Privacy Policy

We collect very little, and almost all of it is information you type into a form yourself.

If you use the contact form on our About page, we collect the entity type you select, the type of enquiry, your name, your company or organization, your email address, your phone number if you choose to give it, your country and city, and the content of your message. We use this to understand who is contacting us, to route your message to the right person on our team, and to reply to you. Where you are asking about a pilot, partnership or commercial relationship, we process this data because it is necessary to take steps at your request before entering into a contract, under Article 6(1)(b) of the GDPR. Where your message is a general enquiry, we rely on our legitimate interest in responding to people who contact us and in developing our business, under Article 6(1)(f).

If you join our waitlist, we collect your email address and any other field the signup form asks for at the time. We use this to tell you when ELSSSE opens in your city and to send occasional updates about the launch. We do this on the basis of your consent, under Article 6(1)(a), and you can withdraw that consent at any time by using the unsubscribe link in any message we send or by emailing hello@elssse.com. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

If you email us directly at hello@elssse.com, partners@elssse.com, press@elssse.com or a named team member's address, we process the contents of that email and your contact details in order to reply, on the basis of our legitimate interest in handling correspondence.

When you simply visit the site, our hosting provider and our analytics tool process technical information such as your IP address, the pages you view, the approximate time of the visit, your device type, browser and referring page. We use this in aggregate to understand how the site is used and to keep it secure and working. We rely on our legitimate interest in operating and improving a functioning website, under Article 6(1)(f), and we have assessed that this is a limited and expected form of processing that does not override your interests. [Confirm with your provider whether the analytics used on this site sets cookies or any similar identifier on your device. If it does, this section must be changed to a consent basis and a cookie banner must be added before the tool loads.]

If our analytics is cookieless and we set no non-essential cookies, the position is this. We do not use cookies for advertising, profiling or cross-site tracking. We may use strictly necessary storage to make the site function, for example to remember your language choice, and this does not require your consent under Section 205 of the Finnish Act on Electronic Communications Services.

If we do set any cookie or store any identifier that is not strictly necessary, we will ask for your consent through a banner before doing so, we will not treat continued browsing as consent, and refusing will be as easy as accepting. You will be able to change or withdraw that choice at any time from the same banner.

We do not sell personal data, we do not share it with advertisers, and we do not use it to build profiles for marketing by third parties.

We do use a small number of service providers who process data on our behalf under written data processing agreements. These are our website hosting and deployment platform, our email and productivity provider, Each of them may access personal data only to the extent needed to deliver their service to us and on our documented instructions.

We may also disclose personal data where we are legally required to do so, for example in response to a lawful request from a public authority or a court, or where it is necessary to establish, exercise or defend legal claims. If our business or a part of it is ever sold, merged or reorganized, personal data may transfer to the acquiring entity, and we will inform you if that happens.

We are based in Finland and we prefer providers who store data inside the European Economic Area. Some of the providers named above may process data in the United States or elsewhere outside the EEA. Where that happens, the transfer is protected either by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses together with any supplementary measures that are appropriate. You can ask us for a copy of the relevant safeguards by writing to hello@elssse.com.

We keep contact form submissions and email correspondence for as long as we are dealing with your enquiry and then for 24 months from our last contact with you, so that we have context if you get back in touch. Where an enquiry leads to a contract, we keep the related records for as long as the relationship lasts and then for the period required by Finnish accounting and tax law, which is generally six years from the end of the accounting year. Waitlist entries are kept until you unsubscribe, or until 24 months after ELSSSE launches in your area if you never activate an account, whichever comes first. Aggregated analytics data that no longer identifies anyone is kept without a fixed limit. When a retention period ends we delete the data or irreversibly anonymize it.

Under the GDPR you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, and to have data erased where there is no longer a good reason for us to keep it. You can ask us to restrict how we use your data while a dispute about it is resolved, and you can object to processing that we carry out on the basis of legitimate interest, in which case we will stop unless we can demonstrate compelling grounds that override your interests. Where we process data on the basis of your consent or a contract by automated means, you can ask us to provide it in a portable machine readable format or to send it to another controller. You can withdraw consent at any time, and you can object to direct marketing at any time with no need to give a reason, after which we will stop immediately.

To exercise any of these rights, write to hello@elssse.com. We will respond within one month, and we will tell you if we need longer because the request is complex. We may need to verify your identity first, and we will only ask for what is necessary to do that. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If you think we have handled your data badly, we would like the chance to fix it, so please contact us first. You also have the right to complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman, at Lintulahdenkuja 4, 00530 Helsinki,

We use encryption in transit across the whole site, we limit access to personal data to the people on our team who need it, and we choose providers who maintain recognized security practices. No system is perfectly secure, so we cannot guarantee absolute security, but if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Ombudsman within 72 hours and tell you directly where the law requires it.

This website is aimed at adults and at professionals working for cities, employers, universities and community organizations. It is not directed at children, and we do not knowingly collect data from anyone under the age of 16. If you believe a child has given us personal data, contact us and we will delete it.

We do not make decisions about you that produce legal effects or similarly significant effects using automated processing alone, and we do not profile you for those purposes.

We will update this policy as ELSSSE develops, and in particular before the application launches. When we make a material change we will update the date at the top and, where the change affects processing we carry out on the basis of your consent, we will ask for consent again. Please check back before sending us new information.