Privacy Policy

How we process personal data and respect your rights.

This privacy policy explains how Sotto Pizzeria processes personal data and how you can exercise your rights as a data subject. We comply with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

Data controller

Sotto Pizzeria Oy

Business ID: 3158814-2

Domicile: Helsinki, Finland

Email for data requests: info@sotto.fi (subject line: ”Data protection request”).

What data we collect

We collect personal data when you contact us, use the site or submit an inquiry:

Contact details: name, email, phone number
Group inquiry details: group size, date, location, selected packages, allergies, possible delivery address
Job application details: name, contact information, CV, motivation, experience
Business contact details (franchise inquiries): company, desired location, background
Technical data: IP address, browser and device details, and information about how the site is used, collected with cookies, browser storage and cookieless measurement (see our cookie policy)
Advertising measurement data, only with marketing consent: advertising identifiers of Meta, TikTok and Google and, when you send a form or subscribe to the newsletter, hashed (SHA-256) contact details: your email address, phone number and name, which we pass to Meta, and your email address, phone number and address, which the Google tag may pass to Google
Newsletter subscription details: email address, language, first name if given, subscription source, time of consent and IP address at signup
Gift card purchase details: buyer email address; when bought as a gift, buyer and recipient names, recipient email address and greeting; amount and payment status
Form submission details: landing page, campaign tags (UTM), device type and the page the form was sent from; for gift card purchases and group orders also the Google Analytics identifier, if you have allowed analytics cookies
Giuseppo chat data, if you use the chat (the AI assistant in the bottom-right corner of the page): your messages and the chat's replies in full, a random identifier for the conversation, the language and times, the address of the page where you started the conversation (including any campaign or ad click identifiers in it), the device type and a hash calculated daily from your IP address. You do not need to give contact details in the chat; if you type them in a message, they are stored with it.
Pizza package feedback request data: details of the order the request concerns (order identifiers and how the order was placed, restaurant, time of the event, delivery method and number of pizzas, and the customer's company, email address, language and, for orders placed with the form, first name), details of sending the request and, if you respond, the rating (1–5) and request to be contacted with their changes and times, any comment, whether the feedback was passed to our customer service, and the time of the first click on the Google review link

Purposes and legal bases

We process your personal data for the following purposes:

Customer service and responding to inquiries — legitimate interest (GDPR Art. 6(1)(f))
Giuseppo chat: we use AI to answer your questions about the menu, restaurants and group orders. We store the conversations and review them to improve the chat and our frequently asked questions. The conversations are copied daily to a SharePoint list in our Microsoft 365 environment, and a daily summary showing the beginning of the first message of each conversation is sent to our email — legitimate interest (Art. 6(1)(f))
Processing inquiries and contracts — pre-contractual / contract performance (Art. 6(1)(b))
Feedback requests for pizza packages: asking for feedback on a completed order, monitoring and improving the quality of our service, and contacting you if something went wrong — legitimate interest (Art. 6(1)(f))
Selling, charging and delivering gift cards — contract performance (Art. 6(1)(b))
Processing job applications — pre-contractual and legitimate interest
Operating and improving the site, and analytics — legitimate interest (essential cookies and cookieless measurement, Art. 6(1)(f)) or consent (analytics and marketing cookies, Art. 6(1)(a))
Monitoring visitor numbers, site performance and marketing results without cookies: Vercel Web Analytics and Speed Insights, and Google's cookieless signals when you have not allowed Google's cookies (Consent Mode) — legitimate interest (Art. 6(1)(f))
Improving the cookie panel: a cookieless choice counter that stores only daily totals of panel views and choices by device type and page language, without cookies, IP addresses or identifiers — legitimate interest (Art. 6(1)(f))
Security and fixing errors: spam and bot protection for forms (Cloudflare Turnstile) and error reports from the site (Sentry) — legitimate interest (Art. 6(1)(f))
Measuring online payments for gift cards and group orders: the payment is recorded in Google Analytics 4 from our server under the same analytics identifier — consent (Art. 6(1)(a)), only if you have allowed analytics cookies
Marketing communications and advertising: newsletter, targeted ads and measuring ad results, also from our server via Meta's Conversions API — consent (Art. 6(1)(a))
Compliance with legal obligations such as accounting — legal obligation (Art. 6(1)(c))

Newsletter and marketing consent

You can subscribe to our newsletter using the signup form on the site or by ticking the newsletter box on the group order form. Ticking the box is voluntary and does not affect how your order is processed. The newsletter is sent about once a month.

The subscription starts only after you confirm it via the confirmation email we send you (double opt-in). The subscription and its consent details – email address, language, first name if given, subscription source, time of confirmation and IP address at signup – are stored in Mailchimp. For consent given on the group order form we additionally store the time of consent, its source and the version of the consent text with the order record, so that we can demonstrate that consent was given.

You can unsubscribe at any time via the link at the bottom of every newsletter or by emailing info@sotto.fi. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Pizza package feedback requests

After a completed pizza package (group order), we usually send one feedback request to the order's email address on the working day after the event, from asiakaspalvelu@sotto.fi. The message contains no advertising or offers. We do not send it if you have stopped feedback requests or if a feedback request has been sent to the same address within the last 60 days. We also mention the feedback request on the group order form. Giving feedback is voluntary. The legal basis is legitimate interest (Art. 6(1)(f)): we want to monitor and improve the quality of our service and put things right if something went wrong.

The rating buttons in the message open a private feedback page. Your rating (1–5), any comment and any request to be contacted are saved only when you send the form, and you can change them for as long as the link is valid (30 days). We keep them with the details of the order. Feedback is handled by our customer service, and we do not publish it. If the rating is 1–2, you ask to be contacted or the comment mentions, for example, an allergy or illness, your feedback and the order's contact details (email address, company and, for orders placed with the form, name and phone number) are passed to our customer service task list (SharePoint) and internal Teams channel in our Microsoft 365 environment so that we can contact you. Feedback is not passed to the restaurants automatically. We process health information only to resolve the matter. If you reply to a feedback request by email, your reply is processed like any other email sent to our customer service, including with the help of an AI assistant (see Anthropic under Data recipients and processors).

After you send your feedback, the thank-you page shows everyone who responded the same link, regardless of the rating, where you can review the restaurant that delivered your pizza package on Google if you wish. A review is voluntary, and we offer no benefits for answering a feedback request or for a review. The link goes through our server: we record the time of the first click on the link with your feedback so that we can follow how the link is used, and our server sends Google Analytics only the fact of the click and the restaurant, without cookies or identifiers relating to you. Your feedback, contact details and feedback link are not passed to Google. The link takes you to Google's service, where Google processes your data, such as the public review you write, as an independent controller under its own terms.

You can stop feedback requests via the link in every message, also after the feedback link's 30-day validity has ended, or by emailing info@sotto.fi, also in advance. When you do, we store only a hash (SHA-256) of your email address and the time you stopped them, so that we no longer send you feedback requests. Stopping them does not affect order confirmations or other messages about your orders.

Retention periods

We retain data only as long as necessary:

Contact messages and feedback: 24 months
Giuseppo chat conversations: 12 months from the start of the conversation, after which the conversation is deleted automatically from our content management system and our Microsoft 365 environment, including from the daily summary emails.
Inquiries and confirmed orders, including the Google Analytics identifier stored with the order: 24 months (accounting records 6 years as required by law)
Pizza package feedback: 24 months from the feedback request. If you stop feedback requests, we keep a hash of your email address and the time you stopped them for as long as we send feedback requests, so that your choice stays in effect.
Gift card purchases: sales records as accounting material for the period required by law (6 years); form submission details and the Google Analytics identifier 24 months
Job applications: 6 months from receipt of the application, unless retained longer with the applicant's consent
Franchise inquiries: 24 months
Newsletter subscription data: until you unsubscribe; a consent given on the group order form is kept with the order record (24 months)
Analytics data: Google Analytics 4 keeps event-level and user-level data for 14 months; the period for user-level data starts again when you return to the site. Microsoft Clarity keeps session recordings for 30 days (recordings marked separately for up to 13 months) and heatmaps for 13 months.
Advertising measurement data: Google, Meta and TikTok keep the data they receive according to their own policies. Cookie durations are listed in our cookie policy.
Cookie choice: stored in your browser and valid for 12 months from your choice, after which we ask again. If you withdraw consent, the site deletes the cookies and stored data of the withdrawn category from the sotto.fi domain; only TikTok's ttclid cookie remains until it expires (see our cookie policy).
Daily totals of the cookie panel choice counter: 400 days
Vercel Web Analytics: the hash used to tell visitors apart is discarded within 24 hours

The same retention periods apply to data copied to SharePoint lists in our Microsoft 365 environment. Deleted data is permanently removed from the Microsoft 365 recycle bins and backups, and from the version history of our content management system, no later than four months after deletion.

Data recipients and processors

We use trusted service providers (data processors). Transfers are based on data processing agreements (DPA) and, where applicable, EU Standard Contractual Clauses (SCC) or the EU–US Data Privacy Framework (DPF):

Wolt Oy (Business ID 2646674-9) — online store order processing, payments and delivery. Wolt acts as an independent controller for its own order records.
Stripe Payments Europe, Limited — online payments for gift cards and group orders (Stripe processes card details; we never see them)
Microsoft Corporation (M365) — email communication and storage (EU servers)
Mailchimp / The Rocket Science Group LLC (Intuit) — newsletter delivery, USA (DPF-certified)
Sanity.io — content management and storage (EU servers)
Vercel Inc. — site hosting and cookieless visitor and performance measurement (Web Analytics and Speed Insights), USA (DPF-certified)
Upstash, Inc. — a helper memory for our server, which we use to limit the number of requests to forms, the chat and other functions to prevent misuse. Your IP address is stored in the request counter and is deleted within 20 minutes at the latest. The helper memory also keeps, for up to two days, the data needed to prevent duplicate group order submissions and to limit the number of order changes and feedback submissions. Located in the USA; the transfer is based on the EU–US Data Privacy Framework and, where needed, the Standard Contractual Clauses.
Cloudflare, Inc. — spam and bot protection for forms (Turnstile): IP address and technical browser details. Cloudflare also uses the data to improve its bot detection as an independent controller. USA (DPF-certified).
Functional Software, Inc. (Sentry) — error reports from the site: error details, page address, browser details and the events on the page that preceded the error, without IP address, cookies or form contents. Data stored in the EU.
Google Ireland Limited — Google Analytics 4 and Google Tag Manager (analytics), and Google Ads and Google Floodlight, part of Campaign Manager 360 (advertising and measuring its results). Google's cookies are used only with your consent; without it, Google's tags send only cookieless signals (Consent Mode). With marketing consent, the Google tag may pass the email address, phone number and address you typed in a form to Google in hashed form (enhanced conversions). Online payments for gift cards and group orders recorded from our server only with analytics consent.
Google (Google Maps Platform) — address search and delivery area check on the group order form. When you type a delivery address, our server sends Google the text you have typed (at least 3 characters) to get address suggestions, and the identifier of the suggestion you choose. When the delivery area is checked, when you send the form and when you change your order, our server sends Google the full address to find its location, and the coordinates of the address to calculate the driving distance to our restaurants. The requests are made from our server, so Google does not receive your IP address or browser details in them. Google is an independent controller for this data. Map images on the site are fetched from Google through our server, so viewing them sends Google no information about you.
Microsoft Corporation — Clarity user analytics (heatmaps and session recordings, only with analytics consent; text typed in forms and the chat is masked), USA (DPF-certified). Clarity is not given permission for advertising storage, so it does not set Microsoft advertising cookies.
Anthropic Ireland, Limited — the AI model (Claude) that we use in the Giuseppo chat and to prepare replies to emails about customer service and group orders and to Google reviews. Our server sends Anthropic the messages of a chat conversation and, for emails, the sender's name and address, the content of the message and its image attachments, and the information needed to handle the matter, such as earlier messages in the same thread, order details including the phone number given in an order, and any previous compensation, but not your IP address or the chat conversation identifier. For Google reviews, we send the reviewer's name, the star rating and the text of the review. By default, Anthropic deletes the data within 30 days, unless it needs to keep it longer to enforce its usage policy or to comply with the law, and does not use it to train its models. The data may be processed outside the EU; the transfer is based on the EU Standard Contractual Clauses.
Meta Platforms Ireland Limited — Meta Pixel and Conversions API (Facebook and Instagram): targeted advertising and measuring its results, only with marketing consent. When you send a form or subscribe to the newsletter, our server sends Meta your hashed contact details (email address, and phone number and name if you gave them), IP address, browser details, the page address and Meta's identifiers. Some browser events pass through a Conversions API Gateway server located in the United States. Meta is an independent controller for the data it receives, and we are jointly responsible with Meta for collecting the data and transmitting it to Meta. The essence of this joint arrangement is set out in Meta's Controller Addendum: we inform you about the processing, and Meta handles requests to exercise your rights regarding the joint processing. You can still exercise your rights against us as well.
TikTok Technology Limited — TikTok Pixel: targeted advertising and measuring its results, only with marketing consent

Transfers outside the EU

Some of our processors are located outside the EU/EEA, primarily in the United States. Such transfers are protected by the EU–US Data Privacy Framework certification or EU Standard Contractual Clauses, together with appropriate safeguards.

Automated decision-making and profiling

We do not make automated decisions with significant legal effects on you. We do not engage in profiling beyond ad targeting, for which we ask separate consent in the cookie panel (Marketing).

Your rights

As a data subject you have the following rights:

Request access to your personal data (GDPR Art. 15)
Request rectification or completion of incorrect data
Request erasure of your data (”right to be forgotten”)
Restrict processing in certain situations
Object to processing based on legitimate interest
Receive your data in a portable format (data portability)
Withdraw your consent at any time (affects only future processing)

To exercise these rights, send a message to info@sotto.fi with the subject line ”Data protection request”. We aim to respond within one month.

Right to lodge a complaint

If you believe that we process your personal data unlawfully, you have the right to file a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

Changes to this policy

We may update this policy when needed. The updated version is published on this page.

Last updated: 29.10.2026