Privacy policy

1.  Introduction

This Privacy Policy describes the principles according to which Ilona IT Oy as a data controller collects and processes personal data relating to users of its online-based service GDPR Software Library EU. There are two main categories of data subjects and users to the service: (1) representatives of software suppliers, who maintain data in the service concerning their software products, and (2) software buyers, who use the service to evaluate software products. Personal information is any information related to an identified or identifiable person, such as a name and email address.

2. Controller and contact details for privacy matters

Ilona IT Oy
Business ID: 2319462-9
Energiakuja 3, 00180 Helsinki

3. What personal data we process, for what purpose and what is the legal basis for the processing

We collect, store and process personal data only for predefined purposes and only on legal grounds. We process personal data mainly for the following purposes and on the following grounds:


Description of the processing

Processed personal data

Providing the GDPR Library EU
and the associated DPIA tool
to its users

We collect, store and process personal data for running our online service

In connection with the provision of our online service, personal data is processed, for example, for (1) concluding a user agreement and accepting the terms of use, (2) creating a user account, (3) identifying the user during use of the service, (4) identifying the users who enter and edit data relating to software products in the service and maintaining a log from all data entries and edits, (5) and communication with the customers and users.


  • Company name (employer)
  • Name of the person
  • Email address
  • Username and password
  • Log history of data entries and edits in the service, mainly: (1) who entered/edited data, (2) entries/edits made, (3) time stamp – this data is collected to ensure reliability of data in the service
  • Customary contact and billing details required for billing and invoicing paid services
  • Customary correspondence with users


Legal basis: Agreement. This processing of personal data is necessary for the creation of a contract and the execution of the concluded contract, such as a user agreement.

Legitimate interest. The aforementioned purpose is also in accordance with our legitimate interest related to the provision of our online-based services, and we consider that based on the relationship or your position between you and our company, it is also processing that you can reasonably expect in connection with the provision of the service and which does not conflict with your fundamental rights and freedoms.

4. From which sources has the personal data been obtained

We receive personal data mainly from the data subject in connection with contacting, registering or using our service. The information may be provided by you or may originate from the use of the service. If we create usernames for several people in the same organization at once, we may receive the information needed to create usernames from one person.

5. With whom do we share personal data

As a general rule, your personal data is processed only by us for the purposes described in this privacy policy. However, we may share personal data with others, especially in the following situations:

  1. Our service providers. We may use external service providers and outsource some processing of personal data. For example, we use third party services providers for website hosting and software development for developing and maintaining the service. The service providers we use may not use personal data for any of their own purposes, but only for our benefit. We always make sure, for example through contracts, that the confidentiality of your data is maintained and that the data is also otherwise processed in accordance with the law. What data our service providers process at any given time is closely related to the task and purpose for which we use the service provider;
  2. Official and other legal reasons. We may also disclose information when required by law, a court or a competent authority, to respond to a legal claim or to prepare one;
  3. Corporate and business arrangements. We may also disclose information if we were involved in a merger, business transaction or other reorganization of our business; and
  4. Consent of the data subject. We may also disclose information if the person has given their consent to the disclosure of information.

6. International transfers of personal data

Personal data is primarily processed within the EU/EEA area only. Personal data may, however, be transferred outside the EU/EEA especially if a services provider we use is located outside the EU/EEA.

If personal data were to be transferred outside the EU/EEA to a country that is not included in the EU Commission's decision on an adequate level of data protection, we will make sure that the processing, transfer and storage of your data is carried out on the grounds required by law and with adequate protection mechanisms, such as using the standard contract clauses confirmed by the EU Commission. The standard contract clauses can be found here (part of the text is in English): The standard contractual clauses have different modules for different situations, most likely we would apply modules 1 (controller-controller) or 2 (controller-processor), depending on the situation.

7. Personal data retention periods

We do not store personal data for longer than is necessary for the purpose of their use or as required by contract or law. Personal data can also be deleted in the situation when the data subject withdraws his/her consent or requests the deletion of his/her data (and there is no other legal basis for the processing). Data retention periods can also be governed by legislation (e.g. accounting law, export control, customs handling, tax laws) and the expiration of deadlines related to presenting legal claims (e.g. statutes of limitations).

The necessary storage time can vary, but typically it can mean a few years. Information that is necessary for defending against legal claims may have to be stored for up to 10 years. Accounting documentation is typically kept for 6-10 years.

We store online behavior data collected with cookies and other similar technologies as described in the cookie statement produced by our cookie tool. The cookie statement is available on our website.

8. Your rights

You have the following rights in relation to your personal data:

Updating your own information

In case you are a registered customer in our online service, you may have certain limited possibilities to check and update your profile data by accessing your account in the service.

The right to access personal data

You have the right to receive confirmation from us as to whether we are processing personal data concerning you and to know what personal data concerning you we are processing (e.g. a copy of the data). In addition, you have the right to receive additional information about the basis of the processing of your personal data. However, the right to access personal data can be restricted based on legislation, the protection of privacy of other persons and the protection of business secrets.

The right to correct data

You have the right to have your incomplete, incorrect or outdated personal data supplemented or corrected.

The right to delete data

You have the right to request the deletion of your personal data. Your data will be deleted if there is no longer a legal basis for processing personal data.

The right to restrict processing

You may have the right to restrict the processing of your personal data. In this case, the controller generally does not process personal data other than by storing the data. You may have this right, for example, when you dispute the accuracy of your personal data, if the processing is against the law, or if you have objected to the processing of your personal data and are waiting for a response to the request for action in question.

Right to object

If we process your personal data based on our legitimate interest, you have the right to object to such processing based on your personal reasons.

The right to transfer data from one system to another

If we have processed your data on the basis of your consent or to fulfill a contract and the processing has taken place automatically, you have the right to receive the data you have provided us electronically in a commonly used machine-readable format so that the data can be transferred to another data controller.

Withdrawal of consent

If the processing of personal data is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the legality of the processing of personal data that took place before the withdrawal. The processing of your personal data is based on consent, for example when you have given permission for electronic direct marketing by subscribing to our newsletter. The processing of non-essential cookies on our website is also based on your consent. You can manage the cookie consents you have given yourself using the cookie tool on our website.

The right to prohibit direct marketing

You always have the right to object to the processing of your personal data for direct marketing purposes and the right to withdraw any consent you may have given for marketing purposes.

9. How you can exercise your rights

You can exercise your rights described above by contacting us, for example, by using the contact information provided in Section 2 of this statement. The use of your rights is basically free of charge for you. If you submit a request electronically, we will deliver the information electronically as far as possible, unless you request otherwise. If necessary, we may ask you to verify your identity or specify your request. You can easily prohibit email marketing, for example, by clicking the link in the header or footer of any email marketing message or by replying to the message if it was sent from a personal address. You can manage consents regarding cookies yourself directly with the cookie management tool on our website.

10. Complaint to the supervisory authority

If you believe that we do not process your personal data in accordance with this privacy statement or the applicable national and European Union data protection legislation, you can file a complaint with the supervisory authority if you wish. In Finland, the authority in question is the office of the Data Protection Commissioner (homepage:

11. Security

Personal data in electronic form is stored on servers that are protected by technical means in accordance with the general practices of the industry. The personal data we collect and process are confidential, and we do not disclose it to anyone other than those who need the information in their work or, in accordance with this privacy statement, to our partners or other recipients.

12. Cookies

We use cookies on our website so that we can offer the best possible user experience to the website visitor. Cookies are short text files that the web server stores on the user's terminal device. Cookies give us information about how users use our website. We may use cookies to develop our website, to analyze website usage, and to target and optimize marketing. Non-essential cookies are processed only with the consent of the website visitor. Consent is given, it is revocable and it is managed using the cookie tool on our website, which opens to the visitor from the cookie banner on the side of the site. The cookie banner and the separate cookie statement on our site provide more detailed information about the cookies on our site.

13. Obligation to provide personal data and the consequences of not providing it

Use of our online service is only possible for registered users, so if the user does not provide their personal data, use of the service may not be possible.

With legal entity customers processing of certain personal data is also mandatory for instance for concluding and executing contracts and for invoicing purposes.

To the extent possible and when doing business with us, we try to inform you which information is mandatory to fulfill the contract or create a user account and which information you can provide if you wish.

14. Automated decision-making and profiling

We do not perform such automatic decision-making and profiling that would have legal effects or other similar effects on a person

15. Changes

We may make updates to this privacy statement as our operations, privacy principles or applicable legislation change. Unless otherwise stated, changes will take effect when we have posted an updated privacy statement on our website.