1. Data Controller
Nollaamo Oy (Business ID 3182025-5), Untamonpolku 2, 40930 Kinkomaa, Finland. Contact for data-subject rights requests: asiakaspalvelu@nollaamo.fi.
Last updated: 2026-07-23
Privacy Policy
2. Personal Data Collected
We process the following categories of data: (a) Contact and booking form: name, company, email, phone, team size, and message. (b) Blog comments: name, email, comment content, and pseudonymised IP address (SHA-256 hash that does not directly identify the user). (c) Chatbot conversations: your questions, AI responses, session identifier, language used, and pseudonymised IP. (d) Pageview counting: cookieless visitor statistics from all pages. We record only the visited path, a coarse device class (mobile or desktop), the external referring domain, and any campaign parameters (utm). We store no IP address, no sessions, and no identifiers that single out the user, and we neither read nor write anything on your device. The statistics are stored in Nollaamo’s own EU-region system (Supabase, Ireland).
3. Purpose and Legal Basis
Personal data is processed for contact handling, managing customer relationships, moderating blog comments, operating the chatbot, and developing our services. The legal basis is our legitimate interest (responding to contacts, comment moderation, service operation and improvement) and your consent (newsletter, voluntary chatbot conversations).
4. Retention Periods
Contact and booking form data: 24 months from the contact, unless longer retention is required for the customer relationship. Published blog comments: retained as long as the article is published. Rejected or pending comments: 30 days. Chatbot conversations: 30 days from sending, then automatically deleted. Pageview statistics: anonymous aggregated data (no personal data), retained for service statistics. Pseudonymised IP hashes follow the same timelines.
5. Processors and Data Transfers
We use the following processors with whom data processing agreements (DPAs) are in place: Supabase (database, EU region eu-west-1 Ireland), Vercel (application hosting, EU region), Resend (email delivery, USA — DPA + SCC), OpenAI (chatbot and AI text generation language model, USA — DPA + SCC), and Telegram Messenger LLP (internal lead notification for contact requests received through the chatbot, UK / EU). Transfers outside the EU and adequacy-decision area are based on the European Commission’s Standard Contractual Clauses (SCC). We do not share personal data with third parties for marketing.
6. AI Chatbot and Use of Artificial Intelligence
The website may include an AI assistant that uses OpenAI’s language model (gpt-4o-mini) to answer your questions. Your conversation is sent to OpenAI to generate a response. OpenAI does not use API-customer conversations to train its models. The chatbot stores conversations for 30 days to improve the service and detect misuse, after which they are deleted automatically. If you share your contact details in the chat for a meeting or follow-up, they are stored as a contact request (section 4) and forwarded to our operator via an internal Telegram channel. The chatbot does not replace professional advice on medical, legal, financial, or safety-related matters.
7. B2B Marketing Register (Prospects)
We send targeted sales email about our products and services to representatives of organisations. The register contains name, work email address, organisation and role. The data originates from our earlier correspondence and from contact details the organisations have themselves made public — we did not obtain it from you directly, which is why we state its origin here. The processing is based on our legitimate interest (GDPR Article 6(1)(f)) in offering our products to organisations whose activities they relate to; Section 200 of the Finnish Act on Electronic Communications Services (917/2014) permits direct marketing to legal persons without prior consent. The messages concern the recipient's professional role, not their private life. We do not disclose the data to third parties and do not use it for profiling or automated decision-making. You have an unconditional right to object to direct marketing at any time (Article 21(2)): reply to any of our messages with the word POIS, or email asiakaspalvelu@nollaamo.fi, and we will remove you — on request your entire organisation — from the list and send no further messages. Prospect data is deleted once a campaign has ended and contact has not continued. Addresses of those who have objected are, however, retained permanently on a suppression list — that is the only way to ensure the objection is not breached later.
8. Blog Comment Moderation
Comments on blog posts are reviewed before publication. The data collected (name, email, comment content, pseudonymised IP) is limited to moderation and spam prevention. Your email address is not published alongside the article — it is used only for moderation. We reject comments that violate the law or contain hate speech, advertising, or misleading content.
9. Your Rights
You have the right to information about the processing, access to your data, rectification or erasure, restriction of processing, objection to processing, and data portability. You may at any time request deletion of your chatbot conversations or blog comments. To exercise your rights, contact asiakaspalvelu@nollaamo.fi.
10. Right to Complain
You have the right to lodge a complaint with the data protection authority (tietosuoja.fi) if you believe the processing of your personal data violates data protection laws.
11. Cookies
We use necessary cookies to ensure the website works. Our visitor counting is cookieless and requires no consent: it neither sets, reads, nor stores any identifier or session information in your browser. We do not currently use analytics or marketing cookies. You can find more information about cookies via the "Cookies" link at the bottom of the page.
12. Policy Updates
We update this privacy policy as needed when our service or legislation changes. Significant changes are announced on the website. The latest update date appears at the top of this page.