Privacy policy

1. Controller

Innosus Oy (operator of Semlab)

Business ID (Finland): 3105686-7

Ukkohauentie 11–13 A, 02170 Espoo, Finland

Email: info@semlab.eu

2. Contact person for matters concerning the register

If you have questions about data protection, please contact us by email at info@semlab.eu. We normally reply within one month.

3. Personal data processed

To provide our services, we process the following personal data:

• Contact details - name, email address, phone number, postal address and postcode.
• Order details - sample type, description of the sampling, time of the order and price.
• Sample metadata - sampling location, material description and order number. The physical sample itself contains no personal data.
• Analysis results and reports - the results of the asbestos analysis, the reports and details of their delivery.
• Customer communication - messages sent via the contact form and email correspondence.
• Usage data - IP address, browser type, pages visited and times of visits.
• Payment details - payment method and payment reference details. Card details are not stored in our own systems; payments are processed by Stripe.

4. Purposes and legal bases of processing

We process personal data for the following purposes:

• Performance of a contract (GDPR Art. 6(1)(b)) - carrying out the asbestos analysis, reporting the results and handling the order.
• Legal obligations (GDPR Art. 6(1)(c)) - the Finnish Accounting Act, the Finnish Value Added Tax Act and the rules on asbestos analysis (including documentation of the method under ISO 22262-1 and Finnish Government Decree 798/2015).
• Legitimate interest (GDPR Art. 6(1)(f)) - customer service, development of the services, prevention of misuse and statistics.
• Consent (GDPR Art. 6(1)(a)) - marketing and the use of non-essential cookies.

5. Sources of data

We normally collect personal data from you directly, through the order form, the contact form, by email or by phone. Data on the use of the website is collected automatically when you visit it. Some orders reach us through a partner; in that case the customer has given the data to the partner.

6. Disclosure and transfer of data

We only disclose personal data to parties that are needed to provide the service:

• Asbestos survey partner in Finland - we receive orders for sample analyses from the partner and send the analysis reports to the contact person named in the order.
• Stripe Payments Europe, Ltd. - processing of online payments.
• Resend - sending of service emails (order confirmations, analysis reports).
• Vercel Inc. - hosting and delivery of the website content.
• Supabase - database and sign-in service for the back-end systems (servers in the EU).
• Posti Group Oyj - postal transport of samples to the laboratory and delivery of reports by email.
• Google Analytics - analysis of website use (anonymised IP address).
• PostHog - analysis of website use and, with your consent, session recordings (servers in the EU, anonymised IP address).
• Authorities - where required by law.

Some service providers (e.g. Stripe, Resend, Google) may process data outside the EU/EEA. In those cases we ensure the protection of the data through the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards.

7. Retention periods

Personal data is only kept for as long as is necessary for the purposes of the processing:

• Customer and order details - 6 years from the end of the financial year, under the Finnish Accounting Act.
• Analysis reports and their metadata - 10 years, due to a statutory retention obligation.
• Physical samples - routinely destroyed once the analysis is complete; kept for at most 12 months by separate agreement.
• Messages sent via the contact form - at most 24 months.
• Data based on marketing consent - until the consent is withdrawn.
• Technical website logs - at most 12 months.

8. Protection of the register

Personal data is protected by appropriate technical and organisational measures: access management, strong authentication, encrypted connections (HTTPS) and encrypted database connections, regular backups, and access to personal data only for people whose tasks require it. The laboratory's internal sample chains and report production run in the separate Labbmate system, which only authorised laboratory staff can access.

9. Your rights

Under the EU General Data Protection Regulation you have the following rights:

• Right of access - you can request a copy of the personal data we hold about you.
• Right to rectification - you can ask for inaccurate or incomplete data to be corrected.
• Right to erasure - you can ask for your data to be erased, unless there is a legal basis for keeping it.
• Right to restriction of processing - in certain cases you can ask for the processing to be restricted.
• Right to object - you can object to the processing, for example for direct marketing.
• Right to data portability - you can ask for your data to be transferred in a machine-readable format.
• Right to withdraw consent - where the processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint - you can lodge a complaint with the data protection supervisory authority of your own EU member state or with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu): tietosuoja.fi.

You exercise your rights by sending a request to info@semlab.eu. If necessary, we will ask you to verify your identity.

10. Cookies

We use cookies on the website for its functions, for analytics and, where applicable, for marketing. Cookies are divided into categories:

• Necessary cookies - basic functions of the website, for example session management.
• Analytics cookies - anonymised measurement of website use (e.g. Google Analytics).
• Marketing cookies - only used with your consent.

You can manage cookie settings in your browser. If you block necessary cookies, the website may not work fully.

If you decline analytics cookies or make no choice, we still count page views and events on the website anonymously, without cookies and without storing anything on your device. This uses a hash that is generated on PostHog's servers in the EU and renewed daily, and which cannot be used to identify you. Session recordings and analytics cookies are only used if you consent.

11. Changes to this policy

We update this privacy policy when necessary, if legislation or our services change. We announce significant changes on the website and, where necessary, directly to the people concerned.