Release.fi machinery leasing
Privacy in the leasing-request service.
This privacy information describes the data used to receive and handle a leasing request, the parties involved in processing and the applicant's choices and rights.
Commercial context
Controller and contact
The controller is Release Finland Oy, Business ID 3486207-1. Address: c/o Martin Sundman, Bomansonintie 10 A, 00570 Helsinki, Finland.
Privacy questions and personal-data requests can be sent to [email protected].
Commercial context
Request information and sources
The form requires the company name and Finnish Business ID, contact name, email, telephone, and a short description of the asset to be financed. You can also add a sales-listing link if you wish. The request also includes the correspondence language and source page.
The requested financing amount is optional. Files cannot be submitted through the form. Do not enter personal identity codes, health information or the contents of identity or financial documents in the fields.
The applicant supplies the request information. The company's Business ID is sent to the Finnish Patent and Registration Office's (PRH) Open Data YTJ interface. Returned company names are compared with the supplied name on the server; the complete registry response is not stored. Companies outside its coverage are referred for manual checking. A name mismatch or registry outage stops submission.
Commercial context
Purposes and service providers
Information is used to receive the leasing request, check company details, assess the enquiry and contact the applicant. The automated company check is not a leasing decision.
Release processes business enquiries and company contact details on the basis of its legitimate interests in responding to financing enquiries, verifying company information and preventing misuse (GDPR Article 6(1)(f)). Where an individual applies on their own behalf, processing necessary to take steps towards a contract at their request is based on those pre-contractual steps (Article 6(1)(b)).
The online service uses Cloudflare to host the website and process form requests on the server. Cloudflare Turnstile checks submissions to prevent abuse. The server uses the connection's IP address to create a protected identifier for limiting submissions. Application logs do not contain the raw IP address, complete form contents or Turnstile token.
Resend processes the complete request to send an internal email to Release's application-handling mailbox and sends the applicant a confirmation in Finnish or Swedish. A limited notification can also be sent to a separately configured reporting mailbox, without the applicant's contact details, Business ID or machinery answers.
Ireland is the selected Resend sending region. Resend states that message content, delivery logs and customer data are nevertheless stored in the United States. The Ireland sending region does not restrict storage of this information to the European Economic Area.
Applications are handled by Release's authorised staff. The internal application email is delivered to [email protected] through Google's email service. Limited tracking and technical notifications are delivered to the designated responsible person's Proton mailbox. Cloudflare, Resend and email services may also process information outside the European Economic Area. Cloudflare's and Resend's data-processing terms use the European Commission's standard contractual clauses for applicable transfers. Information about the applicable safeguards and a copy can be requested from [email protected].
Private Cloudflare R2 storage holds a limited processing record: reference, time, language, source page, company-check status and message-processing statuses. Incomplete submissions also retain technical retry information and a protected fingerprint of the message. The R2 record does not contain the complete application. Processing records can be exported to a private file.
The form's privacy checkbox acknowledges that you have read this notice. It is not consent to personal-data processing or marketing and does not establish the legal basis for processing. The form does not subscribe you to marketing messages. Google Analytics and limited traffic-source measurement operate only with separate analytics consent.
With your consent, we use Google’s Google Analytics 4 service to improve the website and contact journeys. We measure page views, application starts, server-confirmed acceptance of new applications, and clicks on telephone, email and WhatsApp links. An accepted application is not a positive financing decision. The legal basis is consent (GDPR Article 6(1)(a)).
Google processes browser identifiers and technical information about the browser, device and connection, and usage events after consent. We do not send applicant or company details, form answers, application references or contact-link destinations to analytics. We use predefined page identifiers and page addresses without query parameters or fragments.
Only after consent do we read traffic-source information available on the current page. From the referrer, we allow only the HTTPS origin, meaning the scheme and hostname, of predefined public search and social services, without paths, query parameters or fragments. From our marketing links, we accept only predefined combinations of utm_source, utm_medium and utm_campaign. Search terms, advertising click identifiers and arbitrary campaign values are not forwarded. The website keeps this limited information only in the current page’s memory, without storing it in its own cookies, localStorage or sessionStorage. Accepted information is sent to Google Analytics after consent. Missing attribution remains unknown; earlier activity before consent is not inferred or reconstructed. Withdrawal clears the source information from page memory.
Analytics does not load before you consent. You can allow or reject analytics, and withdraw consent, using Cookie settings at the bottom of the page. Your choice does not affect the application form. Withdrawal stops the website’s analytics events and removes its analytics cookies; it does not delete information already sent or affect the lawfulness of earlier processing.
Your choice is saved in browser localStorage as release_analytics_consent_v1 for up to 180 days. It contains no application information or unique identifier. After consent, Google uses the _ga and _ga_BQY95JGQ2Y cookies to distinguish users and sessions. The website configures a maximum cookie lifetime of 180 days, without automatically extending it on visits.
GA4’s user-level and event-level retention is set to two months. New activity does not reset user-data retention. This setting does not determine retention of aggregated standard reports. Google signals and user-provided data collection are off. The website does not use analytics consent for advertising personalisation.
Google may process analytics data outside the European Economic Area, including in the United States. Google’s Data Processing Terms provide for processing by Google and its subprocessors and set out safeguards for international transfers. According to Google’s official transfer information, Google relies on the EU–U.S. Data Privacy Framework for transfers of EEA personal data to the United States. For other transfers requiring safeguards, its terms provide for European Commission standard contractual clauses where no applicable alternative transfer mechanism has been adopted. Further information about these safeguards and your data-protection rights is available from [email protected].
Commercial context
Separate storage systems and your rights
The approved retention period for website application information and private processing records is 365 days. For the R2 processing record, this runs from its last update. Martin Sundman is responsible for arranging deletion. This period does not set retention for providers' separate technical logs, backups or other data categories.
Application emails, R2 processing records, technical logs and any exported files are held in separate systems. Deleting an R2 record does not delete emails from Resend or the mailbox, or downloaded export files. The form keeps unfinished answers in page memory and does not store the application in browser localStorage.
You can request access, correction or deletion of your information and, where applicable, restriction of processing, object to processing or request data portability. The rights that apply depend on the processing basis and circumstances. You can lodge a complaint with Finland's Data Protection Ombudsman (tietosuoja.fi).
Practical questions
Privacy questions
When are form answers sent?
Only after you review the information and press submit, when intake is enabled. Selecting the privacy checkbox does not itself send the application.
Where is the complete application stored?
The complete request is sent as an internal email. The private R2 processing record is more limited and is not a copy of the complete application.
How can I raise a privacy question?
Send your request to [email protected].
Start with a short request
Tell us briefly about the machine.
Every request is assessed individually. Optional details can be added after the first contact.