This policy explains how Arcareon Oy processes personal data when you browse our website, create an account, book rental equipment, request delivery or contact us. Processing is governed by the EU General Data Protection Regulation (GDPR) and applicable Finnish legislation, including the Data Protection Act (1050/2018).
1. Controller
Arcareon Oy
Business ID: 3574408-5
Espoo, Finland
Email: info@arcareon.fi
Telephone: +358 45 78734831
2. Purposes and legal bases
We process booking, contact, billing, payment and delivery information to prepare and perform rental agreements, arrange handover and return, and provide customer service. The legal basis is a contract or steps taken at your request before a contract. Accounting records are processed to meet legal obligations. Website security, misuse prevention and handling rental-related claims rely on our legitimate interests in operating a secure service and protecting our rights. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
3. Data processed
Data may include your name, email, phone number, account details, billing and delivery addresses, selected equipment, quantity, rental dates and times, optional services, order totals, payment status, customer-service messages, and handover, return or damage information. Technical data may include IP addresses, browser information, security logs, cookies and browser storage. Identity may be checked at handover; an identity-document copy is not retained without a separate lawful reason. Payment providers process details needed for your chosen method and may return payment status and transaction references to us.
4. Sources of data
Information is obtained from you through bookings, your customer account, contact forms, email, telephone and handover or return. Payment and transport providers may supply information needed to complete the service. Contact details, rental selections and relevant billing details are necessary to process a booking; a delivery address is needed if you request delivery. Without necessary information, we may be unable to confirm a booking or arrange delivery. Collecting equipment yourself does not require using the delivery calculator.
5. Recipients of data
Access is limited to authorised personnel and providers needed for hosting, website maintenance, booking, payments, email, accounting, debt collection and transport. Only information needed for the task is shared. Payment services may include Paytrail or Klarna, depending on the method offered at checkout; their own privacy notices also apply. When you request a distance-based delivery estimate, the entered address may be sent by our server to OpenStreetMap Nominatim to obtain coordinates. Origin and destination coordinates may then be sent to the public OSRM routing service to estimate driving distance. Your name, email, phone number and payment details are not included in these routing requests. Jetpack services provided by Automattic support website statistics and operation and may process technical usage data. Authorities may receive data where required by law. Personal data is not sold.
6. Transfers outside the EU or EEA
Some payment, statistics, communications or technical service providers may process data outside the EU or EEA. Transfers require a lawful mechanism, such as an applicable European Commission adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact us for information about the recipients and safeguards relevant to your data. Provider privacy notices also explain their own processing and transfers.
7. Retention periods
Personal data is retained only while needed for its stated purpose or a legal obligation. Booking and customer-service records are assessed according to the customer relationship, completion of the rental, outstanding payments, complaints or claims, and applicable limitation periods. Under the Finnish Accounting Act (1336/1997), transaction vouchers, related correspondence and other supporting accounting material must generally be kept for at least six years from the end of the calendar year in which the financial year ended. Financial statements, accounting books and certain other accounting records must be kept for at least ten years from the end of the financial year. These periods do not apply to every piece of customer data. The delivery-page calculator caches distance and price for up to 30 days under a key derived from the address; its IP-based request-limit counter expires after one hour. Account closure does not remove records that must be retained by law or for legal claims. Unnecessary data is deleted or anonymised.
8. Cookies
Necessary cookies and browser storage support the basket, login, language selection and booking process. Session storage may remember your delivery or pickup selection during checkout. Jetpack (Automattic) provides website statistics and may process technical usage information. Under Finnish rules on cookies and terminal-device storage, non-essential storage or access requires prior consent unless a statutory exception applies. You can manage or clear cookies and site storage through your browser; blocking necessary storage can affect the service. Browser settings do not replace consent where consent is legally required. Contact info@arcareon.fi with questions about statistics or consent-based processing.
9. Data security
Data is protected with appropriate technical and organisational measures. Access to systems is restricted, connections are protected and access rights are managed according to work duties.
10. Rights of the data subject
Subject to the conditions in data-protection law, you may request access, correction, erasure, restriction of processing or a portable copy of data processed automatically on the basis of consent or a contract. You may object to processing based on legitimate interests and to direct marketing, and withdraw consent where it is the legal basis. Legal obligations or the establishment, exercise or defence of legal claims may limit deletion. You may lodge a complaint with the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi/en/home). Delivery-price calculation is not a creditworthiness or eligibility decision.
11. Exercising your rights
Send your request to info@arcareon.fi. Please state which right you wish to exercise and provide enough information to identify the relevant account or booking. We may request proportionate additional information to verify your identity. We normally respond within one month of receiving a request. If an extension is permitted because of complexity or the number of requests, we will explain it within the first month.
12. Changes to this policy
This policy may be updated when services or legislation change. The current version is published on this page.
Updated 11 October 2026