Legal

Privacy notice

Effective date: 27 October 2026

1. Who we are

Gravito Oy (in English, Gravito Ltd)
Lapinlahdenkatu 16, 00180 Helsinki, Finland
Business ID: 2891268-5
VAT number: FI28912685
Email: support@gravito.net
Phone: +358 50 486 0739

Gravito Oy is the controller for the processing described in this notice. For any question about privacy, data protection or security, write to support@gravito.net.

2. What this notice covers, and what it does not

This notice covers personal data for which Gravito decides the purposes and the means. That is:

People who visit gravito.net
People who contact us or book a demo
People at our business customers and partners who hold accounts in our administration tools
People who receive our marketing communications

This notice does not cover visitors to our customers’ websites.

Gravito supplies consent management and data tools that our customers run on their own websites and apps. Where our tools process data about visitors to a customer’s site, the customer decides the purposes and the means and is the controller. Gravito processes that data on the customer’s documented instructions, as a processor, under a data processing agreement.

If you are a visitor to a website that uses Gravito, including if you reached this page from that website’s consent banner, the notice you need is that website’s own privacy notice. Your rights over that data are exercised with the website’s operator, who can act on them. We help them do so, but we cannot answer for them.

3. The legal bases we rely on

We process personal data on one or more of these bases, and each section below says which applies:

Consent, Article 6(1)(a) GDPR. You can withdraw consent at any time, and withdrawing is as easy as giving it
A contract, or steps before a contract, Article 6(1)(b)
Legitimate interests, Article 6(1)(f). Where we rely on this, we state the interest, and you can object under Article 21
A legal obligation, Article 6(1)(c), for example keeping accounting records

4. Visiting gravito.net

4.1 Server logs

When you load a page, the systems of our hosting provider, Cloudflare, process technical information about the request. This can include your IP address, the date and time, the page requested, the page you came from, your browser type and version, your operating system, and an approximate location derived from the IP address.

Why: to deliver the site, find and fix technical faults, and protect the security of the site and our systems. Basis: legitimate interests, Article 6(1)(f). Our interest is running and securing our own website. Retention: only as long as needed for these purposes, after which the logs are deleted automatically.

4.2 Cookies and similar technologies

Our website uses Gravito’s own consent management platform. On your first visit it asks for your choice. You can change or withdraw that choice at any time through Consent preferences at the foot of every page. The same panel shows the current list of every cookie and similar technology the site uses, what each is for and how long it lasts.

Without your consent, we use only what is strictly necessary to deliver the site, to protect it, and to remember the choice you made. Everything else is used only after you consent, and only for the categories you accept.

To keep an accurate record of your choices, our consent platform creates a pseudonymous identifier for your browser when you first arrive. It is held in your browser and in secure server-side storage in our own first-party context, and it holds only the values needed for a complete and accurate record of your consent choices, nothing else. Because it is what remembers your choice, it is used without consent. Basis: legitimate interests, Article 6(1)(f). Our interest is keeping a reliable record of the consent choices made on our site, which the GDPR requires us to be able to demonstrate (Articles 5(2) and 7(1)).

When the consent prompt opens, our consent platform reports to us that it was shown. This lets us see when the prompt fails to appear, for example because something has blocked it, so that we can find out why. The report carries the technical information any web request carries, such as your IP address and browser type. Basis: legitimate interests, Article 6(1)(f). Our interest is making sure the consent prompt on our own site works.

Your choice is remembered for 364 days, and on day 365 you are asked again. Your browser may delete stored items sooner, for example under its own tracking-prevention rules, and if it does you are asked again sooner. If you delete cookies in your browser, your choice is deleted with them.

You can object to the processing of the identifier that holds your choice (section 11). If we stop it, we can no longer remember your choice or show that we respected it, so you will be asked again on every visit. You can remove it from your browser at once yourself: delete the cookies and site data for gravito.net, and the identifier is removed from your browser.

4.3 Analytics and chat on our own site

Provider	What it does	Data involved
Matomo, our own installation at `analytics.gravito.net`	Website analytics: which pages are visited and how the site is used	Interaction data, pseudonymous visitor and session identifiers, device and browser information
HubSpot	Website chat: lets you write to our team from any page	What you write in the chat, any name or email address you give, technical information about your browser, and the cookies HubSpot sets to run the chat

Basis: consent, Article 6(1)(a). Each of these loads only if you accept it in the consent preferences, and stops if you withdraw.

We review what our site actually loads after each change and keep this list up to date. The consent preferences panel always shows what is currently in use.

5. Contacting us and booking a demo

You can reach us through the contact form or the chat on our website, by booking a session through our booking page, or by email.

What we process:

Contact form: what you enter (name, email address, company, country, role, the product you ask about, and your message), plus your browser’s user agent and the country derived from your IP address. The form is delivered to our team by email and stored in our website’s own database. To prevent abuse, your IP address is also held for about one hour to limit how many messages can be sent from one address.
Form protection: the contact form uses Cloudflare Turnstile to check that a message is sent by a person and not by an automated program. Turnstile loads only when you start filling in the form, and processes technical information about your browser and connection for that check.
Demo booking: our booking page is run with Microsoft Bookings. What you enter there is processed by Microsoft on our behalf.
Chat: what you write in the chat. A person from our team answers, and if the chat cannot be handled live, a person contacts you afterwards. The chat is provided by HubSpot (section 4.3), which processes the conversation on our behalf to run it.
Email: what you send us.

Why: to answer you and handle your request, and to protect the form from automated abuse. Basis: legitimate interests, Article 6(1)(f), where you approach us about our services: our interest is answering the people who contact us, and protecting the channel they use. Where you are asking about buying our services, steps before a contract, Article 6(1)(b).

What getting in touch does not start: contacting us does not put you into an automated marketing sequence. A person from our team answers you. We do use outbound marketing for our own services (section 5.2), and we would ask you separately before sending you any newsletter or other regular updates by email.

Retention: messages that are spam or unsolicited sales offers are deleted within a week. Genuine enquiries are kept with our records of the prospective customer until a decision has been made about working together. If your organisation becomes a customer, section 6 applies.

We do not currently send a newsletter by email. Our newsletter is published on LinkedIn (section 7). If we offer updates by email in the future, we will send them only to people who have asked for them, and every message will have a link to unsubscribe.

5.2 Marketing communications

We may send marketing about our own services to people at businesses we work with or could work with.

Where the contact details come from: from you, if you have been in touch with us, and otherwise from business sources: the sales-intelligence platform Apollo, which we use to find business contacts and send outbound messages, and publicly available professional information. The details involved are business contact data, such as your name, job title, employer, business email address and business phone number.

Who is involved: besides our own team, we work with subcontractors who contact businesses on our behalf using their own tools.

Basis: legitimate interests, Article 6(1)(f), our interest being to tell businesses about our services, or your consent where the law requires consent.

You can object to this at any time, free of charge, using the link in any message or by writing to support@gravito.net, and we will stop. To make sure we do not contact you again, we keep your email address on a suppression list, which we use only for that purpose.

6. Customers, partners and people who hold accounts in our tools

If your organisation is a Gravito customer or partner and you hold an account in our administration tools, we process:

Account and contact data: name, business email address, company, role, phone number, address, VAT number, preferred language, invoicing details
Authentication data: credentials, login records and, where used, multi-factor authentication details
Activity records: actions taken in the administration tools, for security, support and audit
Commercial records: subscription and invoicing data, including the statutory validation of VAT numbers

Why: to provide the service to your organisation, identify you as an authorised user, keep the account secure, support you, issue valid invoices, and meet our legal obligations. Basis: a contract with your organisation and steps before a contract, Article 6(1)(b); our legitimate interests in securing and supporting the service, Article 6(1)(f); and legal obligation for accounting and tax records, Article 6(1)(c).

You have rights here in your own name. Being an employee of a customer does not change that. If you ask us to act on a right over your own data, we will handle it, and we will tell your organisation only where we are required to or where we cannot act without them.

Retention:

Account, contact and commercial records: for as long as your organisation’s contract runs, and after that for as long as accounting and tax law requires for the records that law covers.
Authentication and activity records: for as long as needed to keep the service secure and to investigate incidents, and then deleted.

We have a company page on LinkedIn, and publish a newsletter there. LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) gives us aggregated statistics about the page and its audience. For that statistics function, LinkedIn and Gravito are joint controllers under LinkedIn’s Page Insights Joint Controller Addendum, and LinkedIn is responsible for the underlying processing.

Requests about data LinkedIn holds are best made to LinkedIn, which is the only party that can act on them. LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy

We do not sell personal data, and we do not trade it.

We use service providers who process personal data on our behalf, under written contracts, only on our instructions, and bound to confidentiality and appropriate security. They are:

Cloudflare, which hosts our website, stores what you send through the contact form and delivers it to our team by email, and provides the form protection described in section 5
Other hosting and cloud infrastructure providers, for our administration tools
Email, office and booking services, and customer relationship management
The analytics and chat providers named in section 4.3
Apollo and our marketing subcontractors, for the outbound marketing described in section 5.2
IT maintenance providers and professional advisers

We may disclose personal data where the law requires us to, or where it is needed to establish, exercise or defend legal claims. Where we receive a demand from a public authority, we disclose only what the demand legally requires.

9. Transfers outside the EEA

Some of our service providers, or their own subprocessors, may process personal data outside the European Economic Area. Where that happens, the transfer relies on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified US providers, or on the European Commission’s standard contractual clauses.

Our website chat provider, HubSpot, processes chat conversations in the United States.

You can ask us which safeguard applies to a given provider by writing to support@gravito.net.

10. How long we keep data

Each section above states how long we keep the data it describes. Where none is stated, we keep data only as long as needed for the purpose it was collected for and then delete it, unless the law requires us to keep it longer, or we need it to establish, exercise or defend legal claims.

11. Your rights

Where we process your personal data, you have the right to:

Access a copy of your data and information about how we process it (Article 15 GDPR)
Rectification of inaccurate or incomplete data (Article 16)
Erasure (Article 17)
Restriction of processing (Article 18)
Data portability: to receive data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible (Article 20)
Object to processing based on legitimate interests (Article 21), and to object at any time to direct marketing, in which case we stop
Withdraw consent at any time, where processing is based on consent (Article 7(3)). Withdrawal does not affect processing carried out before you withdrew

These are free of charge. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee based on our administrative costs, or decline to act, and we will tell you why.

We answer within one month of receiving your request. If a request is complex, or we receive many, we may extend this by up to two further months, and if we do we will tell you within the first month and explain why.

To exercise any right, write to support@gravito.net. Where we have reasonable doubts about who is asking, we may ask for information to confirm your identity before we act.

11.1 Complaints

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority.

In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), PO Box 800, 00531 Helsinki, tietosuoja.fi.

You may also complain to the supervisory authority where you live or work, or where you believe the infringement took place. We would welcome the chance to put things right first at support@gravito.net, but you do not have to contact us before complaining.

12. Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure, and to restore availability and access after an incident.

13. Children

Our services are for businesses and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@gravito.net and we will delete it.

14. Changes to this notice

We may update this notice. The current version is always at gravito.net/privacy-notice/ and shows its effective date. Where a change materially affects how we use your data, we will take reasonable steps to tell you.

15. Contact

support@gravito.net, or by post to Gravito Oy, Lapinlahdenkatu 16, 00180 Helsinki, Finland.

This notice replaces all previous versions. Previous versions, including the version effective from 8 October 2024, are available on request from support@gravito.net.