1. Data Controller
Altivo Oy (Business ID: 1585540-7) Mutkakatu 11, 53100 Lappeenranta
Altivo Oy provides the Anywhistle notification channel as a technical service. The company using the channel is responsible for processing its own notifications as the data controller, and Altivo Oy processes the data on its behalf in accordance with the agreement entered into with the company.
2. Person in Charge of Registry Matters
Jukka Kolari / Altivo Oy Phone +358 40 529 8630 Email jukka.kolari@altivo.fi
3. Name of the Registry
Anywhistle.com Announcement Channel Announcement Log
4. Legal Basis for the Processing of Personal Data
The registry is needed for receiving, recording, and processing reports submitted through the anonymous whistleblowing channel. This processing is based on the data controller’s legal obligation to maintain an internal reporting channel (Whistleblower Protection Act 1171/2022 and Article 6(1)(c) of the EU General Data Protection Regulation).
5. Purpose of the Registry
The purpose of the registry is to store reports submitted to the Anywhistle reporting channel for processing by companies that use the reporting channel provided by Altivo Oy. The reporting channel is intended to be anonymous, and personal data is not requested or stored by default. If personal data is included in a report, it will be processed within the limits permitted and required by the General Data Protection Regulation, the Data Protection Act (1050/2018), and the Whistleblower Protection Act.
The information in the registry will not be used for advertising or marketing purposes, nor will it be combined with Altivo Oy’s other registries.
6. Standard Sources of Information
Personal information is obtained from the person filing the report if they include it in the report or its attachments, or voluntarily provide their email address. The report may also contain information about other individuals to whom the report pertains.
7. Information Contained in the Registry
- The content of the report and its attachments, as well as messages between the reporter and the reviewers
- The registrant's email address, if they have voluntarily provided it
- The names and email addresses of the data processors, and a log of their activities
8. Disclosure and Transfer of Data Outside the EEA
Reports are accessible only to designated data processors at the company to which the report pertains. The data will not be disclosed to third parties or transferred outside the EEA. The data may be disclosed to authorities only as required by law.
9. Data Retention Period
A processed and closed report, along with its attachments, will be automatically deleted after the retention period specified by the company. Personal data contained in the report will be deleted no later than five years after the report is received, unless retaining it is necessary to comply with statutory rights or obligations. Personal data that is unnecessary for the purposes of the report will be deleted without delay.
10. Privacy and Data Security
The reporting channel is designed so that the reporter can remain anonymous and so that only those individuals whose job it is to handle the report have access to its contents.
Anonymity
- Submitting a report does not require a user account, a name, or contact information. The reporter tracks their report using only a report ID and a secret code.
- The reporting channel does not store the reporter’s IP address or browser information. To prevent abuse, a short-term, non-reversible identifier is generated for the connection; this identifier expires within 24 hours at most and is not linked to the report.
- Location and device information is automatically removed from photos.
- With regard to advertisements, this website uses only session cookies that are necessary for its operation, and these are deleted when you close your browser.
- Providing an email address is optional. The address is stored in encrypted form and is not visible to those processing the report. Email messages do not contain the content of the report. The reporter is informed that the email always leaves a record in the server logs, so the report is not completely anonymous in that case.
Encryption
- Notifications, messages, attachments, and the submitter's email address are stored in the database and on the server in encrypted form. The encryption uses the verified encryption provided by the libsodium library (XSalsa20-Poly1305).
- Each company has its own encryption key, derived from the master key. A company's data cannot be accessed using another company's key.
- The encryption key is stored separately from the database. The database alone, or even a backup of it, is not sufficient to read the records.
- The connection to this site is secured with HTTPS encryption.
Usage Rights
- Only the processors designated by the company handle the reports, and each processor can view only the reports from their own companies. Company data is kept separate from one another.
- The administrator of the notification channel manages the settings and users, but cannot view the content of the notifications. The administrator can only see the number of notifications.
- In addition to a password, the processor requires two-factor authentication to log in. The session expires after 30 minutes of inactivity or 10 hours.
- Every login, notification opened, message, status change, and attachment uploaded is recorded in the event log. The log does not include the content of the notifications.
Server
The service operates on a server located within the EEA and protected by a firewall and access controls. Access to the server is restricted to designated personnel from Altivo Oy and its service provider who are responsible for technical maintenance and who are bound by a duty of confidentiality. The web server’s technical logs are retained only for the short period required for information security purposes.
Manual data
Notifications are not printed on paper unless necessary. Necessary printouts are stored in a locked area and securely disposed of after use.
11. Rights of the Data Subject
Data subjects have the right, under the General Data Protection Regulation, to access their personal data and to request the correction of inaccurate data or the deletion of unnecessary data. The Whistleblower Protection Act restricts these rights when it is necessary to protect the whistleblower’s identity or to ensure the investigation of the report.
The registrant can supplement their registration and submit corrections to it on the tracking page using the registration ID and secret code. For other matters, requests should be addressed to the person at Altivo Oy responsible for registry matters, who will forward them to the company processing the listing, if necessary. The data subject also has the right to file a complaint with the Data Protection Ombudsman.
12. Use of Cookies on the Website
The notification and processing pages use only essential session cookies and do not use analytics or marketing cookies.
On other pages of the site, we use Google Analytics, Google Tag Manager, Google Ads, and the Google Display Network to analyze site usage, form submissions, and support service requests, as well as—with your consent—to target marketing. The data sent to Google is anonymized. You can opt out of the identifiers used for targeted marketing by managing your cookie consent settings, enabling your browser’s “Do Not Track” feature, or blocking third-party cookies. Analytics data is never combined with reports or other records to identify users.
13. Changes to the Privacy Policy
Altivo Oy reserves the right to amend this Privacy Policy by posting a notice on its website. Changes may also be based on changes in legislation. We encourage you to review this policy regularly.
This Privacy Policy was last updated on October 30, 2026.