Privacy

Controller

Origodesign Oy, business ID 0799689-1. Postal address c/o Riitta Kirjalainen, Sammonsilta 5 A 24, 02100 Espoo, Finland. Email erkki@origodesign.fi. Phone +358 44 508 2114.

Privacy requests go to the same email. A data protection officer has not been appointed.

What this covers

This notice meets the duty to inform in Article 13 of the EU General Data Protection Regulation. Cookies and similar storage are covered by section 205 of the Finnish Act on Electronic Communications Services (917/2014). The Supreme Administrative Court decision KHO 2026:65 requires that non-essential cookies can be refused as easily as they are accepted.

The site works if you refuse analytics. Refusal does not close the content, and nothing non-essential is pre-ticked.

What is processed

• Delivering the page. The server logs technical connection data: IP address, time, requested page, and browser type. This is needed to show the site and to limit abuse. It is not used for advertising. The legal basis is legitimate interest (GDPR Article 6(1)(f)).
• Language. If you choose FI or EN, the choice is stored only in your browser (localStorage, key origo-lang) so the same language is there when you return. It is written only after you choose, and it is not sent to us. The basis is the exemption in AECS section 205: the storage is necessary to keep a language you specifically requested.
• The cookie choice. Acceptance or refusal is stored in your browser for 12 months (localStorage and the cookie origo-consent, version 2026-10-06). That way the question is not asked on every page, and analytics does not start without consent. The record is necessary in order to remember the choice. When the version changes, or 12 months pass, we ask again.
• Analytics, only with consent. The Google tag (ID G-434CEB75J8) is in the page so the installation can be verified. Until you accept, analytics storage is denied: no analytics cookies are written and the visit is not measured. If you accept, Google Analytics 4 starts and sets the cookies _ga and _ga_434CEB75J8. They distinguish browsers and show which pages are used. Advertising features and Google signals are switched off. The legal basis is consent (GDPR Article 6(1)(a) and AECS section 205). You can withdraw it from Cookies in the footer. Withdrawal stops new measurement requests and tries to delete analytics cookies already set.
• Email and phone. If you write or call, the message is used to reply and, if it becomes an assignment, to do the work. Accounting material is kept as the Finnish Accounting Act requires, generally six years after the end of the financial year. The legal basis is a contract or steps before a contract (Article 6(1)(b)) and a legal obligation (Article 6(1)(c)).

What we do not do

We do not sell data, show third-party ads, or make automated decisions or advertising profiles. The site is not aimed at children, and we do not knowingly collect children’s data. There are no embedded video players that would set cookies before you open a link to YouTube, LinkedIn, or kirjalainen.com.

Recipients and transfers

The site is delivered by the host Vercel, Inc., which processes connection logs in order to serve and protect the site. Analytics, if you accept it, is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the United States may process the measurement data.

Data may be processed outside the EU and the EEA. Transfers are protected by the European Commission’s standard contractual clauses and, where the recipient is certified, by the EU–US Data Privacy Framework. Google LLC is certified under that framework. We do not pass data to anyone else unless the law requires it.

Retention

• The language choice stays until you clear site data in the browser.
• The cookie choice stays for 12 months, or until the version of this notice changes.
• Analytics cookies last at most two years. Measurement stops when you withdraw consent.
• Server logs stay for the host’s ordinary limited period. They are not turned into a customer register.
• Client messages stay for as long as the matter needs. Accounting material stays for the period the law requires.

Your rights

You can ask for access, rectification, or erasure, ask us to restrict processing, object to processing based on legitimate interest, and receive data you provided where processing is based on a contract or consent and is carried out by automated means. You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Write to erkki@origodesign.fi. We reply within one month. If a request is unusually broad, the period can be extended by two months, and we will tell you.

Complaint

You can complain to the Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, Finland, tietosuoja.fi. If you live elsewhere in the EU or the EEA, you can also complain to the supervisory authority in your own country.

Changes

If the purpose of the processing changes, we update this page. If the change concerns cookies, we ask for consent again.

Cookies and local storage

Necessary storage cannot be switched off, because the site needs it to remember language and consent. Analytics is off unless you accept it.

• origo-consentNecessary · Origodesign, cookie and localStorage · 12 months

  Remembers whether you accepted or refused analytics.

• origo-langNecessary · Origodesign, localStorage only · Until you clear site data

  Remembers FI or EN after you choose it.

• _gaOnly if you accept · Google · 2 years

  Distinguishes browsers for visit statistics.

• _ga_434CEB75J8Only if you accept · Google · 2 years

  Keeps analytics state for this site.