain to a supervisory authority

In addition to these rights, you may complain to a supervisory authority if you believe that we are processing your personal data in breach of the GDPR. For example, you may complain if the rights described in this policy are not properly implemented. The Finnish data protection supervisory authority is the Office of the Data Protection Ombudsman.

11. Exercising your rights

If you have questions about your rights, want to inspect your data or otherwise exercise your rights, contact us using the details at the end of this policy.

Exercising your rights is generally free of charge. In certain exceptional cases defined by law, such as requesting several copies of your data, we may ask for an advance fee corresponding to the cost of fulfilling the request.

We respond to all requests without undue delay, at the latest within one month of receipt, and explain the action taken. If we must refuse your request, we will inform you of the refusal and its reasons within one month of receipt.

If requests are numerous or complex, we may need up to two additional months. We will inform you of the extension and its reasons within one month of your request.

For information on making a complaint to the supervisory authority, visit the Office of the Data Protection Ombudsman.

12. Controller and contact details

The controller is the party that determines how and why personal data is processed. Keeplio Oy acts as controller for the personal data of users signed in to Omaisuus.com and for customer, sales and marketing information.

Keeplio Oy has appointed a data protection officer who acts as an internal expert on data protection. The officer monitors processing and helps and advises employees on complying with data protection rules. The officer also serves as a contact for enquiries about the use of personal data and requests for information.

Controller's contact details:
Keeplio Oy
info@keepl.io
Business ID 3562250-4
Savilahdenkatu 5–7, 50100 Mikkeli, Finland

Data protection officer:
Markku Valkonen
info@keepl.io

Updates to this policy

We continuously develop our data protection practices and may update this policy from time to time. Changes may also be based on changes in legislation. We recommend reading the policy occasionally to stay informed of changes. Where necessary, we may also notify you directly.