This notice explains how Mooseville Industries Oy processes personal data as a controller. It gives the information required by Articles 13 and 14 of the EU General Data Protection Regulation (2016/679, the “GDPR”). Finnish national law, the Data Protection Act (tietosuojalaki 1050/2018), also applies.
This is a translation of the Finnish notice. In the event of a discrepancy, the Finnish version prevails.
1 Controller
Mooseville Industries Oy (business ID 3014886-6, the “company”) Aurorankatu 9 A 2, 00100 Helsinki, Finland
Contact in data protection matters: Rami Hirvelä, rami@rhirvela.com, +358 50 328 3421
The company has not appointed a data protection officer under Article 37 of the GDPR, as the conditions for appointment are not met.
2 Scope of this notice
This notice covers processing in which Mooseville Industries Oy is the controller: running its own business, sales, client relationships and the documentation of engagements.
It does not cover processing in which the company acts as a processor on behalf of a client under an engagement. In that case the client is the controller, the client’s own privacy notice applies, and the processing is governed by the data processing agreement made with the client and by the client’s written instructions. The line runs according to whose behalf the data is processed on: work done in the client’s systems on the client’s instructions is processing on the client’s behalf, whereas the company’s own notes, contact details and engagement records are the company’s own controller processing.
3 Categories of data subjects and data processed
| Category | Data |
|---|---|
| Contacts at clients and prospective clients | Name, title, role, employer, business email address, business telephone number, LinkedIn address |
| Client personnel met during an engagement | Name, role, unit, and the notes, recordings and transcripts of meetings, interviews and workshops |
| Prospects, meaning individuals whose organisation has been identified as a possible client | Name, title, employer, publicly available professional background, public writings and contact details |
| Partners and subcontractors | Name, role, contact details, contract and invoicing details |
| Visitors to the website and recipients of shared materials | See section 9 |
No special categories of personal data are collected or processed.
4 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Managing the client relationship and delivering the engagement | Legitimate interest (Article 6(1)(f) of the GDPR); the contact person is not a party to the contract but represents the client organisation |
| Communication and arranging meetings | Legitimate interest |
| Documenting the engagement: memos, decisions and tasks | Legitimate interest |
| Sales, prospecting and business-to-business direct marketing | Legitimate interest |
| Invoicing, accounting and taxation | Legal obligation (Article 6(1)(c) of the GDPR) |
| Establishing, exercising and defending legal claims | Legitimate interest |
A balancing test has been carried out for processing based on legitimate interest. The processing is limited to individuals acting in a professional role and to data relating to their work. The data is ordinary working-life contact data, and the processing does not concern private life. Data subjects have the right to object described in section 10.
5 Sources of data
Data is obtained from the data subject, from their employer, or from the client in connection with an engagement.
For prospecting, data is also collected from public sources: organisations’ websites, LinkedIn, public job advertisements, news media, the Finnish Trade Register and comparable public sources.
Where data has been collected from a source other than the data subject, the information required by Article 14 of the GDPR is provided to the data subject no later than at the first contact, and this notice is publicly available at www.rhirvela.com.
6 Retention periods
| Data | Retention |
|---|---|
| Client contact details and engagement records | For the duration of the client relationship and three years thereafter |
| Recordings of meetings and interviews | No more than 12 months, after which only the written note remains |
| Prospect data | No more than 24 months from the most recent meaningful contact or update, after which the data is deleted or updated |
| Invoicing and accounting records | For the period required by the Finnish Accounting Act (kirjanpitolaki 1336/1997) |
| Proposals and contracts | For the duration of the contractual relationship and the limitation period |
| Website visit records and IP addresses | No more than 7 days from the visit. A hash derived from the IP address is kept for no more than 30 days so that the same address is not looked up again |
Retention periods are reviewed regularly and unnecessary data is deleted.
7 Recipients and services used
Personal data is not sold, nor is it disclosed to third parties for marketing purposes. Data is processed in the following services, which generally act as processors:
| Service | Purpose | Location of processing |
|---|---|---|
| Own customer relationship management (Twenty, self-hosted) | Contact details and sales status | The company’s own hardware, Finland |
| Own file-based knowledge base | Engagement notes | The company’s own hardware, Finland |
| GitHub (Microsoft) | Version control and backup of notes in private repositories | United States |
| Google Workspace | Email, calendar and files | EU and United States |
| Anthropic (Claude) | Processing of notes and transcripts, and drafting of documents | United States |
| Meeting recording and transcription service | Recordings and transcripts | See section 8 |
| Vercel | Technical platform for the website and shared materials | EU and United States |
| Accounting firm and accounting system | Invoicing and accounting | Finland |
Data may also be disclosed to public authorities where there is a legal obligation to do so, and to the company’s legal advisers, who are bound by confidentiality.
8 Transfers outside the European Union and the European Economic Area
Some of the services listed above process data in the United States. Transfers are based on the standard contractual clauses approved by the European Commission or on another transfer mechanism under Chapter V of the GDPR, and a data processing agreement is in place with the provider where the service acts as a processor.
Anthropic’s Claude service is used under consumer terms, which do not include a separate data processing agreement. For this reason, only the company’s own notes, transcripts and working documents are processed in that service. Personal data processed on behalf of a client is not entered into it; such processing takes place in the client’s own systems and under the client’s own agreements. Model training is disabled in the service settings.
The meeting recording and transcription service is agreed with each client before the first recording. The client’s own service is used where one exists, in which case the recording remains in the client’s system.
9 Website, analytics and shared materials
Analytics. The website www.rhirvela.com uses two visitor measurement services, Umami and Ahrefs Web Analytics. According to their providers, neither sets cookies nor collects personal data, and Umami hashes IP addresses without storing them as such. For this reason no cookie consent is requested.
Organisation-level visitor identification. For each visit to the website, the time, the page opened, the referring address, the browser identifier, the country and the IP address are recorded. The IP address is used to look up, in the public IP address registry (RIPE NCC, the Netherlands), which organisation’s network the visit came from. Identification is made at the level of the organisation: the individual is not identified, no cookies are set, and no profile of the visitor is created. If the visit comes from a company that belongs to the controller’s sales target group, the visit is recorded in that company’s data as a sales signal, without the IP address. The purpose is business-to-business sales, and the legal basis is legitimate interest. Nothing is recorded if the browser sends a Do Not Track or Global Privacy Control request. Retention periods are set out in section 6.
Shared materials. Materials are shared with clients at password-protected addresses. When a material is opened, a technical session cookie is set in the browser to keep the session active. The cookie is strictly necessary for the operation of the site, so no consent is requested for it (the Finnish Act on Electronic Communications Services, 917/2014).
The time, country, city and browser identifier of the opening are also recorded, and a notification is sent to the controller. The purpose is information security and confirming whether the material reached its recipient. The opening is also recorded as a sales signal in the data of the recipient’s company, so that the controller can time the follow-up. The legal basis is legitimate interest. The data is deleted within 12 months.
10 Rights of the data subject
The data subject has the right to
- access their data and obtain a copy of it
- rectify inaccurate data and complete incomplete data
- request erasure of the data
- restrict the processing
- object to processing based on legitimate interest on grounds relating to their particular situation
- object to direct marketing at any time without giving reasons
- receive the data in a portable form, to the extent that the processing is based on a contract or consent and is carried out by automated means
Requests may be made to rami@rhirvela.com. A response will be given within one month. The identity of the person making the request may be verified where necessary.
If the data subject considers the processing unlawful, they have the right to lodge a complaint with a supervisory authority. In Finland the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).
11 Automated decision-making
The company scores prospective client organisations in order to target its sales activity. The scoring concerns the organisation, not an individual, and its only consequence is whether the organisation is contacted. The company does not make automated decisions within the meaning of Article 22 of the GDPR that produce legal effects concerning the data subject or similarly significantly affect them.
12 Information security
Data is held on devices and in services protected by passwords and two-factor authentication. Device drives are encrypted. Only the controller has access to the data. Shared materials are behind a password and encrypted at rest. The providers of the services used are responsible for the security of their own services.
In the event of a personal data breach, notification will be given to the supervisory authority and, where required, to the data subject in accordance with Articles 33 and 34 of the GDPR.
13 Changes to this notice
This notice is updated when the processing, the services used or the applicable law change. The version in force is available at www.rhirvela.com.