Privacy Policy

Traceira is a service of Plto Oy, a company registered in Finland with its principal place of business in Helsinki. In this policy, "Traceira", "we", "us" and "our" refer to Plto Oy. We provide structured weakness analysis services that combine senior expert analysts with supervised artificial intelligence to assess security, operations, and strategy.

For personal data collected through our website and in our own business operations, Plto Oy acts as the data controller under the EU General Data Protection Regulation (GDPR). Contact details are provided at the end of this policy.

We collect the following categories of personal data:

Analysis request form. When you submit a request through our website, we collect your company name, your name, your work email address, the primary domain or system you identify, your requested analysis depth, and any scope description you choose to provide.

Communications. When you contact us by email or other channels, we collect your contact details and the content of your messages.

Engagement records. When your company becomes a client, we process the names, roles, and business contact details of the people involved in the engagement, together with contracts, correspondence, and delivery records.

Website technical data. When you visit our website, we may collect technical information such as IP address, browser type, device information, and pages visited. We use this information to keep the site secure and to understand how it is used.

We do not intentionally collect special categories of personal data, and we ask that you do not include such data in the scope description or other free text fields.

We process personal data for the following purposes:

To respond to analysis requests and inquiries, and to carry out preliminary scoping reviews you have consented to. Legal basis: steps taken at your request prior to entering into a contract, and your consent.

To deliver our services and manage client relationships, including invoicing and support. Legal basis: performance of a contract.

To operate, secure, and improve our website and services. Legal basis: our legitimate interest in running a safe and reliable business.

To communicate about our services, including relevant updates for existing clients and prospects. Legal basis: our legitimate interest, or your consent where required. You can opt out of marketing communications at any time.

To comply with legal obligations, such as accounting and bookkeeping requirements under Finnish law. Legal basis: legal obligation.

Our analysis work is performed strictly within a scope that the client authorizes in writing. No active scanning begins before a formal contract is signed. During an engagement we may encounter personal data contained in client systems, documents, or logs. Where this happens, we process such data on behalf of and under the instructions of the client, acting as a data processor. The terms of this processing, including confidentiality, security measures, and deletion, are set out in the service agreement and, where required, a data processing agreement with the client.

Findings are reviewed by our senior analysts. We apply strict confidentiality to all client material, and we do not use personal data found in client systems for any purpose other than delivering the agreed analysis.

We do not sell personal data. We share personal data only with:

Service providers that support our business, such as hosting, email, document management, and analytics providers, acting under our instructions and bound by data processing agreements.

Professional advisers, such as lawyers, auditors, and accountants, where necessary.

Authorities, where we are legally required to disclose information.

Parties involved in a corporate transaction, such as a merger or acquisition, subject to appropriate confidentiality protections.

We store and process personal data primarily within the European Economic Area. Where a service provider processes data outside the EEA, we rely on an adequacy decision of the European Commission or appropriate safeguards such as the European Commission Standard Contractual Clauses, together with additional measures where needed.

We keep personal data only as long as necessary for the purposes described above. As a general rule: inquiry and form data is kept for up to 24 months after our last contact if no engagement follows; client engagement records are kept for the duration of the relationship and for the period required to establish, exercise, or defend legal claims; accounting material is kept as required by Finnish law; and website technical data is kept for shorter periods defined by our security and analytics practices. When data is no longer needed, we delete it or anonymize it.

Security is central to what we do. We apply technical and organizational measures aligned with recognized industry frameworks, including access controls, encryption in transit, least privilege principles, logging, and staff confidentiality commitments. Access to client material is limited to personnel who need it to deliver the engagement.

Under the GDPR you have the right to request access to your personal data, to have inaccurate data corrected, to request deletion, to restrict or object to processing, and to receive data you have provided to us in a portable format. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us using the details below. You also have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

Our website may use cookies and similar technologies for essential functionality, security, and analytics. Where consent is required, we ask for it through a notice on the site, and you can adjust your choices through your browser settings or the notice.

We may update this policy from time to time to reflect changes in our services or legal requirements. The current version is always available on our website, and the effective date above shows when it was last revised.

Plto Oy (Traceira)

Helsinki, Finland

Business ID: 3181608-8

Email: pak@traceira.com