Privacy policy

Your personal data is processed by Ilvamar Group Oy. Ilvamar Group Oy is the data controller and is responsible for the processing described in this policy.

Please write to us by email. We do not operate a telephone line for data protection enquiries.

We have not appointed a Data Protection Officer. The processing described in this policy does not oblige us to appoint one under Article 37, and Ilia Gamtsemlidze is the contact point for every data protection matter.

We process personal data belonging to:

1. our clients;
2. prospective clients who have contacted us, or whom we have approached;
3. representatives of the organisations we work alongside — partners, subcontractors, design teams, suppliers and authorities;
4. visitors to and users of this website.

We do this in order to run and develop our client relationships and to market our engineering and project management services to organisations. Our services are sold to organisations rather than to consumers, so in nearly every case the data we hold about you is your professional contact information rather than anything private.

We may process and record the following:

• name;
• contact details: email address, telephone number, postal address;
• the organisation you work for;
• your job title or role, and where relevant your professional qualifications or chartered status;
• the content of your enquiries and our correspondence — including any drawing, calculation, specification or brief you send us;
• records of meetings, offers and contracts relating to an engagement;
• areas of interest, and any profiling we derive from them;
• data recorded when you visit this site: the pages requested, the time, your IP address and the approximate location derived from it, where you arrived from, and what your browser reports about itself. This is recorded by our host in order to serve and protect the site, and it happens whether or not you allow cookies. Section 11 explains it;
• whether you have asked us not to contact you about our services;
• anything else needed for the purposes set out in section 05.

Material you send us with an enquiry is treated as confidential technical information belonging to your organisation, not as our own. It reaches us by email and stays in our Google Workspace mailbox and file storage. Only the people working on your enquiry can open it, and if no engagement follows it is deleted together with the enquiry, 12 months after our last contact with you.

We do not ask for and do not want special category data under Article 9, and we do not collect personal identity codes.

We obtain personal data:

• from you, or from the organisation you represent;
• in the course of an enquiry, an engagement or the conclusion of a contract;
• from the Finnish Business Information System (YTJ) and the Trade Register;
• from public sources such as your organisation’s website, professional networks and published tender notices.

We do not run credit checks on prospective clients, and we do not buy data from credit information registers.

We process and store your personal data in order to:

• enter into, manage, maintain and develop client relationships;
• deliver the engineering and project management work we have been engaged to do, and communicate with you about it;
• answer enquiries and tell you whether we are the right engineers for a piece of work;
• tell organisations about our services, where we believe the work is relevant to them;
• produce statistics and analysis, and use them to develop our services;
• meet our own legal and professional obligations.

We do not run marketing campaigns and we do not send bulk marketing messages, newsletters or mailshots. Where we contact an organisation about our services, it is an individual approach from a named person.

Legal basis

• Performance of a contract — Article 6(1)(b), where the processing is needed to agree or carry out an engagement.
• Legitimate interests — Article 6(1)(f), for client relationship management and for approaching organisations about work we believe is relevant to them. We have weighed this against your interests and consider it proportionate, because the data is professional contact information and the contact is individual rather than a campaign. You can object at any time.
• Consent — Article 6(1)(a), for non-essential cookies. You can withdraw consent at any time.
• Legal obligation — Article 6(1)(c), for accounting and other statutory records.

We keep your data for as long as it is needed for the purpose it was collected for, and no longer.

• Enquiries that do not lead to an engagement — 12 months from our last contact with you, then deleted.
• Client relationship and contract data — 10 years from the end of the engagement. This matches the outer limit within which a claim about the work could still be brought against us.
• Project and technical records — designs, calculations, reviews and safety cases are kept for 10 years from handover, for the same reason. Where a nuclear or construction regulator imposes a longer duty, that longer period governs.
• Accounting records — as the Finnish Accounting Act requires: vouchers for 6 years and accounting books for 10 years, in both cases from the end of the financial year they belong to.
• Contact records for organisations we have approached — until you object, and in any case reviewed every 24 months so that contacts we have had no interaction with are removed.
• Website request logs and visitor statistics — kept by our host for a limited period under our hosting plan. We do not export them or combine them with anything else. Your cookie choice is remembered for 12 months, after which we ask again.

We delete your data on request, or when it is no longer needed for any of the purposes above.

You may tell us at any time to stop contacting you about our services. Write to ilia@ilvamar.com and we will stop.

You have the rights set out below. To exercise any of them, write to ilia@ilvamar.com and tell us what you want and which data it concerns.

We may ask you for enough information to confirm who you are, so that we do not disclose your data to somebody else. We will not ask for more than is necessary for that, and we will reply within one month. If your request is complex and we need longer, we will tell you why within that month.

Access and rectification

You have the right to know what personal data we hold about you and to receive a copy of it. If any of it is wrong or incomplete, you can ask us to correct or complete it.

Erasure

You can ask us to delete data we no longer need. We will either delete it or explain why we are keeping it — for example, where a retention duty in section 06 applies.

Restriction and objection

You can ask us to restrict processing while a dispute about accuracy or lawfulness is resolved, and you can object to processing we carry out on the basis of legitimate interests.

Direct marketing

You can tell us to stop using your data to contact you about our services, at any time and for any reason, and we will stop. We do not sell your data, and we do not pass it to anyone else so that they can market to you.

Data portability

Where we process your data by automated means on the basis of consent or a contract, you can ask to receive it in a structured, commonly used, machine-readable format.

Withdrawing consent

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already took place while the consent was valid.

Complaints

If you believe we are handling your data unlawfully, you can lodge a complaint with the supervisory authority. In Finland this is the Office of the Data Protection Ombudsman, tietosuoja.fi. You may also complain to the authority in the EU country where you live or work. We would rather you came to us first, but you do not have to.

Ilvamar Group Oy is a single company with no subsidiaries, and as a rule we do not disclose your data to anyone outside it without your permission. We may, however, pass it to:

• you, or the organisation you represent;
• service providers who process data on our behalf, under a written data processing agreement, in order to run our correspondence, our files and this website;
• our professional advisers, where needed to establish or defend a claim;
• authorities, where the law requires it — which in regulated nuclear and construction work can include a regulator or a client’s auditor.

Where a service provider processes data for us, ownership of the data does not pass to them and they have no right to use it for any purpose other than the assignment agreed with Ilvamar Group Oy. We satisfy ourselves that each provider complies with data protection law before we use them.

We keep our own tooling deliberately small. These are the providers who process personal data on our behalf:

Each of these is engaged under a written data processing agreement: Google’s Cloud Data Processing Addendum, accepted for our Google Workspace business plan; Netlify’s Data Processing Agreement, which forms part of its terms and is pre-signed by Netlify; and Squarespace’s Data Processing Addendum, which forms part of its terms of service.

The provider that holds most of our data is established inside the European Economic Area: Google Ireland Limited, for email and files. Google may pass personal data on to Google LLC in the United States in order to run those services.

This website is different. It is hosted by Netlify, Inc., which is established in the United States, so the request logs and visitor statistics described in section 11 are processed there directly rather than being sent on by an EEA company. Our domain registrar, Squarespace Ireland Limited, is inside the EEA and uses Squarespace, Inc. in the United States as a sub-processor.

Those transfers rest on:

• Standard Contractual Clauses approved by the European Commission in Decision 2021/914. These are incorporated into Google’s data processing terms, into Netlify’s Data Processing Agreement, where Netlify has pre-signed them as the data importer, and into Squarespace’s Data Processing Addendum. They apply to every transfer described above and are the basis we rely on first.
• The EU–US Data Privacy Framework, relied on as a second basis for the Google transfer. The European Commission’s adequacy decision of 10 July 2023 is in force, and Google LLC’s certification under it was active when we last checked the Data Privacy Framework list on 7 September 2026.

Engagements outside the EEA

We work worldwide. Where an engagement is for a client outside the European Economic Area, carrying it out means corresponding with that client and with the design teams, contractors and authorities they nominate, in their country. Names, roles and contact details travel with that correspondence, as does the technical material the work produces.

Those transfers are necessary in order to perform the engagement, and we make them only to the extent the work requires. We do not transfer personal data to any other recipient in a third country, and we do not transfer it for any purpose of our own.

We process your data in line with good practice, and we require the same of the providers who process it for us.

• Access is granted only to those people whose work requires it, and to the administrators who maintain the systems.
• Every provider that processes data for us is engaged under a written agreement covering the operational, administrative, physical and technical measures they must apply.
• Systems holding personal data are protected by firewalls and by protection against malware and intrusion.
• Our providers keep records of their processing operations and restrict access to staff who are authorised, trained and have a specific need.
• Our data is held separately from other customers’ data and is backed up regularly.
• Administrative and end-user connections are made only over encrypted connections.
• Client technical material is handled as confidential and is not used outside the engagement it was supplied for.

Because our email and files sit in Google Workspace, the practical controls there matter most. Two-step verification is enforced on every account, accounts are named rather than shared, and sharing of client material is restricted to named recipients rather than open links.

We use cookies and online forms on this site in order to make it work, to improve what we publish, and to understand how the site is used. We use as little of both as we can.

Cookies

A cookie is a small text file that a site asks your browser to store. Cookies cannot damage your computer or your files. This site is deliberately light on them: at present the only cookie it sets is the one that remembers the choice you make about cookies. Anything beyond that would be set only if you allow it.

You can change your choice whenever you like:

Cookie settings

Hosting

This site is hosted by Netlify, Inc. Netlify serves the pages and, as any web server does, records each request made to them: the page asked for, the time, your IP address, the approximate location derived from it, where you arrived from, and what your browser reports about itself. That happens whether or not you allow cookies, because it is how the site is served, kept available and protected against abuse. We rely on our legitimate interest in running a working, secure website for it.

The domain name ilvamar.com is registered through Squarespace, which also holds its DNS records. That service points the name at the site. It does not serve the pages and does not receive anything you send us.

The enquiry link on this site opens a message in your own email program, addressed to us. There is no web form, so nothing you type is submitted to or stored by this website; your message goes from your email program to our Google Workspace mailbox.

Managing cookies in your browser

Most browsers also let you manage cookies directly — refusing them all, accepting or rejecting them one at a time, or deleting cookies already stored. Please note that refusing cookies may stop some parts of this site from working.

Analytics

Our visitor statistics come from Netlify, and they are produced entirely from the server logs described above. No JavaScript runs in your browser to gather them and no cookie is set for them. They tell us how many pages were viewed, roughly how many distinct visitors there were, which pages were read, which links brought people here, and which addresses returned an error.

We do not use Google Analytics or any other third-party analytics service, we run no advertising or tracking pixels, and we build no advertising audiences. The statistics are aggregated and are not linked to your name or to the content of an enquiry.

Write to Ilia Gamtsemlidze at ilia@ilvamar.com. If we change this policy we will update the date at the top of the page.