Privacy Notice
1. Who we are
Valaa Technologies Oy (Business ID 2906337-1), trading as Nobody Engineering ("we", "us"), is the controller of the personal data described in this notice.
- Address: Näsilinnankatu 25 B 508, 33200 Tampere, Finland
- Privacy contact: legal@nobody.engineering
We have not appointed a Data Protection Officer, because the law does not require one for a company like ours. Our CTO is responsible for data protection internally. Send all privacy questions and requests to legal@nobody.engineering.
2. Two roles: controller and processor
We are the controller when we decide why and how personal data is used: for example our website, sales, customer and partner relationships, recruitment, and our own staff accounts. This notice covers that data.
We are a processor when we process data on behalf of a customer in the Nobody IDL platform: for example building data, platform user accounts that a customer manages, remote access records, alarm email recipients and photos or notes attached to buildings. In that case the customer is the controller and decides how the data is used. Please read your organisation's (or the building owner's) privacy notice, and send requests to them. If we receive a request about such data, we forward it to the customer without undue delay.
3. What data we process, why, and on what legal basis
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | Technical data such as IP address, browser and pages visited | Running and securing the website | Legitimate interest (a working, secure website) |
| People who contact us (contact or sales enquiries) | Name, email, phone, company, role, your message | Answering you and following up on your enquiry | Legitimate interest; contract, if the enquiry leads to one |
| Prospective customers | Business contact details (name, role, company, work email) and our contact history | Business-to-business sales and marketing | Legitimate interest; consent where the law requires it (for example some marketing emails) |
| Customer and partner contact persons | Name, email, phone, role, company, communication history | Managing the customer or partner relationship, support, invoicing and service notices | Contract; legitimate interest |
| Supplier contact persons | Name and contact details | Managing the supplier relationship | Contract; legitimate interest |
| Job applicants | CV, contact details, interview notes; references only with your consent | Recruitment | Legitimate interest (and steps before an employment contract); consent for references and any tests |
| Platform users (our own staff, and as needed to run the service) | Name, email, login identifiers, login records | Providing secure login (single sign-on) and protecting the service | Contract; legitimate interest (security). For users managed by a customer, see section 2. |
Where the data comes from. Mostly from you. Business contact details of prospective customers may also come from public sources such as company websites and professional networks, or from sales prospecting tools that collect publicly available business contact information. Contact persons of customers and partners may be given to us by their employer.
Do you have to give us data? No, but without it we cannot answer your enquiry, deliver our service or consider your application.
Automated decisions. We do not make decisions about you based solely on automated processing, including profiling.
4. Who receives the data
We do not sell personal data. Only staff who need the data for their work can access it. We use service providers who process data on our behalf under a data processing agreement:
| Category | Provider |
|---|---|
| Platform hosting | Amazon Web Services (Stockholm, Sweden, eu-north-1) and Hetzner (Helsinki, Finland) |
| Login (single sign-on) and monitoring | Run by us on the hosting above |
| Documents and file storage | Microsoft (SharePoint/OneDrive) |
| Microsoft 365, Superhuman | |
| Customer relationship management (CRM) | Attio |
| Sales prospecting | Leadspicker |
| Internal communication and work tracking | Slack, Linear |
| AI assistant (on Company accounts) | Anthropic (Claude) |
| Contracts and e-signature | DocuSign |
| Accounting and invoicing | Asteri, Visma |
| Website hosting | Amazon Web Services (Stockholm, Sweden) |
We may also disclose data to authorities when the law requires it, and to our accountants and legal advisers under confidentiality.
5. Transfers outside the EU/EEA
Our platform is hosted only in EU/EEA regions (Sweden and Finland). We aim to keep all personal data in the EU/EEA. If a service provider processes data outside the EU/EEA, we use a lawful transfer mechanism, such as an EU adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses. Some of the providers in section 4 (for example Microsoft, Slack, Linear, Attio, DocuSign, Superhuman and Anthropic) are based in the United States or may process data there; for them we rely on the EU-US Data Privacy Framework or the Standard Contractual Clauses in their data processing agreements.
6. How long we keep data
| Data | How long |
|---|---|
| Customer and partner contact data | While the customer relationship is active, plus 3 years |
| Prospect and marketing data | 2 years; consent records for as long as we rely on the consent, plus 2 years |
| Enquiries and other business email | 2 years |
| Job applications (if not hired) | 2 years after the recruitment decision |
| Platform user accounts | For the life of the account |
| Login and security logs | 1 year |
| Contracts | 7 years after expiry |
| Accounting records (e.g. invoices) | 6 to 10 years, as required by the Finnish Accounting Act |
After this, the data is deleted or anonymised. We may keep data longer only where the law requires it or to handle a legal claim.
7. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, unless we must keep it by law;
- restrict how we use your data;
- object to processing based on our legitimate interest, and to direct marketing at any time;
- data portability, where processing is based on consent or contract and done automatically;
- withdraw your consent at any time, without affecting processing before the withdrawal.
How to use your rights. Email legal@nobody.engineering. We may ask you to confirm your identity. We answer within one month. For complex requests we may extend this by two more months, and we will tell you why within the first month. Using your rights is free of charge.
8. Right to complain
If you think we process your data unlawfully, you can complain to the Finnish data protection authority:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi
You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to sort out your concern first, at legal@nobody.engineering.
9. Cookies
Our website does not use analytics or marketing cookies, and does not track visitors. Our web server keeps technical logs (such as IP address and browser) to run and secure the website.
The login to the Nobody IDL platform uses cookies that are necessary for signing in and keeping your session secure.
10. Security
We protect personal data with technical and organisational measures, including access control, encryption in transit and at rest, and logging. We are preparing our information security management system for ISO/IEC 27001 certification.
11. Changes to this notice
We update this notice when our processing changes. The date below shows the latest version. If a change is significant, we will tell you in a suitable way.
Last updated: 27 October 2026