Privacy Statement
Last updated: 15 September 2026
At Reflekt, we handle your personal data carefully and transparently. This notice explains what information we collect in connection with our website, enquiries, appointment bookings, requests for materials and newsletter.
This notice covers Reflekt’s website and company communications. It does not cover the Reflekt service platform currently under development. Information about the processing of personal data on the platform will be provided separately when it is launched.
1. Data Controller
Reflekt Finland Oy
Business ID: 3619259-3
P.O. Box 28, 00511 Helsinki, Finland
For privacy-related enquiries, please contact:
elias@reflekt.fi
2. What Information Do We Collect?
We primarily collect information directly from you when you complete a form, contact us, book an appointment or subscribe to our newsletter.
Depending on the service you use, this information includes:
your name, email address and organisation’s name
details of your enquiries and appointment bookings
requests for materials and information you provide through forms
newsletter subscriptions, consents and withdrawals of consent.
Use of our website also generates technical and usage data, such as your IP address, browser information, the time of your visit and the pages viewed.
For newsletter communications, we process delivery information, such as whether an email was successfully delivered and whether you have unsubscribed. With your consent, we may also track newsletter opens and link clicks.
During Teams meetings, we may produce a written transcript of the discussion only with participants’ prior consent, obtained at the start of the meeting. Transcription does not start automatically and can be stopped at any time.
3. How Do We Use Your Information, and on What Legal Basis?
Enquiries and appointment bookings
We use your information to respond to your messages, arrange the meeting you have requested and acquire new customers. This processing is based on our legitimate interest in handling enquiries addressed to us and maintaining professional communications.
Requested materials
We use the information you provide through a form to deliver the materials you have requested, such as our workbook. In the current request form, processing is based on your consent. Requesting materials does not require you to subscribe to the newsletter.
Customer and partnership relationships
Processing is based on entering into or performing a contract when you are personally a party to that contract. We process the information of organisations’ contact persons on the basis of our legitimate interest in managing customer and partnership relationships. Processing necessary to meet statutory obligations is based on law.
Newsletter and tracking
We send newsletters with your consent. Where we track email opens and link clicks, we do so with your consent to assess interest in our content and develop content relevant to our recipients.
Subscribing to the newsletter is voluntary. You can unsubscribe using the link included in every newsletter.
4. Cookies and Website Analytics
Our website runs on Squarespace. We use its built-in analytics and Activity Log feature to review website usage and improve the site.
Essential cookies are used to operate the website. Analytics cookies requiring consent are enabled according to your choices. You can accept or reject them, or change your choices through the Cookie Preferences link on the website.
The processing of technical logs necessary for website operation and security is based on our legitimate interest in maintaining a functional and secure website.
5. Service Providers and Data Recipients
We use the following service providers:
Squarespace: website hosting, providing access to files and website analytics.
HubSpot: online forms, contact and consent management, emails delivering requested materials and newsletters.
Microsoft 365, including Outlook, Teams and Bookings: email communications, meetings and appointment bookings.
Our service providers and their subcontractors process data to the extent necessary to perform their tasks. We enter into data processing agreements covering the processing of personal data on our behalf.
We do not sell your personal data or disclose it to other companies for their own marketing purposes. Data may be disclosed to public authorities where required by law.
6. Transfers Outside the European Economic Area
Our service providers may also process data outside the European Economic Area, for example in connection with service maintenance or support.
Transfers rely on an applicable lawful transfer mechanism, such as a European Commission adequacy decision or the European Commission’s standard contractual clauses, together with any necessary supplementary safeguards.
7. Data Retention and Security
We retain data for as long as necessary for its intended purpose:
Requests for materials only: we delete contact details no later than three months after delivering the materials, unless there is another basis for retaining them.
Enquiries and appointment bookings that do not lead to a customer or partnership relationship: we delete the data no later than 12 months after the last contact.
Newsletter subscriptions: we retain subscriber information for the duration of the subscription and review its necessity annually.
Customer and partnership relationships: we retain data for the duration of the relationship and afterwards to the extent required by statutory obligations or potential legal claims.
Transcripts: we explain the retention period before transcription begins and delete the material when it is no longer needed for the agreed purpose.
After you unsubscribe, we may retain limited information to demonstrate consent and ensure that you are not sent messages against your wishes. This information is not used for marketing.
The retention of technical logs, analytics data and backups depends on the settings of the services used and the necessity of retaining the data.
We protect data using appropriate technical and organisational measures. Access to personal data is restricted to people who need it to perform their work duties.
8. Your Rights
Under GDPR and applicable Nordic data protection laws, you have the right to:
Access the personal data we hold about you.
Request the correction or deletion of your data.
Withdraw your consent for us to contact you at any time.