Privacy Policy

1. Controller

VOS Advisory & Consulting Oy
Business ID 3651321-1
Sporentie 24
FI-21530 Paimio, Finland
Email: ville@vosadvisoryconsulting.fi

Contact person for privacy matters: Ville Suvanto, ville@vosadvisoryconsulting.fi

The company does not have a separate Data Protection Officer, as the law does not require one for this type of operation.

2. What data we process and for what purpose

Clients and engagements

Data	Purpose	Legal basis
Name, title, email, phone, company and business ID	Delivering the engagement and communication	Contract
Billing and payment details	Invoicing and accounting	Contract and statutory obligation (Accounting Act)
Engagement materials and correspondence	Delivering the service	Contract

Enquiries and marketing

Data	Purpose	Legal basis
Data from contact forms or email	Responding to enquiries	Legitimate interest
Contact details collected from public sources (company websites, LinkedIn, trade register)	Contacting prospective business clients	Legitimate interest
Name, title, organisation and contact details of people known from previous work and collaboration	Staying in touch and offering our services	Legitimate interest

In processing based on legitimate interest, it has been assessed that the processing constitutes ordinary business-to-business communication and does not involve an interference with privacy that would override the data subject's interests. The recipient may at any time request that contact ceases.

Enquiries, proposals and client relationships are recorded in a customer relationship management (CRM) system, which holds contact details as well as notes on conversations and agreed next steps.

Recommendations and references

Data	Purpose	Legal basis
Name, title, organisation, the recommendation or reference text and a photo, if provided	Publishing recommendations and client references on the website	Consent

A recommendation or reference is published only in the form approved by the person. Consent can be withdrawn at any time, in which case the data is removed from the website.

3. Sources of data

Data is obtained primarily from the data subject themselves. Data may also be collected from public sources such as company websites, LinkedIn, the trade register and public procurement registers (Hilma, TED). Some contact details originate from previous work and collaboration.

4. Disclosure of data

Data is not sold or disclosed for marketing purposes.

Data is processed on our behalf by the following service providers, with whom a data processing agreement is in place:

• Accounting and invoicing: Tilitimantti (Fennoa financial management system)
• Email and productivity tools: Google Workspace
• Customer relationship management (CRM): HubSpot (data hosted in HubSpot's EU data centre)
• Website platform: Webbikettu (cPanel hosting, Finland)

We aim to store data within the EU or EEA. Where data is processed outside this area, for example in a service provider's support functions or by its subprocessors, the transfer is based on the European Commission's standard contractual clauses or an adequacy decision.

Data may be disclosed to an authority where required by law.

5. Retention periods

Category	Retention period
Accounting records and billing data	6 years from the end of the financial year (Accounting Act)
Client contracts and engagement materials	5 years from the end of the engagement
Enquiries and marketing contact details	24 months from the last contact
Published recommendations and references	For as long as they are published; removed when consent is withdrawn

Data is deleted or anonymised upon expiry of the retention period.

6. Security

Data is stored in systems protected by passwords and two-factor authentication. Access is limited to those who need the data to perform their duties. Devices are encrypted. Engagement materials are not stored in public or shared locations.

7. Use of AI tools

We use AI tools in our work to support analysis and documentation. Only material that is necessary for the engagement is entered into these tools, and personal data is not entered beyond what is strictly necessary. We use services whose terms prohibit the use of client data for model training. All AI-generated content is reviewed by a person before use.

8. Your rights

You have the right to:

• know whether we process data about you and to receive a copy of it
• request correction of inaccurate data
• request erasure of data where there is no longer a basis for processing
• request restriction of processing
• object to processing based on legitimate interest
• receive data processed on the basis of a contract or consent in a portable format
• withdraw consent where processing is based on it

Requests can be made by email to ville@vosadvisoryconsulting.fi. We will respond within one month. We may ask you to verify your identity before fulfilling a request.

If you consider that we are processing your data unlawfully, you may lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

9. Cookies

This website uses only technically necessary cookies. We do not use analytics or marketing cookies. A separate consent banner is not required. If analytics are introduced in the future, this section will be updated.

10. Changes

We may update this policy. The current version is always available at vosadvisoryconsulting.fi/en/privacy.