Privacy Notice
Last updated: 29 September 2026 · Värdevia Oy · Y-tunnus 3544262-6
Scope of this notice
This notice covers both the Värdevia Oy website and the Värdevia Renewable Fuels of Non-Biological Origin Diagnostic (“the Diagnostic”). Where this notice refers to “the Diagnostic” alone, it means that tool.
Who we are
Värdevia Oy is a Helsinki-based consultancy registered in Finland (Y-tunnus 3544262-6), Kaanaankatu 6A5, Helsinki. Contact for data protection matters: info@vardevia.fi.
Website contact form
When you use the contact form we collect your name, work email, company, role, project stage, and message, solely to respond to your enquiry and scope an engagement. We retain this for 24 months from our last contact, then delete or anonymise it. We do not sell or share your data for marketing, and we do not use tracking cookies or third-party analytics on this site.
The Värdevia RFNBO Diagnostic
The Diagnostic is a self-assessment tool delivered as part of Värdevia’s practice. It involves more information than the contact form.
Project information. When you begin an assessment we record your role, the project’s lifecycle stage, the products you intend to place on the market, the intended end market, the certification scope, and your answer to each question.
Optional intake form. If completed: company and project name, registration number, country or region, your name, role, email, telephone, voluntary scheme and certification status, electrolyser technology and capacity, production target, renewable electricity source, grid and power purchase agreement (PPA) status, certification body engagement, management system, greenhouse gas (GHG) calculation and mass balance status, target certification date, and funding and off-take status. This form is optional; the assessment can be completed without it.
Report access. Before the report is shown we ask for your name, organisation, and work email address.
Auction self-assessment. If completed: tender, round, submission deadline, technical details, and (where signed) the name, role, organisation of signatory, and date.
Registered interests. If you register a project on a route we cannot yet assess: your name, organisation, email and description.
Acceptance of terms. We record when you accepted the Terms of Use, the version in force, and whether you gave the optional contact permission.
Why we process it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Run the assessment, calculate the result, and produce your report | Performance of contract (Article 6(1)(b) GDPR) |
| Keep your assessment so you can return to your report | Performance of contract |
| Respond to enquiries and registered interests | Contract or legitimate interest |
| Contact you about regulatory developments relevant to your assessment | Consent (Article 6(1)(a) of the General Data Protection Regulation, or GDPR), optional and withdrawable |
| Improve the Diagnostic using aggregated data (not your identity) | Legitimate interest (Article 6(1)(f) GDPR) |
| Keep records of business activity | Legitimate interest and Finnish accounting law |
Withdrawing the optional contact permission does not affect your ability to use the Diagnostic.
Automated processing
Your score, identified gaps, and action priorities are produced automatically from your answers. This is indicative only: it produces no legal effect and no decision is taken about you on the basis of it. Certification decisions rest exclusively with an accredited certification body. Contact us if you believe a result is wrong.
Who else is involved
The Diagnostic runs on infrastructure provided by Supabase (database and application data, hosted within the European Union) and Lovable (application hosting, European Union). Each acts as a processor under written terms and only on our instructions. We do not sell your information or share it for marketing.
How long we keep it
| Category | Retention |
|---|---|
| Assessment answers and reports | 24 months from last activity, then deleted or anonymised |
| Contact details given to open a report | 24 months from our last contact with you |
| Registered interests | 36 months, or until you ask us to delete them |
| Signed auction self-assessments | Six years (Finnish accounting legislation) |
You can ask us to delete your information sooner at any time.
Cookies
The Diagnostic uses only the storage necessary to keep you signed in to your own assessment while you complete it. We do not use tracking cookies or third-party advertising or analytics.
Your rights
Under the GDPR you have the right to access, correct, or request deletion of your personal data, and to object to or restrict certain processing. Write to info@vardevia.fi; we will respond within one month. You also have the right to complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.
Changes
We may update this notice. The version in force is the one published here. Last updated: 29 September 2026.
Glossary
| Term | Meaning |
|---|---|
| the Diagnostic | The Värdevia RFNBO Diagnostic, the self-assessment tool described in this notice. |
| EU | European Union. |
| GDPR | General Data Protection Regulation (EU) 2016/679. |
| GHG | Greenhouse gas. |
| PPA | Power purchase agreement: a contract for the supply of renewable electricity. |
| RFNBO | Renewable Fuels of Non-Biological Origin: the category of hydrogen and e-fuels defined under the Renewable Energy Directive (RED III), Directive (EU) 2023/2413. |