Privacy Policy

This Privacy Policy explains how Viking Lab Oy (“we”, “us”, or “our”) collects, uses, and protects your personal data when you visit our website biofrost.fi. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and Finnish data protection law.

If you have any questions regarding this Privacy Policy, please contact us using the information provided below.

1. DATA CONTROLLER

Viking Lab Oy
Vanha Vaasantie 8 C
33470 Ylöjärvi, Finland
Phone: +358 44 0221422
Email: info@vikinglab.fi
Business ID: FI26181268

2. GDPR CONTACT PERSON

The GDPR contact person in our company is:

• Name: Heikki Lehmuslehti
• Position: Chief Executive Officer (CEO)
• Email: heikki@vikinglab.fi
• Phone: +358 44 0221422

3. PERSONAL DATA WE COLLECT

3.1 Necessary Browser Storage and Server Logs

We use necessary browser storage to remember your choices. Our hosting server also processes technical request data in server logs.

• biofrost-language: Stores your selected language in sessionStorage for the current browser-tab session; it is not a cookie.
• biofrost_consent: Stores your privacy choices in a first-party cookie for 180 days after they are saved or updated.

Server logs contain your IP address, request time and URL, response status and size, and the referring URL and User-Agent string if your browser supplies them. They are used for website operation, troubleshooting and security.

4. LEGAL BASIS FOR PROCESSING

We process personal data based on the following legal grounds under Article 6 of the GDPR:

We rely on legitimate interests to provide the website functions you request, remember your choices and protect the website. You may object to processing based on legitimate interests as described in section 10.

5. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies to manage your consent preferences and to ensure the website functions properly. Cookies are small text files stored on your device when you visit our website.

CookieConsent runs locally on our website and does not send your data to its developer. Software information: https://github.com/orestbida/cookieconsent

5.1 Necessary Cookies and Browser Storage (No Consent Required)

The following storage is necessary to remember your choices and does not require consent:

• biofrost_consent: Remembers your privacy choices for 180 days after they are saved or updated. It is a necessary first-party cookie, including when you reject optional categories.
• biofrost-language: Remembers your selected language in sessionStorage for the current browser-tab session. This necessary browser storage is not a cookie.

5.2 Non-Essential Cookies (Consent Required)

No optional cookies or services are currently configured. Optional categories are disabled by default; selecting them does not currently activate analytics, advertising or external media.

We do not use analytics, tracking, or advertising cookies.

You can manage your cookie preferences at any time by clicking the “Change consent settings” link in the footer of our website or by visiting: https://biofrost.fi/#consent-change

6. HOW WE USE YOUR DATA

The minimal data processed through our website is used only for:

• Providing and maintaining our website functionality
• Displaying the website in your preferred language
• Remembering your privacy choices and protecting website security

Note: We do not engage in analytics, profiling, tracking, or automated decision-making.

7. WHO WE SHARE YOUR DATA WITH

We use OVH SAS (OVHcloud) to host this website. When you visit the website, your IP address is processed by the hosting server.

For more information about OVH’s data protection practices, visit: https://www.ovhcloud.com/en-ie/personal-data-protection/

We do not sell, trade, or otherwise transfer your personal data to third parties for marketing purposes.

8. INTERNATIONAL DATA TRANSFERS

Our website is hosted by OVH SAS in France, within the European Economic Area (EEA).

9. DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

When your personal data is no longer required, we will securely delete or anonymise it in accordance with applicable data protection laws.

10. YOUR RIGHTS UNDER GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you
• Right to Rectification: You can request correction of inaccurate or incomplete data
• Right to Erasure: You can request deletion of your personal data (“right to be forgotten”)
• Right to Restrict Processing: You can request limitation of processing under certain circumstances
• Right to Data Portability: Where the GDPR conditions apply, you can request data you provided in a structured, machine-readable format; this right applies to automated processing based on consent or a contract.
• Right to Object: You can object to processing based on legitimate interests
• Right to Withdraw Consent: You can withdraw consent at any time by adjusting your cookie preferences

To exercise your rights, contact us using the details in section 1. We respond without undue delay and within one month. Where necessary because of the complexity or number of requests, this may be extended by up to two further months; we inform you within the first month and explain why.

11. RIGHT TO LODGE A COMPLAINT

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.

The supervisory authority in Finland is:

Office of the Data Protection Ombudsman
(Tietosuojavaltuutetun toimisto)
Street address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: PL 800, 00531 Helsinki, Finland
Phone: +358 29 566 6700
Email: tietosuoja(at)om.fi
Website: https://tietosuoja.fi/en/home

12. DATA SECURITY

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption: Our website uses HTTPS/TLS encryption for secure data transmission
• Secure Hosting: Our website is hosted by OVH in France, which maintains strict physical and digital security measures
• Access Controls: Access to personal data is restricted to authorised personnel only
• Regular Updates: We keep our website software and security measures up to date

For more information about OVH’s security measures, visit: https://www.ovhcloud.com/en-ie/personal-data-protection/

14. AUTOMATED DECISION-MAKING

We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you.

15. DATA BREACH NOTIFICATION

We assess and document personal data breaches. Where a breach is likely to result in a risk to individuals' rights and freedoms, we will:

• Notify the Finnish Data Protection Ombudsman without undue delay and, where feasible, within 72 hours of becoming aware of the breach
• Inform affected individuals without undue delay if the breach poses a high risk
• Document all breaches and the remedial actions taken

16. DO NOT TRACK SIGNALS

Our website does not currently respond to “Do Not Track” browser signals. However, since we do not use any tracking or analytics technologies, your browsing activity is not tracked regardless of this setting.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make significant changes, we will notify you by posting the updated policy on our website with a new effective date.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

19. CONTACT US

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal data, please contact us:

Viking Lab Oy
Vanha Vaasantie 8 C
33470 Ylöjärvi, Finland
Phone: +358 44 0221422
Email: info@vikinglab.fi

20. LIMITED DATA PROCESSING

We do not use analytics, advertising or profiling. We process necessary browser preferences and technical server-log data as described in this policy. Specifically:

• We do not use tracking pixels, advertising cookies, or remarketing technologies
• We do not create user profiles or conduct profiling
• We do not sell or share data with third parties for marketing

What this means for data subject requests:

If you submit a data access request (Article 15 GDPR), please be aware that:

• Privacy choices are stored in the biofrost_consent cookie, which your browser sends with requests to our website. Your language choice is stored in sessionStorage and is not automatically sent with requests.
• We administer the server access logs on OVHcloud-hosted infrastructure. Their contents and retention are described in sections 7 and 9.

We handle data subject requests within the time limits described in section 10, including when we hold no personal data relating to the request.

This Privacy Policy was last updated on [09.10.2026]