Aluedata — Finland & France postcode/commune intelligence · Effective 2026-08-10
Draft notice: this document was prepared as an operational starting point and has not been reviewed by a lawyer. It is written in good faith to accurately describe what the Service actually does — it collects very little — but has not had formal legal review. Have this checked by qualified counsel before relying on it commercially at scale.
1. Who controls your data
The data controller for aluedata.com is an individual operating from Turku, Finland (not a registered company — see Terms of Service, Section 11). Contact for any privacy question or request: admin@aluedata.com.
2. What is collected
Free public map (aluedata.com)
No cookies. The site sets none — no session cookies, no analytics cookies, no advertising cookies.
No analytics or tracking scripts. There is no Google Analytics, Meta Pixel, or any third-party tracker on the site. Nothing about your visit is sent to any third party for measurement or advertising purposes.
Standard web server logs only. Every web server inherently records, for each request: IP address, timestamp, and the path requested (e.g. /api/municipality/091). Aluedata's logs are no exception. These are used solely to detect abuse (scraping, rate-limit evasion, attacks) and are not linked to any account, since the Service has no user accounts.
No location, device, or browser fingerprinting. The map's "locate me" feature, if you use it, sends coordinates to /api/locate to resolve a municipality/commune — those coordinates are processed in memory to answer that one request and are not stored or logged beyond the standard request log above.
Licensed Embed Widget/API (business customers)
When a business licenses the Embed Widget, Aluedata stores the license record: company/client name, license tier, registered domain(s), and an issued API key. This is business contact information, not data about the business's own end-users (site visitors who see the embedded widget are not tracked or identified by Aluedata at all — the widget makes no calls back to Aluedata's servers beyond the one server-rendered page load needed to display it).
The same standard web server logs described above apply to embed/API requests.
3. Legal basis for processing (GDPR Art. 6)
Data
Legal basis
Server logs (IP, timestamp, path)
Legitimate interest (Art. 6(1)(f)) — securing the Service against abuse, scraping, and attacks
License holder contact/business details
Performance of a contract (Art. 6(1)(b)) — administering the license
No data is processed on the basis of consent, because nothing collected requires it (no cookies, no marketing, no tracking) — there is accordingly no cookie-consent banner on the site, as none is legally required for what is actually collected.
4. Retention
Server logs: retained for up to 30 days, then deleted or rotated out.
License records: retained for the duration of the license relationship plus a reasonable period afterward for accounting/legal purposes, then deleted on request or when no longer needed.
5. Who else sees this data
Aluedata does not sell, rent, or share personal data with third parties for marketing purposes. Data may be visible to:
The hosting/infrastructure provider running the server, as a data processor, strictly to the extent needed to operate the Service.
Law enforcement or a court, if legally compelled.
No data is knowingly transferred outside the EU/EEA. [Confirm this remains accurate once a specific hosting provider/region is chosen — if that provider is outside the EU/EEA, this section needs a transfer-mechanism statement (e.g. adequacy decision or SCCs).]
6. Your rights
Under GDPR, you have the right to:
Access — ask what data, if any, is held about you;
Rectification — correct inaccurate data;
Erasure — request deletion, subject to legal retention needs (e.g. an active license contract);
Restriction — limit how your data is processed;
Objection — object to processing based on legitimate interest;
Portability — receive license-account data in a portable format, where technically applicable;
Lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman; in France, the CNIL; or your own country's data protection authority if neither applies to you.
To exercise any of these rights, email admin@aluedata.com. Because the free public Service collects no identifying data beyond a rotating 30-day server log tied to an IP address rather than an account, most access/erasure requests for the free Service will have nothing to return — there is simply nothing stored against you individually once the 30-day log window has passed.
7. Children
The Service is not directed at children and is not knowingly used to collect data from children.
8. Changes to this policy
This policy may be updated from time to time; the effective date above reflects the most recent revision. Material changes affecting active license holders will be communicated to the contact address on file.