Privacy Policy

Data controller

Mainostoimisto Reflex Oy
Business ID 0700247-1
Satakunnantie 31
20300 Turku, Finland
info@mainosreflex.fi, +358 40 590 3012

Contact person for privacy matters: Jenita Pernell, jenita.pernell@mainosreflex.fi

General

We respect your privacy and are committed to protecting your personal data. This privacy policy explains what personal data we collect, for what purposes and on what legal grounds we process it, to whom it may be disclosed, how long we keep it and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act and other applicable legislation.

Whose personal data do we process?

• Contact persons of our clients, prospective clients, partners and suppliers
• Visitors to our website
• People who contact us, for example via our contact form or by email
• Newsletter subscribers and people who download our e-guides

Purposes and legal bases of processing

• Providing our services and managing client relationships – performance of a contract (GDPR Art. 6(1)(b)) and our legitimate interest in managing the business relationship with the companies we work with (Art. 6(1)(f)).
• Responding to contact requests – our legitimate interest in answering enquiries (Art. 6(1)(f)).
• Business-to-business marketing and new business development – our legitimate interest (Art. 6(1)(f)). You may object to direct marketing at any time.
• Newsletter and e-guide downloads – your consent (Art. 6(1)(a)). You can unsubscribe at any time via the link in each email.
• Website statistics with Matomo (cookieless) – our legitimate interest in maintaining and developing our website (Art. 6(1)(f)).
• Analytics and marketing cookies (Google Analytics, Google Ads, LinkedIn) – your consent (Art. 6(1)(a)) given through our cookie banner.
• Accounting and other statutory obligations – legal obligation (Art. 6(1)(c)).
• Information security and backups – our legitimate interest in keeping our systems secure and reliable (Art. 6(1)(f)).

What personal data do we collect and from where?

We mainly collect personal data directly from you, for example when you contact us, subscribe to our newsletter, download an e-guide or when we work together. We may also collect business contact information from public sources such as company websites, LinkedIn and trade registers.

Depending on the situation, we may process the following data:

• Name, title and company
• Business contact details (email, phone number, postal and invoicing address)
• Information related to the client relationship, such as offers, orders, projects and correspondence
• Newsletter subscription and marketing preferences
• Technical data about your website visit, such as an anonymised or pseudonymised IP address, browser and device type, pages visited, time of visit and referring website
• Cookie consent choices

We do not intentionally collect special categories of personal data or personal identity codes.

Website analytics and cookies

Cookies are small text files stored on your device. Necessary cookies are used for the technical operation of the website and to remember your cookie choices. All other cookies are used only if you give your consent in our cookie banner. You can change or withdraw your consent at any time via the Cookie Settings link, which is also available at the bottom of every page. A detailed list of cookies is shown in the cookie settings.

Matomo Analytics. We use Matomo to produce statistics about the use of our website. Matomo runs on our own web server in the EU, and the data is not shared with Matomo or any other third party. Matomo is configured without cookies, and IP addresses are anonymised (the last two bytes are removed) before they are stored, so individual visitors cannot be identified. Raw visit data is deleted automatically after 6 months; after that only aggregated statistics are kept. You can opt out of Matomo statistics below:

Opt-out complete; your visits to this website will not be recorded by the Web Analytics tool. Note that if you clear your cookies, delete the opt-out cookie, or if you change computers or Web browsers, you will need to perform the opt-out procedure again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

The tracking opt-out feature requires cookies to be enabled.

Google Analytics 4 and Google Tag Manager (Google Ireland Ltd / Google LLC). With your consent to analytics cookies, we use Google Analytics to analyse how our website is used. Google Tag Manager is used to load these tags only in accordance with your consent.

Google Ads conversion tracking (Google Ireland Ltd / Google LLC). With your consent to marketing cookies, we measure the results of our advertising.

LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company). With your consent to marketing cookies, we use the LinkedIn Insight Tag to measure our LinkedIn campaigns and to show relevant content to website visitors on LinkedIn.

PixelYourSite. With your consent, this WordPress plugin stores information about the traffic source and landing page of your visit (e.g. UTM parameters) so that we can understand which channels bring visitors to our website.

Embedded content. Some pages contain embedded videos (Vimeo) and use fonts loaded from Google Fonts. When such content is loaded, your IP address is transmitted to the service provider.

CookieYes. We use CookieYes to ask for and store your cookie consent. A record of your consent choice (an anonymous consent ID, the choice and its date) is stored as proof of consent.

Who processes the data and is it disclosed to third parties?

Your personal data is processed by our personnel who need it for their work. We also use carefully selected service providers who process personal data on our behalf, for example for web hosting (Planeetta Internet Oy, Finland), email and office software, customer relationship and project management, newsletter delivery, cookie consent management (CookieYes) and the analytics and marketing services described above. We have agreements with these processors to ensure that personal data is processed confidentially and in accordance with data protection legislation.

We do not sell or disclose personal data for third parties’ direct marketing purposes. We may disclose personal data if required by law or a competent authority, or in connection with a merger, acquisition or other business arrangement.

Transfers of data outside the EU/EEA

We primarily process personal data within the EU/EEA. Some of our service providers (such as Google and LinkedIn) may transfer personal data to the United States or other countries outside the EU/EEA. In such cases, we ensure that the transfer is lawful, for example because the recipient is certified under the EU–U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection, or because the European Commission’s Standard Contractual Clauses and necessary supplementary safeguards are used.

How long do we keep personal data?

We keep personal data only as long as necessary for the purposes described above or as required by law:

• Client and partner contact details: for the duration of the business relationship and for up to five years after it ends
• Contact requests that do not lead to a business relationship: up to two years
• Newsletter subscriber data: until you unsubscribe
• Accounting records: as required by the Finnish Accounting Act (generally 6–10 years)
• Matomo raw visit data: 6 months, after which only aggregated statistics are kept
• Google Analytics data: 14 months from the visitor’s last activity
• Cookies: according to the lifetimes shown in the cookie settings

Data that is no longer needed is deleted or anonymised.

How is personal data protected?

We protect personal data with appropriate technical and organisational measures. Access to personal data is limited to persons who need it for their work and is protected with user-specific credentials and access rights. Our systems are protected with, among other things, firewalls, encrypted connections, regular updates and backups. Our service providers are required to apply corresponding security measures.

Is providing personal data mandatory?

Providing personal data is voluntary. However, some data is necessary for us to answer your enquiry, deliver our services or fulfil a contract. Using our website does not require you to accept any cookies other than necessary ones.

Automated decision-making

We do not use personal data for automated decision-making or profiling that would have legal or similarly significant effects on you.

Your rights

You have the following rights under the GDPR:

• Right of access – to know whether we process your personal data and to receive a copy of it
• Right to rectification – to have inaccurate or incomplete data corrected
• Right to erasure – to have your data deleted, for example when it is no longer needed or if you withdraw your consent
• Right to restriction of processing – in certain situations
• Right to data portability – to receive data you have provided to us in a machine-readable format when processing is based on consent or a contract
• Right to object – to processing based on our legitimate interest, and at any time to direct marketing
• Right to withdraw consent – at any time, without affecting the lawfulness of processing before the withdrawal

To exercise your rights, please contact us at jenita.pernell@mainosreflex.fi. We may ask for additional information to verify your identity before processing your request. We will respond within one month.

If you believe that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with the supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

Changes to this privacy policy

We may update this privacy policy if our operations or the legislation change. The current version is always available on this page.

Last updated 3 November 2026