PRIVACY POLICY

Please note that this is a translation of the Finnish language version of the Privacy Policy. In case of any discrepancies between the Finnish version and this English version, the Finnish version shall prevail. Translation updated 6th of November 2026.

1. NAME AND CONTACT DETAILS OF THE DATA CONTROLLER

Mezzoforte Oy (”Mezzoforte”)
Porkkalankatu 20 C
00180 Helsinki

Yhteyshenkilö:

Joonas Pihlajamaa
+358 9 7479 1085
tietosuojavastaava@mezzoforte.fi

2. NAME OF THE REGISTER

User register for the Huutokaupat.com online service.

3. PURPOSE OF THE PROCESSING OF PERSONAL DATA AND LEGAL BASIS FOR PROCESSING

3.1. Purpose of the processing of personal data

Huutokaupat.com is an auction-style online service (‘the Service’) owned and operated by Mezzoforte. Mezzoforte, and in certain circumstances companies belonging to the same group at any given time as well as its partners, process the personal data contained in the register:

To establish, manage and maintain a relationship based on customer status and legitimate interests (such as sending customer letters and other customer-related communications electronically and by other means, handling complaints, etc.);
To provide the Service, in which context personal data may also be disclosed to other Users of the Service to the extent necessary to execute transactions made via the Service between the buyer and the seller and to deliver the subject of the transaction to the buyer;
For the purposes of granting credit and assessing a company or its responsible person;
For invoicing and debt collection purposes;
For profiling, personalising services, and for marketing and advertising (including the targeting thereof);
To prevent and investigate misconduct and fraud;
To fulfil statutory obligations; and
To plan, develop and analyse Mezzoforte’s business operations and the functions of the Service.

Mezzoforte and the companies belonging to the same group as Mezzoforte at any given time also have the right, subject to authorisation or restriction, to use and disclose the data held in the register for legitimate purposes (such as direct marketing, distance selling and market research) in accordance with data protection legislation.

Personal data may be processed by companies belonging to the same group as Mezzoforte at any given time, in accordance with applicable data protection legislation.

3.2. Legal bases for processing

Mezzoforte processes personal data on the legal bases set out in the data protection legislation in force at any given time. The processing of personal data is based, in particular, on:

the contractual relationship between Mezzoforte and the Service User regarding the use of the Service;
Consent given by the Service User, for example where they have consented to the setting of non-essential cookies or to electronic direct marketing;
The legitimate interests of Mezzoforte or a company or partner belonging to the same group at any given time, particularly where personal data is processed on the basis of a customer relationship, for direct marketing purposes, to assess creditworthiness, or to prevent or investigate misconduct; and
A legal obligation, in particular where Mezzoforte processes data contained in invoices or other sales-related documentation in order to comply with liability for errors under accounting legislation or mandatory legislation.

Insofar as Mezzoforte develops the Service, carries out marketing activities or addresses misconduct on the basis of a legitimate interest, Mezzoforte considers that such processing is beneficial to both Mezzoforte and the Users of the Service. The processing of personal data enables Mezzoforte to provide ever-better services, inform people who are likely to be interested about the Service, personalise content in accordance with Users’ preferences, and keep the Service secure for all Users. Mezzoforte strives to be as transparent as possible about its practices and to give Users a say in the matters described in section 9.

Mezzoforte utilises artificial intelligence in customer service, to support e-commerce, and in the analysis and development of the Service and its business operations. Artificial intelligence may assist Mezzoforte’s staff and carry out routine service tasks. The personal data required for these tasks is used for the purposes described in this policy and on the applicable legal grounds for processing.

To the extent that Mezzoforte personalises the content of the Service or targets marketing or advertising, either itself or through partners, profiling of Users is carried out. However, Mezzoforte does not make automated decisions that would have legal effects on Users or that would otherwise significantly affect Users.

4. CONTENTS OF THE REGISTER

The register stores the personal data of individuals who have registered as Users of the Service (“User”). The register may contain the following information about the User:

Basic User details, such as full name, address details, country of residence, date of birth, telephone number, and email address;
If the User identifies themselves as a business user, the name and company registration number of the company they represent, as well as billing details, are also stored; in addition, information obtained during a credit check regarding the company and the person responsible for the company, as well as information collected on the basis of a statutory obligation (such as any tax identification numbers and address details);
The User’s personal identification number (or, on a case-by-case basis, another tax identification number or place of birth) is stored if required by a statutory obligation, as well as details of a vehicle or other similar item in the Huutokaupat.com auction, if required by the item’s registration, transfer, financing or other similar transaction;
Conducting transactions on the Service requires the User to authenticate themselves via an authentication service, in which case the information obtained during authentication – namely the User’s name, date of birth, gender and personal identification number – is stored in the register;
Payments, fees and taxes that Mezzoforte has withheld, invoiced or received from the User;
The number of transactions carried out;
If assets from an estate are sold via the Service, the identifier and contact details of the heir to the estate may be collected from the auction publisher in order to prevent misuse. This information will not be disclosed to the parties to the transaction; and
If a notice regarding the content of the Service is made by someone other than the User, the name and contact details of the person making the notice, as well as the content of the notice, will be stored for the purpose of processing the notice.

The register may also contain other data collected on the basis of a statutory obligation (such as the Act on the Reporting Obligations of Digital Platform Economy Operators in the Field of Taxation (2022/1267)). The provision of the aforementioned personal data is necessary for the conclusion of the agreement concerning the use of the Service and for the execution of the transaction between the buyer and the seller. If the User fails to provide the aforementioned information, Mezzoforte will be unable to enter into a contract for the use of the Service with the User and/or may be obliged to suspend the User’s account until the required information has been provided.

In addition, personal data relating to a person other than the User may be stored in the Register as follows:

If the seller of an auction item published on the Service is someone other than the User, the information mentioned above that is collected from the User may be collected and stored in respect of the actual seller of the auction item (including information required by law);
If the purchase price of an item sold via the Service is paid into the bank account of a party other than the User acting as the seller, the data mentioned above that is collected from the User may be collected and stored in relation to the account holder (including data required by statutory obligations);
If the transferee of a vehicle or other similar item is someone other than the User, the information to be collected from the User as mentioned above may be collected from the transferee, if and to the extent that the registration, transfer, financing or other similar transaction relating to the item so requires; and
From Users engaged in business activities (including agriculture and forestry) other than those organised as limited companies, the personal identification number of the User’s responsible person may be collected, where necessary, for identification, credit management and debt collection purposes.

The following information concerning the User is also stored in the register:

Information relating to invoicing and debt recovery;
Information relating to the customer relationship and contractual relationship, such as products and services, their start and termination dates, details of the service provider and information relating to communication, customer service contacts and complaints;
Information relating to transactions, such as details of bids, auction listings, payments and deliveries;
User IDs and other authentication details;
Consent and opt-out information, such as direct marketing consents and opt-outs;
Areas of interest and other information provided by the User themselves;
Event and user analytics data; and
Segmentation data derived from the above-mentioned data and the observed data described below, e.g. classifying a User as ‘interested in vans’.

In addition, Mezzoforte processes behavioural data observed through the use of cookies and other technologies based on the User’s use of the Service. In collecting and processing behavioural data, Mezzoforte also utilises partners involved in the provision of the Service. Further details on the collection and processing of behavioural data are provided in section 7.

Personal data provided by the user or otherwise collected during the customer relationship may be combined with behavioural data observed through cookies and other similar technologies for the purposes described in section 3.1.

5. REGULAR SOURCES OF DATA

As a general rule, data is obtained from the data subject themselves, for example when registering for the Service or by otherwise requesting it from the data subject, and the data is generally updated on the basis of information received from the data subject themselves.

Mezzoforte may also use Users to assist in the collection of data subjects’ personal data; in such cases, the Users act as Mezzoforte’s data processors. This may be done where necessary to collect the personal data mentioned earlier in this privacy notice from persons other than Users (for example, if a property is sold on a commission basis or the consideration payable for the property is paid into a bank account held by a person other than the User).

Data may also be obtained via the identification service, from the Population Information System of the Digital and Population Data Services Agency and from Posti’s address information system, as well as from other similar public and private registers, as well as from Mezzoforte’s partners and other parties involved in the provision of the Service, to the extent that they are authorised to disclose data to Mezzoforte. Data is also collected through the use of cookies and other similar technologies whilst using the Service.

6. DISCLOSURE OF DATA AND TRANSFERS OUTSIDE THE EU OR THE EEA

Mezzoforte may disclose personal data in the following ways:

Conducting an auction: The User’s personal data is disclosed to a person or company that is a party to the auction with the User. In accordance with clause 6 of the Terms of Use, the auction party receiving the data may use the personal data solely for the purpose of conducting the auction.
Direct marketing and surveys: Personal data may be disclosed to selected partners of Mezzoforte for direct marketing purposes and other legitimate purposes, such as opinion polls, market research and distance selling. If the User has objected to the use of their personal data for these purposes, Mezzoforte will not disclose the data.
Authorities: The User’s personal data may always be disclosed to the authorities on the basis of applicable legislation or other official guidelines or regulations binding on Mezzoforte.
Legal claims and breaches: Personal data may be disclosed to third parties if this is necessary to fulfil a contract, to investigate potential breaches, or to prepare, bring or defend a legal claim, or to recover debts.
Corporate restructuring: Personal data may also be disclosed to a company acting as the transferee in connection with a business transfer or other corporate restructuring.
Consent: Personal data may be disclosed to third parties provided the User has given their consent.

Mezzoforte uses service providers in the processing of personal data, such as providers of IT and cloud services, customer relationship management and customer service, marketing, analytics and artificial intelligence services. Insofar as service providers act on Mezzoforte’s behalf, they process personal data solely in accordance with Mezzoforte’s instructions and on the basis of data processing agreements.

The use of service providers may require the transfer of personal data outside the EU or the EEA, for example to the United States. Such transfers are based on a decision by the European Commission on the adequacy of data protection in the destination country or on another legal basis for transfer under data protection legislation, such as the Commission’s standard contractual clauses and, where necessary, supplementary safeguards. For further information on these safeguards and to obtain a copy of them, please contact the Data Protection Officer

7. USE OF COOKIES AND SIMILAR TECHNOLOGIES

Mezzoforte uses cookies and other similar technologies on the Service to monitor its use. A cookie is a small text file that the browser stores on the User’s device. Cookies contain an anonymous, unique identifier that enables Mezzoforte to recognise different browsers visiting the Service. Only the server that sent the cookie can subsequently read and use it. Mezzoforte does not, on the basis of a cookie alone, obtain information such as the User’s name, email address or similar identifying details. However, if the User has logged in to the Service, Mezzoforte may also link information observed about the User to the personal data provided by the User.

Mezzoforte uses cookies and other similar technologies to track visitor traffic, the use of the Service’s various features, and other interactions between the User and the Service. The data obtained through these technologies is used to improve the quality of the Service, to operate the Service, to analyse usage, to develop Mezzoforte’s business, to personalise the user experience and content, and to target advertising and marketing.

Data observed based on the User’s usage includes, amongst other things, the following:

Actions performed on the Service, such as items, sections and pages viewed, searches carried out and search terms used, viewing of images, and sharing of content
the time, frequency and duration of the visit
the page from which the User accessed the Service
browser type and operating system
device type, such as a computer or mobile device
IP address
session time and duration
screen resolution and operating system
unique identifier, such as a cookie or device ID
interaction with communications, such as whether the User has clicked on an email sent to them
other information collected with the User’s consent.

In addition to Mezzoforte’s so-called first-party cookies, the Service uses so-called third-party cookies. These third parties may include, for example, providers of measurement, tracking and other analytics or advertising services, whose services Mezzoforte uses to analyse the use of the Service, target advertising and marketing, personalise content and develop its business.

Third-party cookies are always subject to the cookie and privacy policies in force at any given time for the relevant service provider, and Mezzoforte has no influence over the content of these policies. Users can view the third parties currently in use and their respective privacy policies. Users can view and edit their cookie settings on the Cookies page.

Users can manage cookies in the following ways:

Service cookie settings: The user may give their consent to the use of non-essential cookies in the Service’s cookie settings. The user may change their choices at any time, for example by withdrawing their consent, by selecting ‘Cookies’ at the bottom of the page.
Private browsing: By using private browsing, the User can limit the collection of data. Private browsing deletes cookies, browsing history and saved passwords stored whilst browsing in a private window when the private window is closed.
Creating a new cookie profile: By clearing cookies from the browser at regular intervals, the User changes their unique identifier, thereby resetting the profile associated with the previous identifier.
Blocking cookies: The User can block cookies via their browser settings. Blocking the use of cookies may mean that not all features of the Service are available. Blocking the use of Google Analytics: The user can prevent the use of website data in Google Analytics by installing a browser add-on that blocks Google Analytics here. This add-on prevents the Google Analytics JavaScript (ga.js, analytics.js and dc.js) running on websites from sharing website visit data with Google Analytics.
Combining data: Users may influence the combination of online behaviour data collected via cookies and other similar technologies with the personal data they have provided by contacting Mezzoforte’s customer service by email: asiakaspalvelu@huutokaupat.com or in writing: Mezzoforte Oy, Porkkalankatu 20 C, 00180 Helsinki.
Opting out of targeted advertising: Some third parties allow you to opt out of targeted advertising on the Your Online Choices website.

Opt-outs made via the links listed above are based on cookies and will cease to apply if the User deletes all cookies from their browser. These settings are browser-specific, so if the User uses multiple browsers, they must make their chosen settings separately for each browser.

8. SECURITY MEASURES AND DATA RETENTION PERIOD

8.1. Data security

The register is in electronic form and is located on a server maintained by a third party, managed by Mezzoforte and protected by firewalls and other technical security measures. Access to the register is granted only to those Mezzoforte employees and other persons acting on its behalf who, by virtue of their duties, need to process personal data. Mezzoforte has ensured that such persons have undertaken to comply with a duty of confidentiality.

8.2. Data retention periods

The retention periods for personal data are as follows:

User account: Mezzoforte generally retains personal data for as long as the User remains registered as a User of the Service. Personal data associated with a user account deemed inactive will be deleted no later than two years after the end of activity. Inactive Users will be reminded of their user account and asked to log in again in order to retain their account. If the User does not log in to the Service even after receiving these reminders, the user account will be deleted. Some data may be retained for longer on the grounds described below.
Purchase transaction data: The personal identification number recorded for the registration, transfer, financing or other similar transaction relating to a vehicle or other comparable item, as well as the personal data of the transferee who is not a User, will be deleted once the relevant transaction has been completed. Insofar as Mezzoforte is a party to the auction, the buyer’s personal data will be deleted once Mezzoforte’s liability for defects, based on mandatory legislation, has expired, but no earlier than two years after the transaction. In order to comply with accounting obligations, personal data contained in accounting records is retained for approximately seven years.
Customer feedback, cancellations, reclamations and content notices: Feedback, cancellations and reclamations submitted by a user or another party to the transaction, as well as any notices regarding the content of the Service, are processed until the matter has been finally resolved. The data is retained for two years from the date the matter is marked as resolved.
Service usage and interaction data: Service usage data collected via cookies and other similar technologies is, as a general rule, retained for a maximum of two years. With regard to newsletters, information on when newsletters are opened is stored in the customer relationship management system and remains there for as long as the user account is active and the newsletter has not been deleted from the system. This information is used to improve our communications.
Direct marketing: If a User does not have a user ID for the Service but subscribes to a newsletter, the subscription remains active until the User cancels the subscription or the sending of newsletters is discontinued.
Moderation, usage restrictions and prevention of misuse: Information regarding notices, warnings and usage restrictions issued to the User, as well as the grounds for them, shall be retained for as long as is necessary to implement the moderation decision, to monitor the applicable usage restriction and to prevent misuse. A one-way encrypted identifier, which is necessary for enforcing a restriction on use and preventing misuse, may be retained for the corresponding period. This data may also be retained after other data relating to the user account has been deleted. In the case of usage restrictions lasting up to six months, the data will be deleted two years after the end of the usage restriction; in the case of longer usage restrictions, the data will be deleted upon the expiry of the usage restriction, unless its retention is still necessary due to a legal claim, a dispute or a matter involving the authorities.
Information on heirs to an estate: Information collected on heirs to an estate for the purpose of preventing misconduct and fraud shall be deleted no later than two years after the completion of the sale of the last item from the estate sold via the Service.
Statutory obligations: Personal data concerning Users and other registered individuals may be retained to the extent and for as long as necessary to comply with legislation or an official decision binding on Mezzoforte.
Legal claims and disputes: Notwithstanding the retention periods described above, Mezzoforte may retain data relating to Users and other registered users, user accounts, the use of the Service, interactions and transactions carried out on the Service to the extent and for as long as necessary to prepare, bring or defend a legal claim, or to deal with a dispute or a matter before a regulatory authority. The data retained shall be limited to that which is necessary for the matter in question. The data shall be deleted once its retention is no longer necessary, taking into account the handling of the matter and the applicable limitation periods for bringing legal action, appealing against a decision and the expiry of claims.
User’s request for erasure: Mezzoforte will erase the User’s personal data at the User’s request, provided that the conditions for erasure laid down in the General Data Protection Regulation are met. However, data will not be erased to the extent that its retention is necessary to enforce a valid restriction on use, to comply with Mezzoforte’s legal obligations, or to establish, exercise or defend a legal claim.

9. RIGHTS OF THE DATA SUBJECT

The user or any other data subject has the right, in accordance with the applicable data protection legislation at any given time:

To access their personal data processed by Mezzoforte and to check what information has been stored about them;
To request the rectification, completion or erasure of their personal data if the data is inaccurate, unnecessary, incomplete or out of date, or to amend, supplement or delete their own data on the Service;
To object to the use of their data for direct marketing or profiling;
To object to processing based on a legitimate interest, on grounds relating to their particular situation. For example, in such a situation, processing will be restricted for the duration of the assessment of the grounds for objecting to the processing. Processing may also be restricted, for example, where the User disputes the accuracy of their personal data, in which case processing will be restricted for the period required to verify the accuracy of the data;
Request the transfer of data provided by the User from one system to another, provided that the data is processed automatically on the basis of consent or a contract;
To withdraw the consents given to Mezzoforte to the extent that the processing of personal data has been based in part on consent, without this affecting the lawfulness of any processing carried out prior to the withdrawal of consent.

Statutory grounds may restrict the above-mentioned rights of the User or any other data subject.

Requests relating to the rights mentioned above must be submitted:

By email to asiakaspalvelu@huutokaupat.com or in writing to Mezzoforte Oy, Porkkalankatu 20 C, 00180 Helsinki. Mezzoforte may request further information to verify the User’s identity.

Personal data may be retained and used where necessary to comply with legal obligations, to resolve disputes or to fulfil contractual obligations.

The User has the right to lodge a complaint with the relevant authority if they consider that their data has been processed in breach of this privacy policy or the data protection legislation in force at the time.

Office of the Data Protection Ombudsman
Link to website: tietosuoja.fi
Switchboard: 029 56 66700
Email: tietosuoja(at)om.fi

10. JOINT CONTROLLERSHIP

Mezzoforte acts as a joint controller when it maintains a page on Facebook. With regard to statistical visitor data for Mezzoforte’s Huutokaupat.com Facebook pages, Meta Platforms Ireland Limited (“Meta”) and Mezzoforte are joint controllers. Further information on the processing of personal data can be found in Meta’s Privacy Policy (link).

11. AMENDMENTS TO THE PRIVACY POLICY

We reserve the right to update this Privacy Policy, for example, due to the development of the Service or mandatory legislation. Changes and updates to the Privacy Policy will be announced on the Service.

We recommend that you review the contents of the Privacy Policy regularly. The changes published in May 2018 were based on the entry into force of the EU General Data Protection Regulation (GDPR). In December 2019 and January 2023, clarifications were made to the Privacy Policy, particularly regarding the use of cookies and the User’s ability to exercise control. Following the entry into force in 2023 of the Act on the Reporting Obligations of Digital Platform Economy Operators in the Field of Taxation (2022/1267), the privacy policy was updated in December 2023. In June 2025, the privacy policy was clarified with regard to the retention periods for personal data. In August 2025, information on the use of artificial intelligence in customer service was added to the privacy policy. In November 2026, the privacy policy was clarified, particularly with regard to the use of artificial intelligence, service providers, transfers outside the EU and the EEA, and retention periods.