Privacy Notice

Who is responsible

Nordova Consulting Oy, a company based in Finland, is the controller for the personal data described in this notice.

For any question about this notice or about your personal data, contact hello@nordova.fi.

What we collect

When you send a consultation request, we store the information you enter in the form, together with the time it was submitted and an internal status we use to track the inquiry:

• Name — required, so we know who we are replying to.
• Email address — required, because it is how we reply.
• Phone number — optional.
• Company or organization — optional.
• Your description of what you would like help with — required, so we can understand the request.
• The time the request was submitted, and its internal status.

Protecting the form from abuse

Because the form is public, we limit how many submissions can be sent from the same source in a short period. To do this we derive a short-lived pseudonymous fingerprint from the network source of the request.

That fingerprint is a one-way keyed hash. We do not store the raw network address as part of your consultation record, and the fingerprint is kept only as long as the rate-limiting window needs it.

Why we process it, and on what basis

We use the information you send to receive and review your consultation request, to contact you about it, and to manage the inquiry that follows.

The legal basis for this is that the processing is necessary to take steps at your own request before we might enter into an engagement together. It is not based on consent, so you do not need to give or withdraw consent for us to answer you — although you can ask us to delete your request at any time.

The separate, narrower processing that protects the form from abuse and excessive automated submissions rests on our legitimate interest in keeping the website and this endpoint working.

Who else is involved

We use service providers to run the website and to store consultation requests. They process this data on our behalf and under our instructions:

• Hetzner Online — the server infrastructure the website runs on.
• Supabase — the managed PostgreSQL database where consultation requests are stored.

Where the data is stored

The website runs on a server in the European Union, and we host the consultation database in the European Union. Because the providers above operate global infrastructure, we cannot rule out that some processing — for example support or operational access — takes place outside the EU or EEA. Where that happens, it is subject to the safeguards those providers make available for international transfers.

How long we keep it

We keep a consultation request for up to 12 months after the last activity on that inquiry, and then delete it.

There are two exceptions. If the inquiry becomes an active client relationship, the record moves under the retention rules that apply to our client and business records. And we keep data longer where the law requires it, or where we need it to establish, exercise, or defend a legal claim.

The short-lived records used for rate limiting are kept only as long as they are operationally needed. They are not used as a record of you or of your inquiry.

Your rights

Under EU data protection law you have rights over your personal data. Which of them apply depends on the situation and on the legal basis for the processing:

• Access — ask what personal data we hold about you.
• Correction — ask us to correct data that is wrong or incomplete.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use it.
• Portability — where it applies, receive the data you gave us in a portable form.
• Objection — object to processing we carry out on the basis of legitimate interest, including the anti-abuse processing described above.

Questions and complaints

To exercise any of these rights, or to ask anything about this notice, contact hello@nordova.fi.

If you believe we have handled your personal data incorrectly, you can also lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman.

Automated decisions

Consultation requests are read and answered by a person. They are not subject to automated decision-making that produces legal effects for you or similarly significantly affects you.