Privacy policy

Enquiry register and prospect register. Updated 16 September 2026. The Finnish version is the authoritative one.

This policy explains how Oy Wolflake Consulting Ab processes personal data. It covers two registers: the enquiry register, meaning data you provide through the forms on wolflake.fi or when you contact us by email or phone (sections 2 to 4), and the prospect register, meaning business decision-makers' contact details on the basis of which I contact you (section 5). It is written in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Controller

The company is not legally required to appoint a data protection officer and has not appointed one.

2. Enquiry register: what data is collected

The site has two forms: a general contact form and a Health Check discovery call request form. They collect the following data:

• name
• organization
• phone number
• email address
• on the Health Check form: the organization's number of Microsoft 365 users (selected size band)
• on the contact form: selected topic and free-text message
• the time of submission and the address of the page the form was sent from

In addition, information you provide during the contact or the subsequent conversation is stored, such as background information about your environment and notes of the discussion.

The data in this register is collected from you. If I have contacted you without you having submitted an enquiry, the prospect register in section 5 applies.

3. Enquiry register: purpose and legal basis

The data is used to respond to your enquiry, to arrange and prepare for the discovery call, and to prepare a possible proposal and engagement.

The legal basis is taking steps at your request prior to entering into a contract (GDPR Article 6(1)(b)) and the controller's legitimate interest in managing customer relationships and responding to enquiries (Article 6(1)(f)).

The data is not used for automated decision-making or profiling. Data you provide in a form is not used for newsletters or other marketing messages without your separate consent.

4. Check of public domain records

Before an agreed discovery call I check your organization's publicly available DNS records that indicate the state of email protection. This is information available to anyone on the internet and it is not personal data. No connection is made to your systems and nothing is signed into.

5. Prospect register: outreach to companies

I also contact companies that I believe would benefit from my services, and I maintain a prospect register for this. If you have received an email or a call from me without any prior contact, this section explains where your details came from. This section also serves as the notice required by Article 14 of the GDPR.

What data. Name, job title or role, work email address, work phone number, the organization's name and public basic details, plus notes of our conversation and a record of when I have been in touch. The data relates to you in your professional role, not as a private individual.

Where the data comes from. Public sources such as your organization's website, LinkedIn and the Finnish Trade Register, and the Nordic B2B decision-maker database maintained by Clevenio. No data is collected covertly or from your systems.

Purpose. Getting in touch, presenting the service, proposing a discovery call, and keeping track of who I have contacted and when.

Legal basis. The controller's legitimate interest in marketing its services to companies and acquiring new customers (GDPR Article 6(1)(f)). Electronic direct marketing to an organization is permitted without prior consent under section 200 of the Finnish Act on Electronic Communications Services, and you always have the right to opt out.

Retention. A maximum of 24 months from the last contact, after which the data is deleted. If you opt out, I delete the other data and keep only the minimum needed to make sure you are not contacted again.

How to opt out. Reply to my message or email [email protected]. The opt-out takes effect immediately and you do not need to give a reason. You also have the other rights described in section 10.

6. Who processes the data

The data is processed by Jami Susijärvi. It is not sold, rented or disclosed to third parties for marketing purposes.

The data is processed in the following services, whose providers act as processors:

• Microsoft Ireland Operations Limited. Microsoft 365 and Microsoft Azure: email, files, tasks, calendar bookings, form relay and the lead list. The services are located in the EU.
• Sales Led Oy (Clevenio). Maintenance of the prospect register and tracking of outreach. The service is Finnish and the data is processed in the EU.
• Cloudflare, Inc. Technical hosting and content delivery of the website. Cloudflare processes technical connection data such as your IP address and which page your browser requested. Cloudflare does not process form content, because the form is sent from your browser directly to Microsoft Azure.

Data you provide in the form is stored in the EU. Cloudflare is a US company, so the technical connection data it processes may be transferred outside the EU and EEA. The transfer is based on standard contractual clauses approved by the European Commission or another safeguard under the GDPR.

7. Retention

Enquiry data is retained for a maximum of 24 months from the last contact, after which it is deleted. If the enquiry leads to an engagement, the data is retained for the duration of the customer relationship and afterwards for as long as accounting legislation or other law requires.

8. Security

The data is stored in a Microsoft 365 and Azure environment where access is protected by multi-factor authentication and restricted to the controller's personnel. No paper records are created. The connection to the site and the form submission are encrypted.

9. Providing data is voluntary

Providing data is not based on law or contract and is entirely voluntary. Without contact details, however, I cannot respond to your enquiry or arrange a discovery call. You can also contact me directly by phone or email without the form.

10. Your rights

You have the right to:

• know whether data concerning you is processed and obtain a copy of it
• request rectification of inaccurate data
• request erasure of data
• request restriction of processing
• object to processing based on legitimate interest
• receive the data you provided in a portable format

Requests are sent by email to [email protected]. I respond within one month. You may need to prove your identity if the request concerns disclosure or erasure of data.

If you consider that your data has been processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

11. Cookies and tracking

The site does not use tracking, analytics or marketing cookies, and visitors are not profiled or tracked for advertising platforms. The site sets no cookies in your browser at all.

The site loads fonts from Google Fonts (Google Ireland Limited), whereby your browser's IP address is transmitted to the provider as part of the technical download. This is not a cookie or tracking.

If advertising pixels or analytics are added to the site later, they will be loaded only after your consent, consent will be requested with a separate notice, and this policy will be updated before deployment. You can withdraw consent at any time.

12. Changes to this policy

The policy is updated if data processing changes. The latest update date is shown at the top of the page.