Privacy notice - Anywhistle.com

1. Controller

Altivo Oy (Business ID: 1585540-7) Mutkakatu 11 53100 Lappeenranta, Finland

Altivo Oy provides the Anywhistle whistleblowing channel as a technical service. Each company that uses the channel is the controller of its own reports, and Altivo Oy processes the data on the company’s behalf under the agreement made with that company.

2. Contact person for data protection matters

Jukka Kolari / Altivo Oy Phone +358 40 529 8630 Email jukka.kolari@altivo.fi

3. Name of the register

Report register of the Anywhistle.com whistleblowing channel

4. Legal basis for processing

The register is needed to receive, store and handle reports made in an anonymous whistleblowing channel. Processing is based on the controller’s legal obligation to maintain an internal reporting channel (the Finnish Whistleblower Protection Act 1171/2022 and Article 6(1)(c) of the EU General Data Protection Regulation).

5. Purpose of the register

The register is used to store reports made in the Anywhistle channel so that they can be handled by the companies that use the channel provided by Altivo Oy. The channel is intended to be anonymous, and personal data is not requested or stored by default. If personal data is included in a report, it is processed within the limits permitted and required by the GDPR, the Finnish Data Protection Act (1050/2018) and the Whistleblower Protection Act.

The data in the register is not used for advertising or marketing and is not combined with Altivo Oy’s other registers.

6. Regular sources of data

Personal data is provided by the reporters themselves if they write it in the report or its attachments, or voluntarily give their email address. A report may also contain information about other people whom the report concerns.

7. Data contained in the register

The content and attachments of reports and the messages between the reporter and the handlers
The reporter’s email address, if they have voluntarily given it
The names and email addresses of handlers, and an activity log of the handlers’ actions

8. Disclosure of data and transfers outside the EEA

Reports are available only to the designated handlers of the company that the report concerns. The data is not disclosed to third parties and is not transferred outside the EEA. Data may be disclosed to authorities only where required by law.

9. Retention period

A handled and closed report is deleted automatically, together with its attachments, after the retention period set by the company. Personal data contained in a report is deleted no later than five years after the report was received, unless keeping it is necessary to exercise statutory rights or fulfil statutory obligations. Personal data that is not needed for handling the report is deleted without delay.

10. Privacy and data security

The channel is designed so that the reporter can remain anonymous and only the people whose task is to handle a report can access its content.

Anonymity

Making a report requires no user account, name or contact details. The reporter follows the report using only the report ID and a secret code.
The channel does not store the reporter’s IP address or browser details. To prevent misuse, a short-lived, irreversible identifier is created for the connection. It is deleted within one day at the latest and is not linked to the report.
Location and device data are removed from photos automatically.
For reports, only strictly necessary session cookies are used, and they are deleted when the browser is closed.
Giving an email address is optional. The address is stored encrypted and is not shown to the handlers. The emails do not contain the content of the report. Reporters are told that email always leaves a trace in server logs, so the report is then not fully anonymous.

Encryption

Reports, messages, attachments and the reporter’s email address are stored encrypted in the database and on the server. Encryption uses authenticated encryption from the libsodium library (XSalsa20-Poly1305).
Each company has its own encryption key derived from a master key. One company’s data cannot be opened with another company’s key.
The encryption key is kept separate from the database. The database or a backup of it alone is not enough to read the reports.
The connection to the website is protected with HTTPS encryption.

Access rights

Reports are handled only by the handlers designated by the company, and each handler sees only the reports of their own companies. The companies’ data is kept separate from each other.
The channel administrator manages settings and users but cannot see the content of reports. The administrator sees only the number of reports.
Handlers must use two-factor authentication in addition to their password. A session ends after 30 minutes of inactivity or after 10 hours.
Every login, opened report, message, status change and downloaded attachment is recorded in an activity log. The log does not contain report content.

Server

The service runs on a server in the EEA that is protected by a firewall and access control. Only designated persons at Altivo Oy and its service provider who are responsible for technical maintenance have access to the server, and they are bound by confidentiality. The web server’s technical logs are kept only for the short time that data security requires.

Paper records

Reports are printed on paper only when necessary. Necessary printouts are kept in a locked space and securely destroyed after use.

11. Rights of the data subject

Under the GDPR, data subjects have the right to access data about themselves and to request the rectification of inaccurate data or the erasure of unnecessary data. The Whistleblower Protection Act restricts these rights where necessary to protect the reporter’s identity or to safeguard the investigation of the report.

The reporter can add information to the report and send corrections on the follow-up page using the report ID and secret code. Other requests should be sent to Altivo Oy’s contact person for data protection matters, who will forward them to the company handling the report if needed. Data subjects also have the right to lodge a complaint with the Finnish Data Protection Ombudsman.

12. Use of cookies on the website

The report and report handling pages use only strictly necessary session cookies. No analytics or marketing cookies are used on these pages.

On the other pages of the website, we use Google Analytics, Google Tag Manager, Google Ads and the Google Display Network to analyse the use of the website, form submissions and support requests and, with your consent, to target marketing. The data sent to Google is anonymised. You can decline identifiers used for targeted marketing in the cookie consent, by enabling your browser’s Do Not Track feature or by blocking third-party cookies. Analytics data is never combined with reports or other registers to identify users.

13. Changes to this privacy notice

Altivo Oy reserves the right to change this privacy notice by announcing it on its website. Changes may also result from changes in legislation. We recommend that you read this notice regularly.

This privacy notice was last updated on 30 October 2026.