--- title: "Privacy Policy" description: "How Upperformance Oy uses personal data on TradeRegister.fi: what we collect and why, who receives it, your rights under the GDPR, cookies, and where we process it." url: "https://traderegister.fi/privacy-policy" --- # Privacy Policy > *Updated: October 2026* ## General information on our use of personal data In this privacy notice (the "Notice") we describe how we collect, use, and share your personal data when using our website ([traderegister.fi](https://traderegister.fi/index.md)), our free JSON API and our MCP server, when you communicate with us, and when an official company register names you in a record we show. The website, the API and the MCP server are below named the "Service". Personal data means any information that, directly or indirectly, identifies you, for example, your name or your IP address. We are committed to your privacy. We take measures to ensure that your personal data is protected and that our use of personal data complies with applicable regulations and laws and our internal procedures and routines. ## 1. WHO IS COVERED BY THIS NOTICE? This Notice covers: - Users of our website, our API and our MCP server, including people who let an AI assistant read the Service for them. - Persons named in the public records the Service shows, for example, a company's officers. - Contact persons of a customer, supplier, or partner to us. - External persons who contact or otherwise communicate with us, or are named in such communication, and are not covered by the categories above. ## 2. WHO IS RESPONSIBLE FOR THE USE OF YOUR PERSONAL DATA? Upperformance Oy ("Coragrid", "we", "our" and "us") is responsible for the use of your personal data as described in this Notice. Please see section 11 below for contact information. This Notice does not cover the Coragrid API and the cgd command line, which are governed by the Coragrid Privacy Policy, or third-party services through which you access the Service, whose own privacy policies apply. ## 3. WHICH PERSONAL DATA DO WE COLLECT? We only collect the personal data that we need. We collect and process the following categories of personal data, but which personal data we collect about you, in particular, depends on how you interact with us: - **Identity information.** Information that makes it possible to identify you, for example, your name. - **Contact information.** Information that makes it possible to contact you, for example, your address, email address, and telephone number. - **User-generated information.** Information regarding your activity and use of our website, our API and our MCP server, for example, searches, clicks and visits and your behaviour when using the Service. - **Profile information.** Information regarding your title and name and address of the companies or organisations that you work for. - **Communication.** Contents of communication with us, for example, contents in the email communication or in the support chat. - **Order information.** Information about orders for goods and services, for example, the product or service, price or fee, delivery date or assignment period. - **Technical information.** Technical information about the device or client that you use when using the Service, for example, your IP address, type of device, version of browser, operating system, and the identifier an AI assistant platform sends for you. ## 4. FROM WHERE DO WE COLLECT PERSONAL DATA? We collect personal data from the following sources: - **Yourself.** When you use our website, our API or our MCP server, contact us or communicate with us, we collect the personal data that you provide to us. - **Partners.** If you are the contact person of a customer, supplier, or partner to us, we collect the personal data that it provides to us about you. - **Publicly available sources.** We collect personal data about you from publicly available sources, for example, official company registers and other public records, and we keep the source and observation time of each fact. - **Service providers.** Cloudflare tells us whether a request passed its human verification; where analytics is configured, Google reports aggregated measurements (section 8). - **AI assistant platforms.** When you use the Service through an AI assistant, its platform sends an opaque subject identifier for you, which we use only to apply the per-user allowance. - **External persons.** We collect personal data about you that external persons provide to us, for example, in connection with communication. ## 5. WHY DO WE USE YOUR PERSONAL DATA? Below we explain the purposes with our use of personal data and provide examples of processing activities carried out for each purpose. Please note that not all processing activities may apply to you. Which processing activities that you are covered by depend on how you interact with us. The legal bases that we rely on and for how long we store your personal data are stated at the end of this section. - **Provide the Service.** We use your personal data to provide the Service, for example to answer your searches, serve company records and apply the per-client allowance. - **Analyse the use of the Service.** We use your personal data to analyse the usage of the Service on an aggregated level, for example to collect and analyse statistics of how the Service is used, including information on which companies our users look up and how our users interact with the various functions in the Service. This helps us better understand how the Service is used and how we can continue to develop and improve the Service. We do not profile your personal data for this purpose since analysis is made using aggregated information. We share this aggregated information and anonymised insights, which do not include any personal data, with companies and partners for their own use in their businesses. - **Develop and improve the Service.** We continuously develop and improve the Service in order to provide the best experience possible. We therefore use your personal data for this purpose, for example to develop new features for the website, the API and the MCP server. - **Detect and prevent misuse of the Service.** We use your personal data to detect and prevent misuse of the Service. This is for your and others' safety. - **Manage the relationship with business customers, suppliers, and partners.** If you are a contact person of a business customer, supplier or partner to us, we use your personal data to manage the customer or supplier relationship or partnership, for example, to register you as a contact person, manage invoices and agreements, and to communicate for the same purpose. - **Manage orders of goods and services.** To manage orders of goods and services, we use, where necessary, your personal data for this purpose if you are a contact person for the customer or supplier, for example to manage requests for proposals (RFPs), submit and manage orders, and to communicate for the same purpose. - **Follow up and evaluate the relationship with business customers, suppliers, and partners.** We use, where necessary, personal data about contact persons of business customers, suppliers, and partners to follow up and evaluate the customer or supplier relationship or partnership. - **Respond to questions.** If you contact us, for example by email or through the support chat, with a question, we use the personal data that you share with us to respond to your question. - **Communication between employees and external persons.** We use your personal data, where applicable, in connection with communication, for example, by email, between employees and external persons. - **Enable functionality on this website.** To enable functionality on this website, for example to remember your settings, we use where necessary your personal data. This in order to provide you with a better user experience on the website. - **Ensure technical functionality and security.** We use your personal data to ensure necessary technical functionality and security of this website, our API, our MCP server and our IT systems, for example, for the rate limit, security logging, error handling, and backups. - **Manage and defend legal claims.** If needed, we use your personal data to manage and defend legal claims, for example, in connection with a dispute or court proceeding. For this purpose, we share personal data, when needed, with other recipients. Please see section 6 below. - **Fulfil legal obligations.** To fulfil our legal obligations, if necessary, we will use your personal data, for example, to fulfil accounting or data protection obligations. For this purpose, we may share certain information with other recipients. Please see section 6 below for more information. **Information where personal data is not obtained directly (Article 14).** Personal data from public records is collected from official company registers, not from you. Informing every person named in a register individually would involve a disproportionate effort, so in accordance with Article 14(5)(b) of the GDPR this Notice serves as our public information; we limit the processing to what a register publishes about a person's public role in a company, show each fact with its source and observation time, and you can object (section 7). **Legal bases.** We rely on our legitimate interest (Article 6(1)(f) of the GDPR) in operating, securing and improving the Service, in facilitating B2B commerce and market transparency with personal data from public records, and in managing our business relationships, on your consent (Article 6(1)(a)) for analytics cookies, on the performance of a contract (Article 6(1)(b)) where you are our counterparty, and on our legal obligations (Article 6(1)(c)) where the law requires. **Storage periods.** Request logs are kept for up to 90 days. Addresses used for rate limiting on the website and the API are held in memory only. The MCP server counts calls in our cache store instead, by client address for 2 minutes and by the subject identifier an AI assistant platform sends for up to 32 days, and keeps a copy of recent answers there for at most 15 minutes to answer repeated questions. Emails stay in our mailboxes for as long as handling your request needs them. A support chat conversation is deleted 30 days after you last write in the chat, leave your address or reply to one of our emails; the tr_chat cookie expires 30 days after you last write in the chat or leave your address in the browser, so a conversation continued by email can outlive its cookie. Contact details of business contacts are kept for as long as the relationship lasts, and agreements and invoices for as long as accounting law requires. Personal data from public records is kept for as long as the record remains relevant to the public role it describes and is refreshed from the register, as the [Coragrid Privacy Policy](https://coragrid.com/privacy-policy) describes. Cookie lifetimes are stated in section 8. ## 6. WHICH RECIPIENTS DO WE SHARE PERSONAL DATA WITH? Below we describe which recipients we share your personal data with. Which recipients we share your personal data with depends on how you interact with us. Unless we have stated otherwise below the recipient is responsible (data controller) for its own use of your personal data. - **Other users of the Service.** Personal data from public records, for example, the names and roles of a company's officers, is available to anyone who looks up the company in the browser, through the API or through the MCP server. This is a part of the Service. - **AI assistant platforms.** When you use the Service through an AI assistant, its platform receives the answers to your questions and handles them, and your conversation, under its own privacy policy. - **Service providers.** To process personal data for the purposes described in this Notice, we share personal data with service providers that we have engaged. These service providers provide, for example, hosting in the EU, the Cloudflare edge network and human verification, email services (Amazon Web Services and Google) and, where configured, Google Analytics. When the service providers process personal data on our behalf, they act as data processors for us, and we are responsible for the processing of your personal data. They must not use your personal data for their own purposes and are contractually and legally obliged to protect your personal data. - **External persons.** When we communicate with external persons, for example, via email, we share the personal data that you yourself or employees share with the external person. - **Other recipients.** If needed, we share your personal data with other recipients to manage a merger or sale of the business, to manage and defend legal claims and rights, to fulfil legal obligations, to respond to a request, and to protect and ensure the safety of our staff. Examples of recipients are external advisors, public authorities, courts, law enforcement, and potential buyers and sellers should we sell the business. ## 7. YOUR RIGHTS We normally reply to your request within one month following the date that we received it, as Article 12(3) of the GDPR requires. If your request is complex or you have submitted several requests at the same time, we may extend that time by up to two further months and will tell you why within the first month. If we cannot, wholly or partly, act on your request, we will tell you that and why within the same time. If you submit your request electronically, we respond electronically unless you ask otherwise, and we charge nothing for a reasonable request. When you submit a request to exercise your rights, we need to confirm your identity so that we do not disclose personal data to an unauthorised person or erase personal data in error. We only request the information that is reasonable and necessary to do so. Below we describe the rights that you have in relation to your personal data. - **Right to access (Article 15).** You have the right to request confirmation of whether we handle your personal data and, if so, a copy of it together with additional information on our use of it. - **Right to rectification (Article 16).** You have the right to request that we rectify or supplement your personal data if you consider it incorrect, incomplete or misleading. For personal data from public records, the register that publishes it is the authoritative source: a correction made there flows into the Service. - **Right to withdraw your consent (Article 7).** Where we use your personal data based on your consent, for example analytics cookies, you have the right to withdraw it at any time, on the About page or by contacting us. - **Right to erasure (Article 17).** You have in certain situations the right to request erasure of your personal data, for example if we no longer need it for the purposes for which it was collected, if you withdraw your consent or if you object and we cannot show a compelling reason to continue. The right does not apply where we must keep the data by law or need it to exercise, manage or defend legal claims. - **Right to object (Article 21).** Where we rely on a legitimate interest, including for personal data from public records, you have the right to object for reasons relating to your particular situation. If we cannot show compelling legitimate grounds to continue, we will stop using your personal data for the relevant purpose. You always have an unconditional right to object to direct marketing, which we do not do. - **Right to restriction (Article 18).** In certain situations you have the right to request that we restrict the use of your personal data, for example while we verify its accuracy or your objection; we may then store it but not use it for any other purpose than to manage, defend or exercise legal claims. - **Right to data portability (Article 20).** For personal data you have provided to us that we handle based on your consent or a contract with you, you have the right to receive a copy in a structured, commonly used and machine-readable format and, where technically feasible, to have it transferred directly to another recipient. - **Right to lodge a complaint.** You have the right to lodge a complaint with your supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi). **Automated individual decision-making.** We do not carry out any automated individual decision-making which has legal effects or similarly significant effects on you. The rate limit and the human verification are automated and can reject a request or ask you to show you are a person; if you believe that happened wrongly, contact us and a person will review it. We do not use your personal data to train machine-learning models. **California residents.** If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal data we collect, to request its deletion and to opt out of its "sale". We do not sell personal data in the conventional sense, but under the CCPA's broad definition our search functionality may be considered a sale of personal data from public records, which you may opt out of by contacting us. We will not discriminate against you for exercising these rights. ## 8. COOKIES AND OTHER TECHNOLOGIES The site sets a signed, HTTP-only cookie named tr_human holding only an expiry time for 30 minutes when you pass the human verification, a cookie named tr_consent holding granted or denied for 180 days when you answer the cookie notice, and a cookie named tr_chat holding a random conversation number for 30 days when you write in the support chat. They are used for nothing else, and the site uses no other tracking technologies. Every page loads Google Tag Manager, which runs Google Analytics 4 in Google's Consent Mode. Until you accept, Google Analytics sets no cookies and receives only cookieless measurements of page views, searches and the links you follow, such as the page address, the search term, the time and your browser, with no identifier that links one visit to the next. After you accept, it sets its `_ga` cookies to recognise returning visits; choosing necessary cookies only removes them. Advertising storage, ad personalisation and ad data stay off either way. The [cookie section of our About page](https://traderegister.fi/about.md) lists every cookie the site sets and lets you change your choice at any time. The browser search is also protected by Cloudflare Turnstile for bot detection. For more information, see the [Cloudflare Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/). ## 9. WHERE WE PROCESS PERSONAL DATA We store your personal data within the EU. However, we use service providers, which also may use sub-contractors, that are established in third countries outside the EU/EEA. To ensure an essentially equivalent level of protection for your personal data when transferred to such providers, we rely on the European Commission's adequacy decisions, including the EU-U.S. Data Privacy Framework for certified providers, or on the standard contractual clauses for international transfers adopted by Commission Decision (EU) 2021/914, together with supplementary measures where needed. For more information on the safeguards that we have taken, please contact us. We protect personal data with technical and organisational measures, including encryption in transit and strict access controls, and will notify you and the supervisory authority of a breach that is likely to result in a high risk to your rights, as Articles 33 and 34 of the GDPR require. ## 10. UPDATES TO THIS NOTICE We regularly update this Notice to ensure that it reflects our use of personal data from time to time, for example if we decide to collect additional categories of personal data or to use personal data for additional purposes. We will in such case notify you by appropriate means, for example by a message on this website. The latest version of the Notice is always available on this page, and the date it was last updated is stated above. ## 11. ANY QUESTIONS? If you have questions about this Notice, our use of your personal data or if you wish to exercise your rights, please contact us at [contact@traderegister.fi](mailto:contact@traderegister.fi). If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority in your country. In Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi) is the data protection authority. Upperformance Oy, Business ID 3282334-3, VAT ID FI32823343, registered in the Finnish Trade Register kept by the Finnish Patent and Registration Office. Registered address: Lapinlahdenkatu 16, 00180 Helsinki, Finland. How the Service may be used is described in our [Terms of Service](https://traderegister.fi/terms-of-service.md). --- *This is a markdown version of [https://traderegister.fi/privacy-policy](https://traderegister.fi/privacy-policy) for AI/LLM consumption.*