Privacy

This page sets out how personal data is processed on tuomo.co, under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.

1. Controller


Controller	Tuomo Antikainen
Address	Tuomo Antikainen, Poste Restante, FI-90100 Oulu, Finland
Email	hello@tuomo.co

For all privacy-related enquiries, contact hello@tuomo.co.

2. Processing

2.1 Newsletter — The Field Report


Data	Email address, first name if given, subscription date and source. beehiiv also records IP address, device, and email opens and clicks.
Purpose	Sending the newsletter and measuring delivery and engagement.
Basis	Consent, Article 6(1)(a). Electronic direct marketing to a natural person requires prior consent under Article 13 of Directive 2002/58/EC.
Consent	Double opt-in. Subscription is confirmed by clicking a link sent to the address.
Withdrawal	Unsubscribe link in every email, or hello@tuomo.co. Withdrawal does not affect processing carried out before it.

2.2 Contact form


Data	Name, email address, subject, message content.
Purpose	Responding to the enquiry.
Basis	Article 6(1)(b) for enquiries concerning possible work; Article 6(1)(f) otherwise.

2.3 Booking


Data	Name, email address, time zone, selected slot, and any information entered in the booking form. A calendar entry and a confirmation email are created.
Purpose	Scheduling the call.
Basis	Article 6(1)(b).
Provider	Cal.com, which processes the booking under its own privacy policy. The booking view is embedded on the contact page and stores data on your device; see section 4.

2.4 Email


Data	Email address, name, message content.
Purpose	Responding.
Basis	Article 6(1)(f), or Article 6(1)(b).
Providers	The mailbox is hosted by Infomaniak. Contact form messages are delivered to it by Resend.

2.5 Payments

Payments and invoices are processed by Stripe.


Data	Name, email address, billing address, amount, description. Card details are submitted directly to Stripe.
Purpose	Processing payment, issuing receipts, and retaining records required by tax law.
Basis	Article 6(1)(b) and Article 6(1)(c).

2.6 Analytics


Data	Pages viewed, referrer, approximate location, browser, operating system, device type, and an identifier stored on your device that distinguishes one browser from another across pages and visits.
Purpose	Measuring which pages are read and where visitors arrive from.
Basis	Consent, Article 6(1)(a), given through the cookie banner. Storage on your device requires consent under Article 5(3) of Directive 2002/58/EC.
Provider	Google Analytics 4, loaded through Google Tag Manager.
Withdrawal	Cookie settings in the footer.

2.7 Advertising and conversion measurement


Data	That a browser visited a given page, and whether it did so after seeing or clicking an advertisement. Meta uses identifiers stored on your device and may match them to a Meta account you are logged into.
Purpose	Measuring advertising performance and building advertising audiences.
Basis	Consent, Article 6(1)(a), and Article 5(3) of Directive 2002/58/EC.
Provider	Meta pixel, loaded through Google Tag Manager.
Role	Meta processes this data for its own purposes as well. See section 5.
Withdrawal	Cookie settings in the footer.

2.8 Approximate location displayed on the site


Data	Approximate city, the coordinates of that city's centre, and a time zone, derived from your IP address by Vercel when the page loads.
Purpose	Displaying the visitor's location in the site's field marker.
Basis	Article 6(1)(f).
Retention	None. The result is returned to your browser, is not stored, and is not cached. Your IP address is not logged by this.

2.9 Server logs


Data	IP address, timestamp, requested path, response code, user agent.
Purpose	Operating the site, diagnosing faults, preventing abuse.
Basis	Article 6(1)(f).
Provider	Vercel, which provides the web hosting.

2.10 Client and billing records

Where an enquiry results in a project: contact details, contract documentation and invoicing data, under Article 6(1)(b) and Article 6(1)(c).

3. Special category data and children

No special category data under Article 9 and no criminal offence data is collected. Do not submit any through the contact form.

The site is not directed at children. Consent under Article 8 for information society services applies from the age set by the applicable national law, and from 13 in Finland.

4. Cookies and device storage

Storage on your device is governed by Article 5(3) of Directive 2002/58/EC and requires consent, except where it is strictly necessary to provide a service you have requested.

Analytics and advertising storage is off until you consent through the banner. Refusal is one click, and Cookie settings in the footer reopens it at any time.

The booking view on the contact page is embedded from cal.com and loads regardless of your cookie choice, so that booking a call always works. It stores data on cal.com's domain.

The full list — every item, its provider, purpose and lifetime — is at tuomo.co/cookies.

5. Recipients

Service	Function	Role	Location
beehiiv, Inc.	Newsletter list and delivery	Processor	United States
Resend (Plus Five Five, Inc.)	Contact form message delivery	Processor	United States
Infomaniak Network SA	Email hosting	Processor	Switzerland
Vercel, Inc.	Web hosting and server logs	Processor	United States
Cal.com, Inc.	Bookings	Processor	United States
Google Ireland Limited	Google Analytics 4, Google Tag Manager, Google Calendar	Processor	Ireland, with transfers to the United States
Stripe Payments Europe, Limited	Payments and invoicing	Processor, and controller for its own fraud prevention and legal obligations	Ireland
Meta Platforms Ireland Limited	Meta pixel	Independent controller	Ireland, with transfers to the United States

Meta determines its own purposes for the data it receives through the pixel. Its processing is governed by Meta's privacy policy.

Data may be disclosed to a public authority where required by law.

Outbound links to third-party platforms load no content on this site and carry no tracking.

6. Transfers outside the EU and EEA

Transfers to providers outside the EU and EEA rest on a European Commission adequacy decision, or on standard contractual clauses under Article 46(2)(c) with supplementary measures. Switzerland is covered by an adequacy decision.

A copy of the safeguards is available on request from hello@tuomo.co.

7. Retention

Data	Period
Newsletter subscriber data	Until you unsubscribe. The address is then retained on a suppression list to prevent further sending.
Contact form messages and email	24 months from the last contact, unless a project results.
Bookings and calendar entries	24 months from the call.
Analytics data	As set in the Google Analytics property, 14 months.
Advertising data	Retained by Meta under its own rules. Cookie lifetimes are listed at tuomo.co/cookies.
Server logs	As retained by Vercel under the applicable plan.
Location shown on the site	Not retained.
Client and contract records	For the duration of the project and any subsequent limitation period.
Invoices and accounting records	As required by applicable accounting and tax law.

8. Security

The site is served over HTTPS. Access to all services listed in section 5 is protected by two-factor authentication. API keys are held in environment variables and are not exposed to the browser.

9. Your rights

Right	Article
Access, and a copy of your data	15
Rectification	16
Erasure	17
Restriction of processing	18
Data portability	20
Objection to processing based on legitimate interests; objection to direct marketing at any time	21
Withdrawal of consent, without affecting prior processing	7(3)

Erasure does not extend to data retained under a legal obligation or for the establishment or defence of legal claims.

Consenting to the marketing group results in profiling within the meaning of Article 4(4): Meta groups a browser by the pages it visited in order to target advertising. This is not automated decision-making under Article 22. It can be stopped through Cookie settings or by objecting under Article 21.

Making a request. Email hello@tuomo.co. Verification of identity may be requested. A response is given within one month of receipt, extendable by two further months for complex or numerous requests, with notice within the first month. Requests are free of charge.

10. Supervisory authority

Under Article 77 you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

In Finland this is the Office of the Data Protection Ombudsman: tietosuoja.fi.

11. Provision of data

Providing data is not a statutory or contractual requirement. Subscribing requires an email address; the contact form requires a name and email address; booking requires a name and email address.

12. Changes

This page is updated when the processing or the providers change. The current version is at https://tuomo.co/privacy, dated at the top.