Privacy notice

1. Who is responsible

The controller is OOMZEE Oy, trading as Captila, business ID 3154423-8, Korkeakoulunkatu 7, 33720 Tampere, Finland. Questions and requests about personal data: privacy@captila.com.

Attestia decides itself why and how it vets businesses, so it acts as an independent controller, not on behalf of the business that applies. A business that gives us the details of its staff should show them this notice; the portal asks for that before an application is submitted.

2. Whose data, and what

• Portal and console users: name, work email, phone number if given, role in the enterprise, sign-in account and security settings (password and authenticator app, held by our sign-in service), and what each user did in the portal (audit log).
• Authorised signatory and contact person named in an application: name, job title, work email and phone, the answer to the confirmation email, the name typed as an electronic signature, the time of signing, and the signed application PDF; for the contact person, whether a one-time code sent to their phone was entered correctly.
• People named in documents and registry records: names and roles of board members, managing directors, owners or other representatives that appear in trade register extracts, authorisation letters, credit reports or registry answers about the business.
• People who request an account on the sign-up page: the names, titles, emails and phone numbers of the person applying and the person who authorises the application, and a one-way fingerprint of the internet address used, only to stop automated spam (it cannot be turned back into the address).
• People who contact us by email: what they write and their contact details.

We do not ask for identity documents, dates of birth, personal identity numbers or private addresses, and the portal asks businesses not to upload them. We do not use special categories of personal data.

3. Where the data comes from

From the business that applies and its users; from the people themselves (for example when they sign or answer a confirmation email); and from the sources we check the application against: public business registries (such as the Finnish Patent and Registration Office PRH, the EU VAT system VIES, GLEIF for LEI codes, the Norwegian Brønnøysund register and the EU Intellectual Property Office), and, where the business is checked with them, credit reference agencies and business verification providers. The current list is on the service providers page.

4. What we use it for, and on what basis

• Running the portal and our contract with the business (accounts, sign-in, support, notices about the application): performance of a contract, and for staff of the business, our legitimate interest in providing the service the business asked for (GDPR Article 6(1)(b) and (f)).
• Vetting and verifying the business: confirming that the company exists, that the person who signs may sign for it, that its contact details are real, and that it holds the brands, numbers, sender IDs and apps it lists. We compare the application with registries, with documents the business uploads and with the answers of the signatory and contact person. This rests on our legitimate interest, and that of the operators and people who receive the business's calls and messages, in preventing impersonation and fraud (Article 6(1)(f)). It does not rest on consent, so it is not a reason to refuse checks; a business that does not want them cannot be verified.
• Recording the electronic signature of the application, so it can later be shown who signed what and when: performance of a contract and legitimate interest.
• Billing and accounting: legal obligation under the Finnish Accounting Act (Article 6(1)(c)).
• Security (audit log, protection against misuse and spam, incident handling): legitimate interest and legal obligations on information security.
• Establishing or defending legal claims: legitimate interest.

You can object to processing based on legitimate interest (section 8). Where we rely on it, we have weighed it against your interests: the data is limited to work contact details and roles, it is used only to check businesses, and it is not used for marketing.

5. Scores and decisions

Attestia computes a Verification Score for each business and its assets from the evidence collected. The score is about the business, not about a person. The decision to verify a business is taken by an Attestia analyst, not by the score alone, and no decision with legal or similarly significant effect on a person is taken solely by automated means.

6. Who receives it

• Operators, messaging platforms and network API providers that rely on Attestia receive the business's token and score: the business name, country, verification result and its verified assets (numbers, sender IDs, brands, apps). These do not include the names or contact details of the signatory, contact person or users.
• Trust Registries, only if the business allows publication, receive the same business information under the publication terms.
• Our service providers (hosting, email, sign-in) process data on our behalf under data processing agreements, and the sources we check against receive the details needed for a check, such as the business ID, the company name or a brand name. Both are listed on the service providers page.
• Authorities, when the law requires it.

We do not sell personal data and do not use it for advertising.

7. Transfers outside the EU

The platform and its data are hosted in the EU. A few sources we may check against are outside the EU or EEA, for example a credit reference agency in the United Kingdom or the United States. We send them only what a check needs, and only on a legal basis for the transfer: an adequacy decision of the European Commission (such as for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. The service providers page says which basis applies to each.

8. How long we keep it

• Verification records of a business (applications, evidence, documents, signatures, decisions): while the business is verified, and then 5 years, so that the basis of a verification can be shown if it is questioned.
• Applications that are rejected or withdrawn, and their documents: 12 months after the decision.
• Account requests from the sign-up page that are not approved: 6 months.
• Portal and console user accounts: until the user is removed or the business leaves Attestia; the audit log of what they did is kept with the verification records.
• Invoices and accounting records: as the Finnish Accounting Act requires (6 or 10 years from the end of the financial year).
• Emails sent by the platform: 12 months. One-time codes and confirmation links: until used or expired (at most 7 days).
• Security logs: 12 months.

9. Your rights

You can ask for access to your personal data and a copy of it, to have it corrected, erased or its use restricted, to object to processing based on legitimate interest, and to receive data you gave us in a portable format. Some data must be kept despite a request, for example accounting records or the record of a signature given for a company. Write to privacy@captila.com; we answer within one month and may ask you to confirm who you are.

You can also complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi), or to the data protection authority where you live or work.

10. Cookies and similar technology

Attestia uses only what is strictly necessary for the service: the sign-in service sets session cookies to keep you signed in and protect the sign-in, and the portal and console store your session and small preferences (such as the last country you viewed) in your browser. We use no analytics, advertising or tracking cookies, so no cookie consent is asked for. Fonts and all other page content are served from our own server; opening a page sends nothing to third parties.

11. Security

Data is encrypted in transit, access is limited by role and recorded in an audit log, sign-in uses an authenticator app for staff, client secrets and one-time codes are stored only as fingerprints, and tokens are signed so they cannot be altered. If a personal data breach is likely to put you at risk, we tell the Data Protection Ombudsman within 72 hours and, where the risk is high, tell you.

12. Changes

We publish any change to this notice on this page with a new version and date. If a change matters for how we use your data, we tell the business and its users in the portal or by email.