Who controls your personal data
Keski-Suomen Otto ja Pano Oy (Business ID 2376890-1), trading as ERPDataArchive, is the controller of personal data described in this policy.
Sepänkatu 1
40100 Jyväskylä
Finland
Email: privacy@erpdataarchive.com
Personal data we collect
When you contact us or request an assessment
We collect your name, work email, company, role, message, and the GP environment details you choose to provide. If you send us an assessment review file, it may contain company and module names, table names, counts, date ranges, sizes, detected products and finding categories.
When your organisation buys or uses the product
We collect business contact, billing, order, licence, support and refund information. Our payment provider processes card or bank details; we do not receive the full card number. Support messages may include technical logs or other information you choose to send.
When you visit the website
Our hosting provider receives ordinary request data such as IP address, browser information, requested page, time and security events. Your browser requests the site's typefaces from Google Fonts, which gives Google your IP address and ordinary request details. If you accept analytics cookies, Google Analytics also receives online identifiers and information about how you use the site. See our Cookie Policy.
Why we use data and our legal bases
- To respond, provide assessments, fulfil orders, issue licences, deliver support and process refunds: taking steps at your request and performing our contract with your organisation.
- To manage customer relationships, improve the service, prevent fraud, secure the website and establish or defend legal claims: our legitimate interests in operating and protecting a B2B software business. We balance those interests against your rights.
- To maintain invoices, tax records and other required records: compliance with legal obligations.
- To deliver the site's typefaces through Google Fonts: our legitimate interest in presenting a consistent, readable website.
- To measure website use with Google Analytics: your consent. Refusing analytics does not affect access to the site, and you can change your choice at any time.
- To send optional product news or marketing: consent where required, or our legitimate interests for limited, relevant B2B communications where permitted. Every marketing message offers an opt-out.
You normally provide data directly. We may also receive order data from our payment provider, business contact data from your employer or colleague, and technical data automatically from your browser. You are not required by law to provide personal data, but we cannot respond to a request or fulfil an order without the information needed for it. We do not use personal data for solely automated decisions with legal or similarly significant effects.
What stays in your environment
The Assessment and Archive applications connect to the GP SQL Server you specify and write results to a location you choose. They do not automatically send us GP records, reports, usage data, query history or crash reports. Your archive remains on hardware and storage you control; we do not have a copy or remote access.
Please do not send us SQL backups, archive files, exported transactions, credentials, or personal data from your GP system unless we have expressly agreed a secure support process in writing. You decide what to send to support and should remove information that is not needed.
Who receives data and international transfers
We disclose data only as needed to providers that help us host the site, provide email and support, process payments, schedule meetings, measure consented analytics, maintain business records, or provide professional advice. We may also disclose data where required by law, to protect legal rights, or in connection with a merger, financing or sale of the business.
These providers act under their own privacy terms or contractual data-processing duties, depending on their role. We do not sell personal data.
Some providers, including Google and payment or communications providers, may process data outside the European Economic Area. Where required, we use an adequacy decision, the European Commission's Standard Contractual Clauses with appropriate safeguards, or another lawful transfer mechanism. You may contact us for information about the relevant safeguards.
How long we keep data
- Assessment requests and review files: up to 24 months after the last substantive contact.
- Unsuccessful sales enquiries: generally up to 24 months after the last substantive contact.
- Customer, licence and support records: for the customer relationship and normally up to 6 years afterward, unless a longer period is needed for a claim or legal obligation.
- Invoices and accounting records: for the period required by applicable accounting and tax law.
- Analytics data: according to our Google Analytics retention setting, no longer than 14 months; analytics cookies may remain for up to 2 years unless you withdraw consent or delete them sooner.
- Security logs and backups: only as long as reasonably necessary for security, continuity and investigation, after which they are deleted or overwritten.
We may retain limited data longer where needed to comply with law, resolve a dispute or enforce an agreement. We delete or anonymise data when it is no longer needed.
Your data protection rights
Subject to applicable law, you may ask us to:
- give you access to and a copy of your personal data;
- correct inaccurate or incomplete data;
- delete data or restrict how we use it;
- provide data you gave us in a portable format;
- stop processing based on legitimate interests, including direct marketing; or
- withdraw consent at any time, without affecting earlier lawful processing.
These rights can have legal exceptions. We may need to verify your identity before acting. We do not charge for ordinary requests, but may charge or refuse requests that are manifestly unfounded or excessive where the law permits.
Security
We use appropriate technical and organisational measures intended to protect the personal data we control. No method of storage or transmission is completely secure. The product's local-data design and customer responsibilities are explained on our Security page.
Questions, requests and complaints
Contact privacy@erpdataarchive.com or write to the address above. You also have the right to complain to the Office of the Data Protection Ombudsman of Finland, or to the supervisory authority where you live or work.
We may update this policy when our practices or legal duties change. We will post the new version here and change the effective date. If a change materially affects how we use existing data, we will provide additional notice where required.