This policy explains how Werklig Oy handles personal data in connection with this website, with enquiries sent to us, and with our client relationships. Last updated 22 October 2026.
Who is responsible
Werklig Oy (business ID 2201114-9), Siltasaarenkatu 18–20 D2, 00530 Helsinki, is the data controller. For privacy matters, contact Janne Kaitala at janne.kaitala@werklig.com or +358 50 406 0040.
Visiting this website
Server logs. When you load a page, our hosting provider’s servers record your IP address, the time of the visit and the pages requested. We use this to keep the site secure and to investigate faults and attacks. The legal basis is our legitimate interest in the security of our website. Log data is kept for a short period set by our hosting provider and is not used for any other purpose.
Analytics. With your consent, we use Google Analytics 4 to understand how the site is used. It records the pages you view, approximate location, device and browser information, and how you arrived on the site. We have switched off Google signals and demographic reports, and analytics data is kept for two months. Analytics cookies are not set until you accept statistics in the consent banner, and you can change your choice at any time with the consent link in the footer. The legal basis is your consent.
Consent record. When you make a choice in the consent banner, we keep a record of it, including when it was made and what you chose, so that we can show that consent was given. The legal basis is our legitimate interest in being able to demonstrate consent.
Video. The videos at the top of some pages, such as the front page, About and Contact, are background loops hosted by Vimeo. They play for all visitors without a consent step, which means Vimeo receives your IP address and basic device information when the page loads. We use Vimeo’s do-not-track setting so that no tracking cookies are used. The legal basis is our legitimate interest: the loops are a central part of how the site presents our work, they are muted and decorative, and we have limited the data sent to Vimeo. Vimeo videos embedded in case studies load when the page opens, in the same way and with the same do-not-track setting. YouTube videos embedded in articles load only after you give consent. Vimeo and YouTube process data under their own privacy policies.
Contact form and email
If you write to us through the contact form or by email, we receive your name, email address, phone number if you give one, the area you are interested in, and your message. The form sends your message to us as an email and does not store it in the website. We use the data to reply and to discuss a possible project. The legal basis is our legitimate interest in answering enquiries and, where you ask us to, steps taken at your request before entering a contract. If a conversation does not lead to a client relationship, we delete it after 24 months.
We also keep business contact details of people we have met or corresponded with, for example at meetings and events, so that we can follow up on possible work. The legal basis is our legitimate interest in business development, and you can ask us to stop at any time.
Clients and contracts
For clients and their contact persons we process name, organisation, role, email address, phone number, invoicing address and the details of what has been agreed. The legal basis is performing our contract and meeting our legal obligations, including accounting. We keep client records while the relationship lasts, accounting records for the period Finnish law requires, and contracts and project correspondence for up to ten years after the contract ends, in case of claims.
Cookies and similar technologies
What is stored on your device, by whom and for how long is described in our Cookie Policy.
Who we share data with
We do not sell personal data. Service providers that host the website, handle our email and provide analytics process data on our behalf. We may also pass data on for invoicing and debt collection, or where the law requires it. Vimeo and YouTube act on their own account for the videos described above.
Transfers outside the EU and EEA
Google and Vimeo are US companies. Where data is transferred to them, the transfer relies on the EU–US Data Privacy Framework if the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses.
Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, including processing based on our legitimate interest and direct marketing, and to receive the data you have given us in a portable format. Where we rely on your consent, you can withdraw it at any time. Send requests to janne.kaitala@werklig.com. No signature is needed, and we will answer within one month.
If you think we have handled your data unlawfully, you can complain to the Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, tietosuoja@om.fi, tietosuoja.fi/en. You can also complain to the authority in the EU country where you live or work.
Changes to this policy
We update this policy when our practices change. The date at the top shows the latest version.