PRIVACY NOTICE

Updated 4 August 2026

1. Controller

Nexus Legal Oy Business ID 3513604-7 Espoo, Finland

Data protection enquiries: juho.saloranta@nexuslegal.fi

2. What we process

Contact form. When you submit the form, we process the name, email address, phone number and message you provide. The form forwards this to our email. It is not stored in the website database.

Direct contact by email or phone. If you contact us directly, we process the contact details and content of your message.

Server logs. Our hosting provider automatically records technical log data such as IP address, timestamp and browser identifier. These are not linked to an identified individual and are used only to ensure the operation and security of the site.

Cookies. The site uses only cookies necessary for its operation, such as the cookie storing your consent choice. There is no analytics, no advertising cookies and no profiling.

3. Purpose and legal basis

Data	Purpose	Legal basis
Enquiries	Responding to your enquiry and preparing a possible engagement	Legitimate interest (GDPR Art. 6(1)(f)) or steps prior to entering a contract (Art. 6(1)(b))
Server logs	Technical operation and security of the site	Legitimate interest (Art. 6(1)(f))
Necessary cookies	Basic site functions and remembering your cookie choices	Legitimate interest (Art. 6(1)(f))

We do not carry out automated decision-making or profiling.

Providing your data is voluntary. Without contact details we cannot respond to your enquiry.

4. Processors

• Xetnet Oy — domain, website hosting, server logs and server-level backups
• Google Ireland Limited (Google Workspace) — receiving and storing email

We do not disclose data for marketing purposes and we do not sell it. Data may be disclosed to authorities where required by law.

5. Transfers outside the EU

The website, server logs and backups are located in Finland.

Email is handled through Google Workspace. Our contracting party is Google Ireland Limited, but data may also be processed in the United States. Such transfers rely on the European Commission’s adequacy decision on the EU–US Data Privacy Framework and on the Commission-approved standard contractual clauses included in Google’s data processing agreement.

6. Retention

Enquiries. Up to two years, unless the enquiry leads to an engagement. Data relating to an engagement is retained under the engagement agreement and statutory retention obligations.

Server logs and backups. For the period defined by our hosting provider.

7. Your rights

You have the right to access your data and obtain a copy, to rectification, to erasure, to restriction of processing, to object to processing based on legitimate interest, and to data portability where processing is based on consent or contract.

To exercise these rights, contact us at the address in section 1. We respond within one month of receiving the request.

8. Right to lodge a complaint

If you consider that we process your personal data unlawfully, you may lodge a complaint with the Finnish Data Protection Ombudsman. Instructions are available at tietosuoja.fi.

9. Changes

We update this notice when the site or our processing changes. The current version is always available on this page.