Privacy Policy

How we process personal data and respect your rights.

This privacy policy explains how Sotto Pizzeria processes personal data and how you can exercise your rights as a data subject. We comply with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

Data controller

Sotto Pizzeria Oy

Business ID: 3158814-2

Domicile: Helsinki, Finland

Email for data requests: info@sotto.fi (subject line: ”Data protection request”).

What data we collect

We collect personal data when you contact us, use the site or submit an inquiry:

Contact details: name, email, phone number
Group inquiry details: group size, date, location, selected packages, allergies, possible delivery address
Job application details: name, contact information, CV, motivation, experience
Business contact details (franchise inquiries): company, desired location, background
Technical data: IP address, browser type, site usage via cookies
Newsletter subscription details: email address, language, first name if given, subscription source, time of consent and IP address at signup
Gift card purchase details: buyer email address; when bought as a gift, buyer and recipient names, recipient email address and greeting; amount and payment status
Form submission details: landing page, campaign tags (UTM), device type and the page the form was sent from; for gift card purchases also the Google Analytics identifier, if you have allowed analytics cookies

Purposes and legal bases

We process your personal data for the following purposes:

Customer service and responding to inquiries — legitimate interest (GDPR Art. 6(1)(f))
Processing inquiries and contracts — pre-contractual / contract performance (Art. 6(1)(b))
Selling, charging and delivering gift cards — contract performance (Art. 6(1)(b))
Processing job applications — pre-contractual and legitimate interest
Site improvement and analytics — legitimate interest (essential cookies) or consent (analytics and marketing cookies, Art. 6(1)(a))
Measuring gift card purchases: the purchase is recorded in Google Analytics 4 from our server under the same analytics identifier — consent (Art. 6(1)(a)), only if you have allowed analytics cookies
Marketing communications (newsletter, targeted ads) — consent (Art. 6(1)(a))
Compliance with legal obligations such as accounting — legal obligation (Art. 6(1)(c))

Newsletter and marketing consent

You can subscribe to our newsletter using the signup form on the site or by ticking the newsletter box on the group order form. Ticking the box is voluntary and does not affect how your order is processed. The newsletter is sent about once a month.

The subscription starts only after you confirm it via the confirmation email we send you (double opt-in). The subscription and its consent details – email address, language, first name if given, subscription source, time of confirmation and IP address at signup – are stored in Mailchimp. For consent given on the group order form we additionally store the time of consent, its source and the version of the consent text with the order record, so that we can demonstrate that consent was given.

You can unsubscribe at any time via the link at the bottom of every newsletter or by emailing info@sotto.fi. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Retention periods

We retain data only as long as necessary:

Contact messages and feedback: 24 months
Inquiries and confirmed orders: 24 months (accounting records 6 years as required by law)
Gift card purchases: sales records as accounting material for the period required by law (6 years); form submission details and the Google Analytics identifier 24 months
Job applications: 6 months from the hiring decision, unless retained longer with the applicant's consent
Newsletter subscription data: until you unsubscribe; a consent given on the group order form is kept with the order record (24 months)
Analytics data: according to provider settings (typically 14 months for Google Analytics 4)

Data recipients and processors

We use trusted service providers (data processors). Transfers are based on data processing agreements (DPA) and, where applicable, EU Standard Contractual Clauses (SCC) or the EU–US Data Privacy Framework (DPF):

Wolt Oy (Business ID 2646674-9) — online store order processing, payments and delivery. Wolt acts as an independent controller for its own order records.
Stripe Payments Europe, Limited — online payments for gift cards and group orders (Stripe processes card details; we never see them)
Microsoft Corporation (M365) — email communication and storage (EU servers)
Mailchimp / The Rocket Science Group LLC (Intuit) — newsletter delivery, USA (DPF-certified)
Sanity.io — content management and storage (EU servers)
Vercel Inc. — site hosting, USA (DPF-certified)
Google Ireland Limited — Google Analytics 4 and Google Tag Manager; gift card purchases recorded from our server only with analytics consent
Microsoft Corporation — Clarity user analytics (heatmaps), USA (DPF-certified)
Anthropic PBC — Sotto chat assistant, USA (DPF-certified)
Meta Platforms Ireland Limited / TikTok Technology Limited — targeted advertising (only with user consent)

Transfers outside the EU

Some of our processors are located outside the EU/EEA, primarily in the United States. Such transfers are protected by the EU–US Data Privacy Framework certification or EU Standard Contractual Clauses, together with appropriate safeguards.

Automated decision-making and profiling

We do not make automated decisions with significant legal effects on you. We do not engage in profiling beyond ad targeting, for which we ask separate consent via the cookie banner.

Your rights

As a data subject you have the following rights:

Request access to your personal data
Request rectification or completion of incorrect data
Request erasure of your data (”right to be forgotten”)
Restrict processing in certain situations
Object to processing based on legitimate interest
Receive your data in a portable format (data portability)
Withdraw your consent at any time (affects only future processing)

To exercise these rights, send a message to info@sotto.fi with the subject line ”Data protection request”. We aim to respond within one month.

Right to lodge a complaint

If you believe that we process your personal data unlawfully, you have the right to file a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

Changes to this policy

We may update this policy when needed. The updated version is published on this page.

Last updated: 15 September 2026