Privacy policy

Last updated: 3 October 2026. This site sets no cookies and loads no third-party resources.

1. Who is the controller

Vigil28 ([registered name], [address], Finland) is the controller for the personal data described in this privacy policy. Vigil28 is based in Finland. You can reach us at hello@vigil28.eu. Our data protection officer (DPO) can be reached at dpo@vigil28.eu (GDPR Art. 37).

2. What data we process and why

2.1 Contact details you give us when you register

When you register on the service we process the contact details you provide: your name, your work email address and your company. We use them to create your account, to identify you as a customer, and to send you service notifications. Legal basis: performance of a contract or of steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)).

2.2 Information provided as part of payment processing

Subscription payments are processed for us by Mollie Payments B.V. in the Netherlands. Mollie sends us the transaction details we need for accounting and customer administration: the amount paid, the plan, the payment status and a customer reference. Your card or bank details are entered on Mollie’s payment page and never reach our systems. Legal bases: performance of a contract (GDPR Art. 6(1)(b)) and compliance with our legal obligations under the Finnish Accounting Act (GDPR Art. 6(1)(c)).

2.3 Direct communication with our team

When you contact us by email or through our support system, we process the personal data contained in your messages: the contact details you use, the content of your message and any attachments you send. We use this data to answer your request and to keep a record of our correspondence. Legal bases: performance of a contract (GDPR Art. 6(1)(b)) when your request relates to your subscription, and our legitimate interest in operating customer support (GDPR Art. 6(1)(f)) in other cases.

2.4 Service security

Our hosting platform logs each request’s IP address, the time of the request and the requested URL. We use these logs to secure the service, to detect and prevent abuse, and to respond to incidents. Legal basis: our legitimate interest in information security (GDPR Art. 6(1)(f)).

3. What we do not do

Vigil28 is built for organisations that take privacy seriously, and our own practices follow the same principles.

• We do not sell, rent or trade your personal data.
• We do not share your personal data with advertisers, advertising networks or data brokers.
• We do not use your content or your customer data to train AI models or machine-learning systems.
• We do not use tracking pixels, web beacons, browser fingerprinting or cross-site tracking.
• This website sets no cookies and loads no third-party resources.

4. Recipients and sub-processors

We process the personal data described in this policy ourselves and use a small number of sub-processors, each bound by a data processing agreement concluded in accordance with GDPR Art. 28. Our current sub-processors are:

Each sub-processor processes personal data only on our documented instructions and only for the purpose stated in this section. Before adding or replacing a sub-processor we will notify you by email and you have the right to object before the change takes effect.

5. Where your data is processed

All of our sub-processors process personal data within the European Union or, in Proton’s case, in Switzerland, which is covered by an EU adequacy decision. We do not transfer personal data outside the EEA or Switzerland. If a future sub-processor were to require a transfer to another country, we would rely on standard contractual clauses, carry out a transfer impact assessment, and notify you before the first transfer.

6. How long we keep your data

• Account, registration and communication data: we retain it for the duration of your active subscription plus 12 months, and delete it after that.
• Payment and accounting records: we retain them for 10 years as the Finnish Accounting Act requires.
• Server log entries: we delete them within 30 days of creation.
• Backups are overwritten on a rolling schedule that follows these retention periods.

7. Your rights (GDPR Art. 15–21)

Under the GDPR you have the following rights over your personal data:

• Right of access (Art. 15): you can request a copy of your personal data and information about how we process it.
• Right to rectification (Art. 16): you can ask us to correct inaccurate personal data.
• Right to erasure (Art. 17): you can ask us to delete your personal data.
• Right to restriction of processing (Art. 18): you can ask us to pause certain processing.
• Right to data portability (Art. 20): you can receive your personal data in a structured, commonly used format.
• Right to object (Art. 21): you can object to processing based on our legitimate interest.

To exercise any of these rights, email us at dpo@vigil28.eu. We will respond within one month of receiving your request; for complex requests we may extend this period by two further months, and we will tell you about the extension within the first month. Handling a request is free of charge. We refuse only manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with a supervisory authority. In Finland the supervisory authority is the Office of the Data Protection Ombudsman (tietosuojavaltuutettu).

8. Security

We take the security of your personal data seriously and protect it with technical and organisational measures, including encryption in transit (TLS) and at rest, strict access control on a need-to-know basis, and hosting in EU data centres.

Security communication is proactive. We maintain a security.txt file where we publish our contact for vulnerability reports, and we tell affected customers about security problems that concern them, even when the law does not require it. If a personal data breach occurs, we will without undue delay assess the risk to those affected, notify the competent supervisory authority within 72 hours where the GDPR requires it (Art. 33), and inform affected persons where the risk to them is high (Art. 34).

9. Changes to this policy

We review this privacy policy regularly and update it when the service or our processing changes. When a change is material we will notify you by email in advance, and the notification explains what changed. Minor clarifications take effect when published on this page, which always shows the current version with its date.

10. Children

Vigil28 is a business service and is not directed at children or minors. We do not knowingly collect personal data from anyone under 18. If we learn that we hold a child’s personal data, we will delete it.

11. Automated decisions

You will not be subject to decisions based solely on automated processing, including profiling, as described in Article 22 of the GDPR.