Privacy policy

1. Data controller

Innosus Oy (trading as Onelab)

Business ID: 3105686-7

Ukkohauentie 11–13 A, 02170 Espoo

Email: info@onelab.fi

Telephone: +358 45 784 111 11

2. Contact person for matters concerning the register

In data protection matters, please contact us by email at info@onelab.fi. We answer enquiries as a rule within one month.

3. Personal data processed

In order to provide our services, we process the following personal data:

• Contact details - name, email address, telephone number, address and postal code.
• Order details - sample type, description of the sampling, time of the order and price.
• Sample metadata - sampling location, material information and order number. The physical sample itself contains no personal data.
• Analysis results and reports - the results of the asbestos analysis, the reports and their delivery details.
• Customer communications - messages sent through the contact form and email correspondence.
• Usage data - IP address, browser type, pages visited and the times of the visits.
• Payment details - payment methods and reference information for payment transactions. Card details are not stored in our own systems; payment transactions are handled through Stripe.

4. Purposes of the processing and legal basis

We process personal data for the following purposes:

• Performance of a contract (GDPR Art. 6(1)(b)) - carrying out the asbestos analysis, reporting the results and delivering the order.
• Statutory obligations (GDPR Art. 6(1)(c)) - the Accounting Act, the VAT Act and the regulation concerning asbestos analysis (including documentation of the methods used under the ISO 22262-1 standard, Government Decree 798/2015).
• Legitimate interest (GDPR Art. 6(1)(f)) - customer service, development of the services, prevention of misuse and statistics.
• Consent (GDPR Art. 6(1)(a)) - marketing communications and the use of non-essential cookies.

5. Sources of data

Personal data is as a rule collected from the data subject themselves in connection with the order form, the contact form, email or a telephone conversation. Website usage data is collected automatically when the data subject visits the site. Some orders reach Onelab through a partner (e.g. Asbestipro), in which case the customer has given the data to the partner.

6. Disclosure and transfer of data

Personal data is disclosed only to parties that are necessary for providing the service:

• Asbestipro (Suomen Asbestipro Oy) - survey partner; we receive sample analysis orders from them and return the analysis reports to the contact person named in the order.
• Stripe Payments Europe, Ltd. - processing of online payments.
• Resend - sending service emails (order confirmations, analysis reports).
• Vercel Inc. - website hosting and content delivery service.
• Supabase - backend database and authentication service (servers within the EU).
• Posti Group Oyj - postal delivery of samples to the laboratory and delivery of reports by email.
• Google Analytics - website usage analytics (anonymised IP address).
• PostHog - website usage analytics and, with consent, session recordings (EU servers, anonymised IP address).
• Authorities - where required by law.

Some service providers (e.g. Stripe, Resend, Google) may process data outside the EU/EEA. In these situations we safeguard the data with standard contractual clauses (SCC) approved by the European Commission or with equivalent arrangements.

7. Retention period

Personal data is retained only for as long as is necessary for the purposes of the processing:

• Customer and order data - 6 years from the end of the financial period, as required by the Accounting Act.
• Analysis reports and their metadata - 10 years in accordance with the statutory retention obligation.
• Physical samples - destroyed after the analysis is completed in accordance with the instructions; the retention period is a maximum of 12 months where separately agreed.
• Contact form messages - a maximum of 24 months.
• Data based on marketing consent - until the consent is withdrawn.
• Technical website logs - a maximum of 12 months.

8. Protection of the register

Personal data is protected by appropriate technical and organisational measures: access control, strong authentication, encrypted connections (HTTPS) and encrypted database connections, regular backups, and access to personal data only for those persons whose duties require it. The laboratory’s internal sample chains and reporting take place in a separate Labbmate system, access to which is restricted to authorised laboratory personnel.

9. Rights of the data subject

You have the rights provided under the EU General Data Protection Regulation:

• Right of access - you can request a copy of the personal data stored about you.
• Right to rectification - you can request the correction of inaccurate or incomplete data.
• Right to erasure - you can request the deletion of your data if there is no lawful basis for retaining it.
• Right to restriction of processing - you can request the restriction of the processing in certain situations.
• Right to object - you can object to the processing, for example for direct marketing.
• Right to data portability - you can request the transfer of your data in a machine-readable format.
• Right to withdraw consent - if the processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint - you can lodge a complaint with the Office of the Data Protection Ombudsman: tietosuoja.fi.

Rights are exercised by sending a request to info@onelab.fi. Where necessary, we will ask you to verify your identity.

10. Cookies

We use cookies on the site to support functionality, analytics and, where necessary, marketing. Cookies are divided into categories:

• Essential cookies - basic functions of the site, such as session management.
• Analytics cookies - anonymised measurement of site usage (e.g. Google Analytics).
• Marketing cookies - used only with your consent.

You can manage cookie settings in your browser settings. Blocking essential cookies may impair the functioning of the site.

If you decline analytics cookies or make no choice, we still count page visits and site events anonymously, without cookies and without storing anything on your device. This uses a daily-rotating hash generated on PostHog’s servers in the EU, which cannot be used to identify you. Session recordings and analytics cookies are only used if you accept them.

11. Changes to this policy

We update this privacy policy as necessary when legislation or our services change. Material changes are announced on the site and, where necessary, communicated directly to the data subjects.