Privacy Policy
How Rock Metal Works collects, uses, stores, and protects information submitted through this website, and how you can exercise your rights.
Last updated: 5 August 2026. This notice explains how Rock Metal Works handles personal data submitted through this website. It applies to the public pages, contact forms, job applications, open applications, newsletter sign-up, and the password-protected staff administration area.
Who is responsible for your data
Rock Metal Works is the controller for personal data collected through this website. To ask a question, exercise a right, or request deletion, use the contact details on our Contact Us page. We may ask for enough information to verify your identity before releasing or changing personal data.
What we collect and why
| Where | What we collect | Purpose and legal basis |
|---|---|---|
| Get a Quote form | Name, email, phone, subject, your message, and consent record | To respond to your request and discuss a possible contract. Processing is necessary for steps requested before a contract and for our legitimate business interest in handling enquiries. |
| Contact Us form | Name, email, phone, your message, and consent record | To answer your enquiry. Processing is necessary for the requested communication and our legitimate interest in maintaining business correspondence. |
| Job application / Open application | Name, contact and address details, education, work experience, availability, your message, CV file, and consent record | To assess you for the role you chose or suitable future roles when you submit an open application. Processing is based on steps requested by you before possible employment and your consent to keep the application for recruitment. |
| Newsletter signup | Email address, subscription status, confirmation and unsubscribe records | To send occasional company updates after double opt-in. Processing is based on your consent, which you can withdraw at any time. |
| Staff administration area | Admin account email, password hash, sign-in timestamps, and security audit records | To authenticate authorised staff and protect the site and submitted data. Processing is based on our legitimate interest in security and, where applicable, legal obligations. |
We do not ask for special-category data. Please do not include health, trade-union, political, religious, or other sensitive information unless it is genuinely necessary and you have a lawful reason to provide it.
How we use and share it
We use the information for the purpose stated beside the relevant form, to communicate with you, to manage recruitment, to prevent abuse, and to meet legal obligations. Authorised Rock Metal Works staff can access submissions through the password-protected admin area.
Form and newsletter messages may be sent through the SMTP email delivery service configured for the website. The website and its SQLite database are hosted on the configured server infrastructure (currently Oracle Cloud Infrastructure). These providers act as service providers for the functions they perform and may process data under their own contractual terms. If a different provider or hosting region is configured, this notice should be reviewed and updated.
We do not sell personal data, use it for advertising profiles, or share it with data brokers. We disclose information only to service providers needed to operate the site, to professional advisers where necessary, or to public authorities when the law requires it.
How long we keep it
We keep information only as long as it is needed for the purpose collected, to resolve a dispute, or to meet a legal obligation. The administrator can enable a scheduled retention cleanup for contact requests, quotes, applications, CV files, email delivery logs, and unconfirmed newsletter sign-ups. It is off by default; when enabled, the configured period is shown in the admin settings and is between 7 and 3,650 days. Confirmed newsletter subscriptions remain until you unsubscribe or ask us to remove them.
When an application or lead is erased, the record is permanently removed and uploaded CV files are deleted from the private storage area. Backups and security logs may retain limited information for a reasonable period before their normal expiry.
Security
CV files are stored outside the publicly served website directory and require an authenticated staff download. The admin area uses password hashing, secure cookies, antiforgery protection, access policies, and audit logging. No internet system can be guaranteed completely secure, so please contact us promptly if you believe you sent information to the wrong place.
Cookies and technical data
The public site does not use tracking, analytics, advertising, or third-party marketing cookies. A strictly necessary authentication cookie is used only for staff administration. The server may record ordinary technical request information in operational logs for security and troubleshooting; it is not used to build advertising profiles.
Your rights
Subject to the conditions in the GDPR, you can ask us to access, correct, delete, or restrict use of your personal data, object to certain processing, receive a portable copy, or withdraw consent. Withdrawal does not affect processing carried out before withdrawal. Contact us using the details on the Contact Us page; you can also complain to the Office of the Data Protection Ombudsman in Finland.
Changes to this notice
We may update this notice when the website, services, or legal requirements change. The latest version and its update date are always published on this page.