In briefWe process your data to perform our contract and keep the service secure. We do not sell personal data or use customer content to train AI models. Primary processing stays in the EU/EEA; transfers to subprocessors outside the EEA rely on Standard Contractual Clauses (SCC).
Data controllerArt. 4(7) GDPR
The controller is MCR One Oy, Business ID 3513953-9, Tainionkoskentie 68, 55120 Imatra, Finland (domicile Imatra). Voitta is a service of MCR One Oy. Privacy requests: [email protected]. Data Protection Officer: [email protected].
Personal data we processArt. 5, 6 GDPR
- Account data — name, work email, company name, business ID.
- Usage data — workspace settings, CPV codes, bid templates.
- Log data — IP address, user agent, session and login events (audit).
- Billing data — Stripe customer ID, billing events.
Legal basesArt. 6 GDPR
- Contract (6.1.b) — providing the service.
- Legitimate interest (6.1.f) — security, product improvement.
- Legal obligation (6.1.c) — accounting, tax, authority requests.
- Consent (6.1.a) — marketing, non-essential cookies.
SubprocessorsArt. 28 GDPR
| Processor | Purpose | Location | Transfer |
|---|---|---|---|
| Hetzner GmbH | Application hosting | Helsinki / Nürnberg | EU |
| Cloudflare | CDN, WAF; R2 EU (cryptographic-deletion ledger and EU backups). Customer data is encrypted with keys that can be deleted. Bucket Lock, not Compliance-mode WORM. Cloudflare account administrators who can remove Bucket Lock configuration are outside this safeguard. | EU edge / R2 EU | EU-DC |
| Stripe | Payment processing | Dublin / US | SCC |
| Postmark | Transactional email | EU | EU |
| Anthropic | AI-assisted generation | EU / US | SCC |
| OpenAI | AI-assisted generation | EU / US | SCC |
| Google (Gemini) | AI-assisted generation | EU / US | SCC |
| Sentry | Error monitoring | EU / US | SCC |
| HubSpot | CRM integration (optional) | EU / US | SCC |
| Microsoft | Teams & SharePoint integrations | EU / US | SCC |
| Slack | Workspace notifications (optional) | US | SCC |
Your rightsArt. 15–22 GDPR
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. You may withdraw consent at any time and lodge a complaint with the Finnish Data Protection Ombudsman.
Exercise your rights by emailing [email protected]. We verify your identity before disclosing data.
SecurityArt. 32 GDPR
- All traffic over TLS 1.3; data at rest AES-256.
- Passwords hashed with bcrypt; SSO (SAML, OIDC) on Kirjoita tier.
- Least-privilege access; full audit logging.
- Customer data is not used to train AI models.
Contact
Privacy: [email protected] · DPO: [email protected]. Full Finnish notice: /tietosuoja.