Privacy Policy

This notice explains what personal data G25 Requests collects when you use this service, why it is collected, how long it is kept, and the rights you have over it. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is Teemu Nätkinniemi, trading as G25Requests, a registered Finnish sole proprietorship (toiminimi).

• Business ID (Y-tunnus): 3606960-8
• Address: Vasikanpolku 1, 65350 Vaasa, Finland
• Contact for data protection matters: [email protected]

We are not required to appoint a Data Protection Officer, and have not appointed one. Data protection enquiries go to the address above.

2. What we collect and why

Data	Why we need it	Legal basis
First name and last name	To identify your order and label the results we send back.	Art. 6(1)(b) — performance of our contract with you
Email address	To deliver your results and to contact you about your order.	Art. 6(1)(b) — performance of our contract with you
The raw autosomal genotype file you upload	To compute your Global25 coordinates. This is the service itself.	Art. 6(1)(b) and, because this is genetic data, Art. 9(2)(a) — your explicit consent
Payment metadata (amount, currency, Stripe transaction reference, payment status)	To confirm your order was paid and to keep required accounting records.	Art. 6(1)(b), and Art. 6(1)(c) for statutory bookkeeping
Technical logs (IP address, timestamp, request path, error details)	To keep the service running, apply rate limits, and investigate faults and abuse.	Art. 6(1)(f) — our legitimate interest in a secure, working service

Genetic data and your explicit consent

A raw genotype file is genetic data, a special category of personal data under Article 9 GDPR. We process it only on the basis of your explicit consent, which you give by ticking the genetic data consent box at checkout. You may withdraw that consent at any time by emailing [email protected]. Withdrawal does not affect processing already carried out, and if you withdraw before we have delivered your coordinates we will cancel the order and refund the fee.

What we never do with it

• We do not sell, licence, rent or share your genotype data with anyone.
• We do not add your data to any research dataset, reference panel or database.
• We do not use it to train models or for any purpose other than producing your own coordinates.
• We do not attempt to identify your relatives, match you against other customers, or infer health information.
• We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22).

3. What we do not collect

We never ask for and never receive passwords, usernames, or account access of any kind for any third-party service, including the DNA testing provider you obtained your file from. You download your own raw data file from that provider and upload it here yourself.

We do not receive your payment card details. Card data is entered on Stripe's own hosted payment pages and is never transmitted to or stored on this site. We see only whether a payment succeeded and its reference.

4. How long we keep it

• Your uploaded genotype file and the computed coordinates are deleted from our servers and from temporary storage once your results have been sent, and in any event no later than 30 days after your order.
• Your name and email address are kept for as long as needed to handle support and refund requests relating to your order.
• Payment and accounting records are retained for the period required by Finnish bookkeeping law (Kirjanpitolaki), currently six years from the end of the accounting year.
• Technical logs are retained for a short period for security and fault diagnosis, then discarded. Logs are forwarded to our log management provider (see section 5), which stores them in the European Union and deletes them automatically after 3 days.
• Error records — created when something goes wrong, so that a customer quoting a reference can be helped without having to reproduce the fault — contain the failing request, your IP address and your browser version. They are kept for up to 90 days and then deleted.

Once you have received your results, keep your own copy. We cannot re-send coordinates after the source file has been deleted.

5. Who else processes your data

We use the following service providers, each acting as a processor on our instructions under a data processing agreement. We do not share your data with anyone else, other than where we are legally required to.

Provider	Purpose	Data involved	Location
Stripe Payments Europe, Ltd.	Payment processing. Card details are entered on Stripe's own hosted checkout and are never received by this site.	Name, email address, payment card data (held by Stripe only), transaction metadata	Ireland / EU, with safeguards for any transfer outside the EEA
DigitalOcean, LLC	Application hosting and temporary encrypted file storage (Spaces, AMS3 region).	Uploaded raw genotype file, name, email address	Amsterdam, Netherlands (EU)
Cloudflare, Inc.	Content delivery, TLS termination and denial-of-service protection.	IP address, request metadata	Global edge network, EU data protection safeguards in place
Google Ireland Ltd. (Gmail API)	Delivery of the results email.	Name, email address, computed G25 coordinates	EU, with safeguards for any transfer outside the EEA
Better Stack, Inc.	Application log storage and alerting, so faults are noticed and diagnosed rather than going unnoticed.	IP address, request metadata, browser user agent, and any name, email address or file name appearing in a log line	Stored in the European Union in ISO/IEC 27001-certified data centres and deleted after 3 days. The provider is incorporated in the United States; see section 6.

6. International transfers

Your uploaded file is stored in the European Union (Amsterdam, Netherlands) and processed there. Where any provider named above processes data outside the European Economic Area, that transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. You may request a copy of the relevant safeguards from us.

7. How we protect your data

• All traffic to this site is encrypted with TLS and HTTP Strict Transport Security is enforced.
• Uploaded files are transferred directly to encrypted object storage using short-lived, single-purpose signed URLs.
• Access to stored files is restricted to the controller and used only to fulfil your order.
• Files are deleted on the schedule set out in section 4.
• A Content Security Policy, anti-clickjacking and anti-sniffing headers, and request rate limiting are applied to the site.

No online service can promise perfect security, but if a breach were to affect your rights and freedoms we would notify the supervisory authority within 72 hours and inform you directly where the GDPR requires it.

8. Cookies

We do not use advertising, analytics or tracking cookies. The only cookies set are strictly necessary ones: a Cloudflare bot-management cookie (__cf_bm) required to protect the site from automated abuse, and Stripe's cookies on Stripe's own checkout pages, governed by Stripe's privacy policy. Strictly necessary cookies do not require consent under the ePrivacy rules.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify data that is inaccurate or incomplete (Art. 16)
• Erasure — ask us to delete your data (Art. 17)
• Restrict how we process it (Art. 18)
• Portability — receive your data in a machine-readable format (Art. 20)
• Object to processing based on our legitimate interests (Art. 21)
• Withdraw consent to genetic data processing at any time (Art. 7(3))

To exercise any of these, email [email protected]. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you believe we have handled your data unlawfully you may lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland — https://tietosuoja.fi/en/home — or with the supervisory authority where you live or work.

10. Children

This service is not directed at children and we do not knowingly process the genetic data of anyone under 16. If you believe a child's data has been uploaded, contact us and we will delete it.

11. Uploading someone else's file

If the genotype file you upload is not your own, you confirm that you have the informed consent of the person it belongs to, or are their legal guardian. You are responsible for having obtained that consent.

12. Changes to this notice

If we change this notice materially we will update the date at the top of this page. The current version always governs.