KuviqSuomeksi
← Home

Privacy policy

How personal data is processed on the Kuviq website (kuviq.io) — what is collected, who processes it, and what your rights are.

Controller

The controller is Indoor Active Oy (business ID 3141938-1, VAT ID FI31419381), c/o Kummelipolku 5a, 02330 Espoo. The website kuviq.io is operated by the same company.

For privacy matters you can contact us at hello@kuviq.io. No formal data protection officer is appointed; the email address above is the contact point for data-subject requests (such as access and deletion).

What this statement covers

This statement covers personal data processed when you visit the website, send the contact or demo-request form, or accept cookies. Details of individual cookies are available from the “Cookie settings” button on the page — this statement describes the processing as a whole, not each cookie.

This statement covers the marketing website only. Processing of personal data inside the Kuviq inspection application is governed separately by the customer agreement and its data processing agreement (DPA) and is not described here.

Consent and cookies

The site uses the Klaro consent tool. Analytics cookies are denied by default until you give consent. Your choice is stored in the ae_consent cookie, which lasts 365 days; you can change or withdraw it at any time from the “Cookie settings” button.

Your consent state is signalled to Google’s tools via Consent Mode v2 (analytics_storage, ad_storage, ad_user_data and ad_personalization). When you decline cookies, these signals remain denied.

Analytics

The site uses a Google Tag Manager container (GTM-M79HZ4H3) to manage measurement tools. When you consent, the container may load Google Analytics 4, which helps us understand how the site is used.

If you do not consent, Google Analytics receives at most cookieless event data carrying a signal that consent was withheld; it contains no persistent identifier, so you cannot be recognised between visits.

When you consent to marketing, the GTM container may load advertising measurement and targeting tools: Google Ads, Meta (Facebook and Instagram) and TikTok. These release Google’s advertising signals in Consent Mode (ad_storage, ad_user_data, ad_personalization) and may set advertising identifiers that can recognise you across visits. The site does not pass your name, email address or phone number to these services.

What data is processed

Analytics does not collect your name or email address. It does, however, process identifiers — such as cookie and client IDs and your IP address — which are personal data under the GDPR. This is therefore not “no personal data”.

Contact and demo-request form

When you send the form, we process the details you provide: name, email address, company name and message. The purpose is to respond to your enquiry and manage any customer relationship arising from it; the basis is our legitimate interest and steps taken to enter into a contract.

The form is delivered as an email to our inbox via the Brevo (Sendinblue) email API. Brevo is used here only to send the email — it does not store your message in its own system. The email includes the details you entered in the form and your IP address, for abuse prevention.

Contact messages are retained in the inbox for 12 months, after which they are deleted.

Technical implementation of the site

The site is hosted on Cloudflare (Cloudflare Pages), and the form is processed in a Cloudflare server function. Cloudflare processes technical data (such as IP addresses) to deliver the site and to handle the form request.

Recipients and data transfers

We use the following service providers as processors. Some may transfer data outside the European Economic Area (EEA) under their own transfer basis:

  • Google Ireland Limited / Google LLC — site analytics (Google Analytics 4) and advertising (Google Ads) via Google Tag Manager — EU–US Data Privacy Framework (DPF), verified 25 Aug 2026.
  • Meta Platforms Ireland Limited / Meta Platforms, Inc. — advertising measurement and targeting — EU–US Data Privacy Framework (DPF), verified 25 Aug 2026.
  • TikTok Technology Limited (Ireland), 10 Earlsfort Terrace, Dublin D02 T380 — advertising measurement and targeting — EU standard contractual clauses (SCC, Article 46 GDPR), verified 25 Aug 2026. For the EEA, UK and Switzerland, TikTok Technology Limited and TikTok Information Technologies UK Limited act as joint controllers.
  • Cloudflare, Inc. — technical delivery of the site and processing of the form request — EU–US Data Privacy Framework (DPF).
  • Brevo (Sendinblue SAS, France) — sending the contact-form email — EU–US Data Privacy Framework (DPF); although Brevo is French, the processing chain includes a US sub-processor.

Where no Commission adequacy decision applies to a provider, the transfer relies on the European Commission’s standard contractual clauses or another basis under Chapter V of the GDPR. The transfer bases were verified on 25 Aug 2026.

Your rights

You have the right to: access the personal data concerning you, request rectification, request erasure, and object to processing. You can also withdraw your cookie consent at any time from the cookie settings.

If you consider that the processing of your personal data is unlawful, you have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

Privacy requests: hello@kuviq.io. No formal data protection officer is appointed; this is the primary contact point for access and deletion requests.

Changes to this statement

We may update this privacy statement as the site’s features or processing change. We will announce significant changes on the site.

Updated: 7 September 2026