Privacy
Privacy Notice
Last updated 14 September 2026
This notice explains how Kanto Systems Oy processes personal data in the Pakkausvastuu service and on pakkausvastuu.fi. The service is for businesses. We still process personal data, because contact persons, signatories and sole traders are people. We follow the EU General Data Protection Regulation (2016/679, "GDPR") and the Finnish Data Protection Act.
1. Data controller
Kanto Systems Oy (Finnish business ID 3636096-4). Email: info@kantoeco.fi. For privacy matters, write to the same address with the subject "Privacy".
2. What data we process
Waiting list
Email address and the time you joined.
Quote request
Company name, webshop address, contact person's name and email, number and list of destination countries, and a free-text description of your packaging and sales volumes.
Customer relationship
- Company identifiers: business ID, VAT number, address, billing details.
- Name, role, email and phone number of the signatory and contact person. Some countries require the signatory's date of birth or a copy of an identity document for registration or a notarised power of attorney. We ask for these only when the destination country requires them, and we tell you so separately.
- Powers of attorney and registration documents.
- Packaging data, photos of packaging, materials and weights, and estimated and actual sales volumes per country. This is mostly business data, but it can contain personal data, for example for a sole trader.
- Registration numbers in destination countries, producer responsibility organisation (PRO) contract details and deadlines.
- Login credentials for national registers and PRO portals when a registration must be made in the customer's own name. See section 8.
- Communication with us: emails, calls and notes of them.
Website use
Server logs (IP address, timestamp, requested page, browser type) for security and troubleshooting. We use no marketing or tracking cookies. If we add visitor statistics, they will be cookieless and will not identify individual visitors.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Telling you when the service opens | Waiting list | Consent (a). You can withdraw it at any time. |
| Preparing a quote and the free obligation check | Quote request | Pre-contractual steps (b) and legitimate interest (f) for the business customer's contact person. |
| Delivering the service: registrations, mandates, PRO memberships, reporting, invoicing | Customer relationship | Performance of a contract (b). |
| Accounting and tax | Billing and contract data | Legal obligation (c), Finnish Accounting Act. |
| Security, abuse prevention, service development | Logs, usage data | Legitimate interest (f). |
| Customer communication about service changes and deadlines | Contact details | Performance of a contract (b) and legitimate interest (f). |
We make no automated decisions with legal effects and we do not profile.
4. Who we share data with
By its nature the service requires passing data to parties in the destination countries. We share only what each registration or report requires.
- Authorities and national producer registers in destination countries (for example LUCID in Germany, ADEME in France, Naturvårdsverket in Sweden).
- Producer responsibility organisations in destination countries (for example ARA, Fost Plus, Citeo, NPA).
- Authorised representatives in countries where a foreign seller needs a local representative. We use partners established in the EU. We name the partner per country in your quote before anything is done.
- Notaries and translators when a destination country requires a notarised power of attorney or a certified translation.
- Technical service providers: website and form hosting (Netlify, Inc., United States), email and office tools, accounting and invoicing services. They process data on our behalf under contract.
- Finnish authorities where the law requires it.
We never sell or rent personal data.
5. Transfers outside the EU and EEA
The service itself is delivered inside the EU. Our website and form hosting provider Netlify is located in the United States. The transfer relies on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. We make no other transfers outside the EU without separate notice.
6. Retention
- Waiting list: until the service opens and we have told you, or until you withdraw consent. At most 24 months.
- Quote requests that do not become customers: 12 months from the last contact.
- Customer data: for the duration of the contract and 6 years from the end of the financial year afterwards (Accounting Act). Registration and reporting documents are kept for the same period, because destination-country authorities can request them later.
- Portal credentials: deleted or returned to you within 30 days of the contract ending.
- Server logs: 30 days.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to object to processing based on legitimate interest, to receive the data you provided in a portable format, and to withdraw consent. The right to erasure is limited by statutory retention duties, for example for accounting records.
Send requests to info@kantoeco.fi. We reply within one month. If you believe we process your data unlawfully, you can lodge a complaint with the Finnish Data Protection Ombudsman: tietosuoja.fi.
8. Portal credentials and security
In many countries a registration must be made in the producer's own name, so we need access to your accounts in national registers or PRO portals. We keep credentials in an encrypted password manager accessible only to the people delivering the service. We recommend that you create a separate user account for us where possible, or change the password when the contract ends. Two-factor authentication is handled in a way agreed with you separately. We protect data through restricted access rights, encrypted transfer and backups.
9. Cookies
The site uses no marketing or tracking cookies. Form spam protection may set a strictly necessary cookie that does not identify you. If our cookie practice changes, we will update this notice and ask for consent where required.
10. Changes
We update this notice when the service or the law changes. We notify customers of material changes by email. The current version is always on this page.