Privacy policy

Controller

openfactory nordic oy, Saapaskallio 2, 20900 Turku, Finland, operates this service and is responsible for the data processed in the FreeTransit portal. Business ID: 3229298-4. Full contact details are available in the Impressum.

What we process

We process account details, contact information, addresses, request details, ticket references, sponsored resource inventory, generated agreements, uploaded signed agreements, supporting documents, invoice references, outbound service-email records, and operational notes needed to provide and administer FreeTransit and RIPE sponsorship services.

Identity documents

For RIPE sponsorship we may need to validate identity documents or commercial-register extracts. Identity documents are used for verification and are purged from the web application as soon as they are no longer needed for the sponsorship process or compliance review. The portal keeps audit metadata showing that validation happened.

Retention

We keep customer, contract, resource, ticket, and billing records while you are a FreeTransit or sponsorship customer and for as long as required for accounting, legal, dispute-resolution, security, and RIPE-related compliance purposes. If service ends, operational records may be retained where necessary to document previous assignments, invoices, abuse handling, and contractual history.

Accounts with no open request and no service are set to inactive one week after a transit request is closed without being provisioned, or 30 days after the last request is closed otherwise, unless they hold sponsored resources. If an inactive account never had a service, resource, signed agreement or invoice, we delete it, its requests and their records one year after it became inactive. Blocked accounts are kept to prevent misuse.

Recipients and systems

Data may be processed in the FreeTransit portal, openfactory nordic oy ticketing systems, RIPE NCC systems, and our accounting system where needed to operate the service. Until autumn 2026 invoices were issued through Bexio, where the records of those invoices remain archived; from autumn 2026 we move invoicing to Procountor. We do not use external captcha providers on the request form.

IP addresses

When you submit a request, sign in, or change your account, we record the IP address the request came from together with the time and the action. Operator actions are recorded the same way. We process these addresses for security and fraud protection, on the basis of our legitimate interest in protecting the service, our customers and the RIPE sponsorship process from misuse. To check requests where residence or RIPE service-region eligibility matters, we may look up the approximate country of the address through the RIPE NCC RIPEstat service.

IP addresses stored with a request, including those recorded for actions on that request, are deleted 30 days after the request is closed, completed, rejected or cancelled. This applies equally to transfer and cancellation requests. IP addresses recorded for sign-ins and other account or operator actions are deleted after 12 months. Our web servers also keep technical logs that include IP addresses and rotate automatically.

Service email

When FreeTransit sends application-generated service email, we retain the recipient, subject, plain-text message, related customer or case, delivery status, timestamps, and technical message identifier. This provides an operational record of notices and authorization reminders. Failed delivery information may also be retained for troubleshooting.

Your rights

You can request a copy of the data held about you, ask for corrections, and request deletion where retention is no longer required. Portal users can download a machine-readable JSON export from their profile. Staff can also export a client record for handling support or privacy requests.

PeeringDB authentication

When you authenticate through PeeringDB, PeeringDB may provide your user identity, name, e-mail verification status, and the networks and ASNs with which your account is affiliated. FreeTransit uses this information to authenticate portal users and to verify that a new transit applicant is authorised for the selected ASN. We retain the PeeringDB user ID, the relevant ASN verification result and its timestamp for account security and request auditing; OAuth access tokens are not retained.

Contact

For privacy requests, contact openfactory nordic oy through the FreeTransit support channel or by opening a ticket in the portal.