Privacy Policy

1. What this is

This Privacy Policy describes how Bittilafka Oy processes personal data in the Listalla.com service ("Listalla"). It explains what data we collect, how we use it, who we share it with, and what rights you have.

Listalla collects sparingly: as little data as possible, retained for as short a time as possible, with no user tracking. There is no cookie consent banner because we do not use cookies or tracking technologies that would require consent.

2. Controller and contact

• Controller: Bittilafka Oy
• Business ID: 3217396-9
• Address: Pitkämäentie 35 A, Helsinki, Finland
• Privacy matters: support@listalla.com

Bittilafka Oy has no statutorily required Data Protection Officer. For privacy-related questions, contact the email above.

3. What data we collect and why

We collect the data listed below and process it for the stated purpose on the stated legal basis. Most data is necessary for the operation of Listalla; data marked optional is genuinely optional. The legal-basis column reflects Listalla's own basis for processing; the Venue Provider's independent controller role is described in section 6.

We do not perform automated decision-making, profiling, or marketing-based tracking.

4. Sources of data

We mainly receive data from you when you register, make a booking, or fill in your profile. In addition:

• Stripe (payment service provider) provides us with the status of payment transactions (e.g. confirmed, cancelled, refunded).
• IP addresses and technical log data are generated automatically from your browser's connection to Listalla.

5. Who we share data with

We do not sell or rent your personal data. Data is shared with third parties only in the following cases:

• The Venue Provider whose venue you book: name, email, phone number (if provided), and booking details. The Venue Provider processes this data as an independent controller, see section 6.
• Stripe Payments Europe Ltd (Ireland, payment service provider): name, email, and payment-related data when you use Listalla-facilitated payment. Stripe acts in part as a processor on Listalla's behalf (technical payment execution) and in part as an independent controller (e.g. fraud prevention, statutory obligations).
• Hetzner Online GmbH (Germany): server infrastructure provider. Listalla's dedicated server is located in Hetzner's data center in Finland; the contract is with Hetzner's German parent company. Hetzner processes data as a processor on Listalla's behalf.
• Amazon Web Services EMEA SARL (Luxembourg, AWS Simple Email Service, Stockholm region): email service provider. We use AWS SES to send login codes and booking messages. Email messages are transmitted and stored in AWS's Stockholm region. AWS processes data as a processor on Listalla's behalf.
• Google Ireland Limited (Ireland): if the Venue Provider for your booking has connected the Google Calendar integration, Listalla writes booking data to the Venue Provider's Google Calendar and reads busy times from it for booking management. Google's subsequent processing of the data is governed by the agreement between the Venue Provider and Google; Listalla relays the data on the Venue Provider's instruction. If the Venue Provider has not connected the integration, no data is sent to Google.
• CARTO (CARTO DB Inc.) and the OpenStreetMap community: the map showing the venue's location loads tile images from CARTO's CDN, which is built on OpenStreetMap data. Your browser connects directly to CARTO's servers, exposing your IP address and the currently visible map area to them. Listalla does not transmit any other personal data to CARTO, and rendering the map is necessary to display the venue's location (contractual performance, GDPR 6(1)(b)).
• Authorities: where required by law or court order.

6. Venue Provider as independent controller

When you make a booking, the data needed to fulfil the booking is shared with the Venue Provider. From that point onward the Venue Provider is an independent controller for the data in their own customer relationship: they process the data for their booking handling, customer service, and their own statutory obligations.

Bittilafka Oy and the Venue Provider do not jointly determine the purposes of processing and are not joint controllers within the meaning of GDPR Article 26; each has its own separate controller role.

Venue Providers may use their own third-party tools (e.g. calendar, CRM, or accounting systems) to manage their bookings. Where a Venue Provider has connected such an integration in Listalla, Listalla relays booking data to the system the Venue Provider has chosen, on the Venue Provider's instructions. Processing in that system is then governed by the Venue Provider's own privacy notice and the terms of the system provider.

To exercise your rights with respect to data processed by a Venue Provider, contact that Venue Provider directly using the contact details in your booking confirmation.

7. Retention

We retain data only for as long as needed for each purpose or required by law.

After account deletion, data that the law requires us to retain (e.g. accounting records) is kept for the legally required period; other data is deleted or anonymized.

8. International transfers

Personal data is mainly processed and stored within the European Economic Area (EEA): Listalla's own server is in Finland, email service is in Stockholm, and Stripe's European operations are in the EU.

Some processors operate within an international group that also has operations outside the EEA, in particular in the United States:

• AWS and Stripe: the primary data location is in the EEA, but internal support and certain administrative functions within these groups may involve limited non-EEA access.
• Google (when a Venue Provider uses the Google Calendar integration): calendar data in the Venue Provider's Google account may be located in Google's global infrastructure depending on the Venue Provider's account configuration.

Such transfers are protected by:

• The EU-US Data Privacy Framework (DPF) where the recipient is certified under the framework. Stripe, AWS, and Google are all DPF-certified.
• Commission-approved Standard Contractual Clauses (SCCs) as a complementary basis in the contracts.
• Technical and organizational safeguards, including encryption at rest and in transit and access controls.

For Hetzner Online GmbH, processing takes place entirely within the EEA and no transfers outside the EEA occur.

9. Cookies and local storage

Listalla uses only strictly necessary cookies:

• Session token: keeps you signed in for the duration of the browser session.

Listalla uses no advertising, ad targeting, social media embeds with cookies, third-party marketing tracking, or any other cookies or similar technologies that would require consent. Because of this, there is no cookie consent banner.

Under section 205 of the Finnish Act on Electronic Communications Services (917/2014), consent is not required for cookies that are strictly necessary for delivering a service the user has requested. Our session cookie falls within this exemption.

10. Analytics and tracking

We use aggregated, anonymized usage statistics to improve Listalla. The analytics are implemented directly within Listalla's own service infrastructure; we use no third-party analytics services. The statistics are irreversibly anonymized and contain no information that could be linked to an individual user or device. Such data is not personal data within the meaning of the GDPR.

We do not use Google Analytics, social-media pixels, or any other tracking tools that would identify users or build profiles.

11. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, loss, and disclosure. These include encrypted connections (HTTPS), access controls, password-less authentication, and regular review of security practices.

If a data breach affects your personal data in a way that is likely to result in a high risk to your rights, we will notify you and the Data Protection Ombudsman in accordance with the GDPR.

12. Your rights

You have the rights granted by the GDPR:

• Right of access: to know whether we process your personal data and to receive a copy.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to have your data deleted when there is no longer a basis for processing. Records we are required by law to retain cannot be erased before the retention period ends.
• Right to restriction: to restrict processing in certain situations.
• Right to portability: to receive data you have provided in a machine-readable format and to transfer it to another service.
• Right to object: to object to processing based on legitimate interest.

To exercise your rights, send a message to support@listalla.com. To verify the request, we send a one-time login code to the email address registered to your account so you can confirm that the request is yours.

We respond without undue delay and at the latest within one month.

13. Right to lodge a complaint

If you believe we process your personal data in breach of the GDPR, you may lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

14. Changes to this notice

We may update this Privacy Policy. We notify users by email of material changes at least 14 days before they take effect. The current version and effective date are always shown at the top of this notice.

15. Effective date and languages

This Privacy Policy enters into force on 11 May 2026. The notice is available in Finnish and English. In case of conflict, the Finnish version prevails.