Last updated: 23 September 2026

Why did you get this link?

If you ended up on this page after clicking a link the sales message sent by Visu24 Regarding the signature, in short: we found your company and you as an employee/representative of your company from public sources — primarily from your company's own website and the Finnish Patent and Registration Office's (PRH) public YTJ business information service — because we assess that our 3D visualisation and architectural illustration services could be relevant to your work duties. As a rule, we only use work contact details published by the company itself in our prospecting and do not generate addresses based on, for example, a name formula.

The latter part of this privacy policy explains in detail what data we process, why, for how long, and how you can, if you wish, opt out of being contacted altogether with a single action (section 7).

1. Data controller

The processing of personal data in accordance with this privacy policy is the responsibility of:

Oy Visu24 Ltd

Social security number: 2620904-8

Melalammentie 4

40900 Jyväskylä

Finland

Email: info@visu24.fi

We do not currently have a designated data protection officer. Any questions and requests regarding this privacy notice can be sent to the email address above.

2. What personal data do we process

2.1 Details of prospects and contact persons (housing company employees)

When we map potential new client companies, we process the following information about their contact persons:

• Name;
• job role or function;
• work email address;
• work phone number;
• employing company.

For prospecting, we fundamentally use only work contact details published by the company itself. We do not generate email addresses. (e.g. based on the company's address formula or name pattern).

2.2 Company Details

• company name;
• Business ID;
• registered office;
• website;
• publicly announced construction projects (e.g. project descriptions published on the company's own website);
• billing history and project history from our own CRM system, if the company has previously been our customer;
• notes on contacts and their outcomes.

2.3 Customer and client details

• identification and contact details (name, email, phone number, company, role);
• order, contract and billing details;
• communication during the project.

2.4 Website quote requests

When you submit a request for a quote using the form on the visu24.com website, the information is first saved in the site's WordPress form system and from there transferred to the BigMailer marketing tool. If the request for a quote proceeds to an active sales process, the data is also transferred, if necessary, to the monday.com customer relationship management system.

The contact fields on the form are necessary so that we can respond to your quote request — without them we cannot process the request. Filling in the non-mandatory fields is optional.

2.5 Project collaboration details (Rewiz.io platform)

We deliver the visualisations and collect feedback, approvals and payments through the Rewiz.io platform, which is the proprietary platform of Oy Visu24 Ltd. In this case, we can process project-related comments, approvals, version history and uploaded files, which may contain personal data depending on the material uploaded to the project.

3. Where the data is collected from

Some of the personal data we process has been obtained directly from you (e.g. in connection with a request for a quote or an order). However, some of the contact data — particularly data used in prospecting — has been collected other than from yourself, meaning we have the Data Protection Regulation under Article 14 obligation to inform you about the processing. This privacy notice fulfils that obligation. The processing is systematic and regular, not random.

Our information sources are:

• companies' own public websites;
• open Business Information System (YTJ) company data service of the Finnish Patent and Registration Office (PRH);
• existing customer relationship: quotes, orders, invoicing and past communication if the company has been our customer.

4. Purposes and legal bases

Client relationship management and project implementation

Legal basis: contract (GDPR Art. 6(1)(b)) — preparation of quotes, processing of orders, production and delivery of visualisations, project collaboration on the Rewiz.io platform.

Invoicing and bookkeeping

Legal basis: legal obligation (Article 6(1)(c) of the GDPR) — compliance with bookkeeping and tax legislation.

Direct marketing and new customer acquisition for businesses

Legal basis: legitimate interest (Article 6(1)(f) GDPR, recital 47, which mentions direct marketing as an explicit example of a legitimate interest).

Our interest is to reach potential business customers for whom our visualisation service may be useful by targeting communication to business-related contact details connected to work roles — not to individuals' personal addresses. We balance this interest against the recipient's privacy: messages are targeted only at contact details related to work roles and published by the company itself, the volume of messages is kept reasonable, and no sensitive data is processed.

Direct marketing for businesses and organisations may engage in accordance with the Act on Electronic Communication Services (SVPL) Section 202's in accordance with, unless the organisation has explicitly prohibited it. When a message is sent to a named person's work address, we direct our communications only to persons whose duties or position our services are essentially related to — merely working in a company belonging to our target group is not in itself a basis for selecting a person as a recipient of marketing. Every message includes clear, free of charge and separate opt-out instructions, see section 7.

Automated processing and use of artificial intelligence

We use AI-assisted tools in processing prospecting data and preparing sales messages. For example, AI can help analyse a company's industry, public project data or a contact person's job role and, based on these, produce a draft sales message. A human reviews and approves every message before sending. We do not make decisions concerning the data subject that produce legal effects under Article 22 of the GDPR or similarly significantly affect them based solely on automated processing.

5. Storage periods

Customers

• billing and accounting information: for 6 years as required by the Accounting Act;
• other contact and project details: 5 years from the latest customer interaction (order, invoice or communication), after which the data is deleted or anonymised, unless a new customer interaction has occurred in the meantime.

Prospects who have never replied

• information is retained for a maximum of 24 months from collection or from the last relevant interaction, unless a customer relationship is established during this time. The need for retention is then reassessed, and unnecessary data is deleted.

Prospects who have exercised their right to object

• Contact information is retained indefinitely with a separate “do not contact” flag to ensure the same person is not contacted again in future prospecting campaigns (see section 7).

6. Recipients, processors and international transfers

Our system

Visu24 uses its own Rewiz.io project sharing and customer feedback platform in the processing of personal data. Rewiz.io is a service developed and operated by Oy Visu24 Ltd itself, not a separate third-party processor.

External service providers

We also use third-party service providers from the following categories to process personal data on our behalf:

• CRM system (customer relationship management) — management of customer and prospect data;
• AI-assisted tools — assisting in the preparation of sales messages and the analysis of prospecting data, subject to human review;
• email sending and receiving services — sending and receiving messages, including sales messages;
• marketing automation tool — processing of quote requests on the website;
• bookkeeping service — invoicing and bookkeeping;
• website visitor analytics tool.

We require all our processors to have a data processing agreement (DPA) in accordance with applicable data protection legislation.

An accurate, up-to-date list of the service providers we use, including their names, is available upon request from info [at] visu24 [dot] fi. If you make a formal data subject access request under Article 15 of the GDPR, we will also provide the specific names of the recipients upon request.

Transfers outside the EU/EEA

Some of the aforementioned service provider groups (for example, our AI-assisted tools and some of our email services) may process data outside the European Economic Area (EEA), including in the United States. In such cases, we use an appropriate transfer mechanism, such as:

• our AI-assisted tools: European Commission Standard Contractual Clauses (SCCs);
• other service providers: European Commission adequacy decision (e.g. EU-U.S. Data Privacy Framework, if the service provider is certified under it) or standard contractual clauses (SCCs).

You can request to see a copy of the safeguard we use by contacting info [at] visu24 [dot] fi.

7. Your rights

Under the GDPR, you have the right:

• access personal data relating to you;
• rectify inaccurate personal data;
• request the deletion of your personal data (with certain exceptions);
• restrict processing;
• object to processing based on a legitimate interest;
• receive the personal data you have provided yourself in certain situations (when the processing is based on consent or a contract and is automated) in a structured, commonly used and machine-readable format and transmit those data to another controller;
• lodge a complaint with the supervisory authority (see section 9).

Absolute right to object to direct marketing (Article 21(2) of the GDPR)

You always have the right, without the need for separate justification, to prohibit the use of your data for direct marketing purposes. A single notification is sufficient — reply to any message you receive with the word “NO THANKS” or similar, or contact info [at] visu24 [dot] fi.

When you exercise this right, we will permanently mark your contact details as “do not contact” in our customer relationship management system (monday.com). All future prospecting lists are filtered against this tag before any new outreach sequence is sent, ensuring you will not be targeted by marketing again in any later runs.

To exercise your rights, please contact: info@visu24.fi. We may need to verify your identity before processing your request.

8. Information security

We use reasonable technical and organisational measures to protect personal data from unauthorised access, loss, unauthorised disclosure, alteration and destruction. Access to personal data is restricted to individuals and service providers who need it to perform their duties. However, no online service can guarantee complete data security.

Right of appeal

You have the right to lodge a complaint with a competent data protection supervisory authority if you consider that the processing of your personal data infringes the law.

Office of the Data Protection Ombudsman

PO Box 800, 00521 Helsinki

Telephone: +358 29 566 6700

www.tietosuoja.fi

We hope that you will contact us first so that we can endeavour to resolve any concerns you may have.