Privacy Policy and Register

Effective Date: 01.12.2019
Last Updated: 21.09.2026

This Privacy Policy and Register Description explains how Albero Oy collects, uses, stores, and protects personal data. We comply with the EU General Data Protection Regulation (GDPR) as well as applicable national legislation.

1. Data Controller

Albero Oy
Business ID: 1065399-6

Lentokentänkatu 49
33900 TAMPERE, Finland

info@gasguitarworks.fi
+358 50 322 6207

2. Data Protection Contact Person

Pekka Mäkinen

3. Purposes and Legal Bases for Processing Personal Data

We process personal data for the following purposes:

  • Customer relationship management, order and service fulfillment, and responding to inquiries and requests for quotation – performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
  • Newsletter and email marketing – consent (Article 6(1)(a) GDPR). For existing customers, we may provide information about our own similar products and services based on our legitimate interests (Article 6(1)(f) GDPR).
  • Website and business development through analytics – cookie-based analytics and marketing tracking with your consent (Article 6(1)(a) GDPR), and cookie-free visitor statistics based on our legitimate interests (Article 6(1)(f) GDPR).
  • Security of services and forms and prevention of misuse – legitimate interests (Article 6(1)(f) GDPR).
  • Compliance with legal obligations, such as accounting and taxation – compliance with a legal obligation (Article 6(1)(c) GDPR).

Where processing is based on our legitimate interests, you have the right to object to such processing. Where processing is based on your consent, you may withdraw your consent at any time. We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

The processing of personal data may be partly outsourced to trusted service providers who comply with data protection legislation.

4. Personal Data Processed

We may collect and process, among others, the following types of personal data:

  • Name and contact details (email, phone number, address)
  • Company / organization and possible identification details
  • Communication history (e.g. emails, inquiries)
  • Website usage data (IP address, browser, visited pages, events)
  • Order and customer information

5. Data Sources

Data is primarily obtained from:

  • website contact forms and emails
  • the Guitar Builder quote form and the guitar selections made in it
  • phone calls, events, and meetings
  • contracts and orders
  • website analytics and cookie tools
  • public registers and professional networks (e.g. LinkedIn)

6. Disclosure and Transfer of Data Outside the EU/EEA

We do not sell personal data or routinely disclose it to third parties. Personal data may be processed on our behalf or disclosed to the following categories of recipients to the extent necessary:

  • email, cloud, hosting, and web service providers
  • analytics and marketing service providers
  • payment processing and financial service providers for processing orders and payments
  • shipping and logistics service providers for the delivery of orders
  • public authorities where required by law

Some service providers may be located outside the EU or the EEA. In such cases, transfers are safeguarded using appropriate data protection measures, such as EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

7. Data Security

We handle personal data with care and store it in secure systems.
Our IT systems are protected by firewalls, encryption, and access controls.
Access to personal data is restricted to employees who have the right to process it as part of their work.
Despite careful security measures, no system is entirely secure, and we ask users to keep this in mind when operating online.

8. Data Retention Period

We retain personal data only for as long as it is necessary for the purposes described in this statement or as required by law:

  • Customer and contract data: retained for the duration of the customer relationship and up to 10 years thereafter.
  • Inquiries and requests for quotation that do not result in an order: 12 months from the last contact.
  • Marketing data: retained until the individual withdraws consent or for a maximum of 6 years.
  • Analytics and cookie data: Google Analytics event data is retained for 2 months and user-level data for 14 months from the last visit, after which it is deleted. Cookie retention periods are described in our Cookie Policy.

9. Data Subject Rights

You have the following rights:

  • To access your personal data and receive a copy of it
  • To request the correction of inaccurate data
  • To request the deletion of your data (“right to be forgotten”)
  • To restrict or object to the processing of your data in certain situations
  • To receive the personal data you have provided to us and transmit it from one system to another where the processing is based on consent or a contract
  • To withdraw your consent at any time (e.g. for newsletters)
  • To lodge a complaint with the Data Protection Authority (tietosuoja.fi)

You may submit your requests in writing using the contact details provided in Section 1. Where applicable, the request will also cover the service providers we use. We may ask you to verify your identity before processing your request.

10. Guitar Builder Requests for Quotation

When you submit a request for quotation through the Guitar Builder, we process your name, email address, the guitar components you have selected, and the name you have given to the guitar. We use this information to respond to your request. Without your name and email address, we are unable to respond. The legal basis for the processing is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). The Guitar Builder does not add you to our marketing mailing list.

We protect the form against bots and misuse based on our legitimate interests (Article 6(1)(f) GDPR). For this purpose, Cloudflare Turnstile processes your IP address and technical information about your browser. To enforce submission limits and prevent duplicate submissions, we store identifiers and hashes, but not your name or email address. IP-based counters are deleted within 24 hours and submission data within 48 hours, and no backups of this data are retained. You have the right to object to this processing. A technical identifier is stored in your browser’s session storage to prevent the same request from being submitted twice.

We use Vercel (hosting and form processing), Upstash (submission rate limiting), Resend (email delivery), and Cloudflare (bot protection) as service providers. Form processing and submission rate-limiting data are hosted in Ireland (EU). Resend stores data in the United States, and Cloudflare operates globally and also uses data to improve its bot detection services (more information). As the service providers are U.S.-based companies, personal data may be transferred to the United States. Such transfers are safeguarded using the EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

Requests for quotation that do not result in an order are deleted from our mailbox 12 months after the last contact. Vercel service logs are retained for 24 hours, and Resend email logs for 30 days. The retention of data relating to orders and your rights are described in Sections 8 and 9.

11. Cookies and Analytics

Our website uses cookies to improve the user experience, for analytics, and for marketing purposes.
You can manage your cookie preferences through the cookie banner or your browser settings.
Some cookies are essential for the proper functioning of the website, while others require your consent.

We use Vercel Web Analytics, provided by Vercel Inc., to understand how visitors use the Guitar Builder and to improve the service. Analytics may include page views, referring websites, approximate geographic location, and browser and device information.

The default analytics does not use tracking cookies. According to Vercel, visitors are distinguished using a temporary identifier derived from the incoming request, which expires after 24 hours. We receive aggregated visitor statistics, which may include the website from which a visitor arrived at the Guitar Builder. This analytics does not track an individual visitor’s browsing history or subsequent activity on other websites.

We do not send guitar names, contact details or quote-request contents as analytics events.

More information: Vercel Web Analytics privacy information.

We use Google Analytics (GA4) and Google Tag Manager. Data may be transferred outside the EU, and such transfers are protected in accordance with the EU–US Data Privacy Framework.

More information about Google’s privacy practices: https://business.safety.google/privacy

We also use Burst Statistics to monitor and improve website traffic. This tool operates in a cookie-free mode and does not collect identifiable personal data or require separate consent. The data is not used to identify visitors and is not shared with third parties.

More information about Burst Statistics’ privacy practices: https://burst-statistics.com/legal/privacy-statement-eu/

We use the Brevo marketing platform (Sendinblue SAS, France) for email marketing and marketing automation. Brevo is used to send newsletters, manage contacts, and track website visits when the user has given consent for marketing cookies.

Brevo stores and processes personal data (such as email address, website visits, and link clicks) only on behalf of the data controller and does not share this data with third parties. Data is processed within the EU, and Brevo acts as a data processor in accordance with the EU General Data Protection Regulation (GDPR).

More information: https://www.brevo.com/legal/privacypolicy/

For more information about cookies, please see our separate Cookie Policy.

12. Links to Third-Party Websites

Our website may contain links to external websites. We are not responsible for the privacy practices or content of these websites, and we recommend reviewing their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on our website and will indicate the date of the update.

Contact for Data Protection Matters:
info@gasguitarworks.fi

MENU '