Privacy.

This note sets out how Orrery (“we”, “us”, or “the firm”) processes personal information received through this website and in the ordinary course of its work. We are the controller of the personal data described below for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Finnish Data Protection Act.

1. Who we are

Orrery is a private investment firm. For any question relating to the processing of your personal data, please write to contact@orreryy.com. Correspondence may also be directed to our office at World Trade Center Helsinki, Aleksanterinkatu 17, 00100 Helsinki, Finland.

2. What data we process

We process only the personal data you choose to share with us. This typically includes: your name, professional email address, the name of your organisation, and the content of the message you send — including when you use the contact form on this website, which transmits your message to our mail systems so we can reply. Where you correspond with us in connection with an investment or other engagement, we may also process information you share in the course of that engagement.

3. How we use your data

We use your data for the following purposes: (a) to respond to your enquiry; (b) to conduct investment due diligence and related engagements; (c) to maintain records for professional, regulatory, or contractual reasons; (d) to communicate with you about matters reasonably related to the above. We do not use your data for unrelated marketing, and we do not sell or rent personal data to third parties.

4. Legal basis

Our processing is based on one of the following legal bases under Article 6(1) GDPR: your consent (for enquiries submitted through this website); the performance of a contract or steps preceding a contract (for engagements); compliance with a legal obligation; or our legitimate interest in operating a serious professional practice in a manner that respects the people who correspond with us.

5. Sharing

We share personal data only with (i) members of the firm who need access to carry out the purpose for which the data was provided, (ii) carefully selected service providers acting under written confidentiality obligations, and (iii) third parties where we are required to do so by law.

6. International transfers

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards recognised under GDPR, such as Standard Contractual Clauses, and on a case-by-case assessment of the protections available in the receiving country.

7. Retention

We retain personal data only for as long as necessary for the purposes set out above, subject to our professional and legal record-keeping obligations. Enquiry correspondence that does not lead to an engagement is typically retained for no longer than twenty-four (24) months.

8. Your rights

Under GDPR, you have the right to request access to, rectification of, or erasure of your personal data; to request restriction of processing; to object to processing; and, where applicable, to data portability. You may exercise these rights by writing to us at contact@orreryy.com. You also have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman.

9. Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Access within the firm is restricted on a need-to-know basis.

10. Changes

We update this note from time to time to reflect changes in law or practice. Material changes will be reflected in the “last updated” date shown at the top of this page.