Privacy notice

1. Data controller

2. Purposes and legal bases of processing

We process data to respond to enquiries, prepare an assessment or quotation requested by you, begin a client relationship, and prevent misuse of the form and website.

• Steps taken before entering into a contract when you request an assessment or quotation.
• Our legitimate interest in responding to business enquiries and protecting the service from misuse.
• Legal obligations if the enquiry leads to a client relationship.

3. Data we process

• Name, email address, and optional company name.
• The contents of your message or product idea, package selection, and target timeline.
• Optional campaign tags and the domain of the website that referred you to us.
• Communications related to the enquiry and any later business relationship.
• Technical data needed to prevent misuse, such as a short-lived hash of the IP address, submission time, and the result of the Turnstile check.

We primarily receive data directly from you through the contact form, email, a call, or another direct enquiry.

4. Processors and recipients

We process data and use the service providers needed to operate the service. These currently include Amazon Web Services for form processing and sending email, Google for email services, and Cloudflare for website delivery, security, Turnstile verification, and privacy-first web analytics.

We do not sell personal data. We disclose data to others only when required by law or to a contracted service provider that needs it to deliver the service.

5. Processing outside the EU and EEA

Some service providers operate globally, so data may be processed outside the EU or EEA. In those cases, the transfer is based on an applicable legal transfer mechanism, such as a European Commission adequacy decision or Standard Contractual Clauses, together with any necessary supplementary safeguards.

6. Retention periods

• Enquiries are retained for no more than 24 months after the last active communication unless longer retention is needed for a client relationship, legal claim, or statutory obligation.
• Technical service logs for the form are retained for no more than one month.
• Hashed IP counters used to prevent misuse expire automatically after a short rate-limit window.

7. Cookie-free web analytics

The site uses Cloudflare Web Analytics to understand page views, referring sites, and technical performance. The service does not use analytics cookies or localStorage and, according to Cloudflare, does not collect or use visitors’ personal data. Optional campaign tags and the external referring domain are kept only in browser session storage so they can be attached to an enquiry sent during the same tab session; they are removed when the tab is closed. The Turnstile check on the contact form is a security measure, not marketing tracking.

8. Your rights

Under applicable data protection law, you may request access to, correction of, or erasure of your data, restriction of processing, or object to processing based on legitimate interests. You may also have a right to data portability.

You may lodge a complaint with the competent supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

9. Privacy requests

Send privacy-related requests to [email protected]. We may ask for additional information when needed to verify your identity.