Last updated: 1 June 2026
This document is a plain-language summary intended to satisfy the transparency requirements of Articles 13–14 GDPR. Final wording will be reviewed by Finnish counsel before any change in scope of processing.
1. Controller
The controller of personal data processed via this website is Hope Valley, Business ID (Y-tunnus) 3341227-1, registered at Kirstinharju 3 D 53, 02760 Espoo, Finland. Privacy enquiries: operations@bpo.hopevalley.digital · Phone: +358 46 579 5294.
2. Categories of personal data we process
- Contact form & pilot enquiry data: name, work email, company name, message content and any information you choose to provide.
- Technical logs: IP address, user agent, request timestamps and basic diagnostic data generated by our hosting infrastructure.
- Cookie preference: your consent choice stored locally in your browser (see Cookie Policy).
We do not knowingly collect special categories of data (Article 9 GDPR) via this website.
3. Purposes and legal bases
- Responding to your enquiry and preparing a possible engagement — Article 6(1)(b) GDPR (steps prior to entering a contract) and, where applicable, Article 6(1)(f) (legitimate interest in answering business enquiries directed to us).
- Service delivery and account administration for clients — Article 6(1)(b) GDPR.
- Accounting and statutory record-keeping — Article 6(1)(c) GDPR, based on the Finnish Accounting Act (Kirjanpitolaki 1336/1997), which requires retention of accounting material for six (6) years from the end of the relevant accounting period.
- Securing our website and preventing abuse — Article 6(1)(f) GDPR.
4. Recipients and processors
We only share personal data with parties that need it to deliver our services or operate this website:
- HighLevel — our CRM and workflow platform, acting as a processor under Article 28 GDPR for enquiry handling and client communications.
- Hosting and edge providers serving this website and any associated infrastructure.
- Professional advisers (accounting, legal) bound by confidentiality.
- Public authorities where we are required to disclose data by law.
5. International transfers
Where personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where appropriate, additional safeguards in line with the Schrems II judgment of the Court of Justice of the European Union.
6. Retention
- Enquiry data that does not lead to an engagement: deleted or anonymised within 24 months of last contact.
- Client data: retained for the duration of the engagement and for any period required by law.
- Accounting records: six (6) years under the Finnish Accounting Act (1336/1997).
- Server logs: short rolling retention for security and diagnostics.
7. Your rights as a data subject
Under Articles 15–22 GDPR you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate data;
- request erasure ("right to be forgotten") subject to legal retention duties;
- request restriction of processing;
- data portability where processing is based on consent or contract and carried out by automated means;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at operations@bpo.hopevalley.digital.
8. Right to lodge a complaint
You have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), PL 800, 00531 Helsinki — tietosuoja.fi. You may also contact the supervisory authority of your habitual residence or place of work in the EU/EEA.
9. Security
We apply appropriate technical and organisational measures (Article 32 GDPR) to protect personal data against unauthorised access, alteration, disclosure and loss. Access is limited to personnel and processors who need it for the purposes set out above.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via this page with a revised "Last updated" date. Continued use of the website after publication constitutes acknowledgement of the updated policy.