5. Recipients and Transfers

We use trusted service providers who process data under our instructions (processors) or as independent controllers:

• Platform and hosting: Squarespace (website)

• Tag management: Google Tag Manager (GTM) – does not permanently store data, only passes on consent and event data

• Analytics: Google Analytics 4 (GA4)

• Advertising: Google Ads (including conversions and audiences)

• Email marketing / newsletter platform: separate provider (if used)

International transfers. Data may be transferred outside the EU/EEA, particularly to the United States through the services above. Such transfers rely on:

(i) the EU–US Data Privacy Framework (if the provider is certified),
(ii) the European Commission’s Standard Contractual Clauses (SCCs), and/or
(iii) additional safeguards such as pseudonymisation and encryption.

We strive to ensure an adequate level of protection in all cases.

6. Retention Periods

We retain personal data only as long as necessary for the purposes described or as required by law:

• Contacts and leads: generally 24 months from last interaction.

• Customer and contract/invoicing data: 6–10 years as required by accounting law.

• Analytics event data (GA4): up to 14 months; aggregate reports without personal data may persist longer.

• Marketing lists and remarketing audiences (Google Ads): up to 540 days or until consent is withdrawn.

• Consent and CMP/TCF logs: typically 36 months to demonstrate consent management.

• Server and security logs: typically 12 months, unless longer retention is necessary for investigations.

7. Safeguards

We apply technical and organizational measures such as encrypted connections (HTTPS/TLS), access control and logging, data minimization, backups, and staff instructions. We choose subcontractors with appropriate security practices.

8. Your Rights

Under GDPR you have (as applicable):

• right of access and to obtain a copy of your data

• right to rectification and completion

• right to erasure ("right to be forgotten")

• right to restrict processing

• right to data portability

• right to object when processing is based on legitimate interest

• right to withdraw consent at any time (does not affect processing carried out before withdrawal)

Requests: toolo@osakeyhtiotoimisto.fi. We will respond without undue delay.

9. Right to Lodge a Complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland or the supervisory authority of your EU place of residence.

10. Children’s Data

Our services are not directed to children under 16 and we do not knowingly collect children’s personal data.

11. Changes to this Policy

We update this policy when our practices or regulations change. Significant changes will be announced on our website.