We process personal data in line with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
1. Who we are
The controller of your personal data is Haamu Technologies Oy, trading as Haamu.io, Business ID 3525500-3, Rantaniityntie 10 A 6, 02390 Sarvvik, Finland.
For questions about this policy or your data, contact us at sari@haamu.io.
2. What data we collect
We collect data you give us directly, data created while we work together, and data collected automatically when you use our website.
- Contact details: name, email, phone number, company and job title, from forms, call bookings or email.
- Newsletter data: email address, subscription status, and email opens and clicks.
- Booking data: meeting time and the details you enter when booking a call.
- Purchase and billing data: billing contact, company details, VAT number, and order and payment details.
- Service content: interview recordings and transcripts, your stories and opinions, drafts, feedback, and photos and videos you share.
- LinkedIn account data: profile details, past posts and post analytics (impressions, reactions, comments, followers), received from LinkedIn when you connect your account to the Haamu platform.
- Communication data: messages exchanged by email, Slack or other channels.
- Technical and usage data: IP address, device and browser type, pages viewed, referring site and cookie IDs, collected via cookies and similar tools.
- Advertising data: ad clicks, campaign interactions and conversion events, from the advertising platforms we use.
We do not intentionally collect special categories of personal data, such as health data. Please don't share such data in interviews unless you want it to appear in your content.
Payment card details are processed by Stripe, our payment provider, and are not stored by us.
3. Why we use your data and on what legal basis
We only use personal data for a specific purpose and with a legal basis under GDPR Article 6.
- Answering enquiries and holding sales calls: steps before entering a contract, or our legitimate interest in responding to business enquiries.
- Delivering the service (interviews, writing, publishing and analytics): performance of a contract.
- Connecting to and publishing on your LinkedIn account: performance of a contract, based on the access you grant.
- Billing, accounting and bookkeeping: legal obligation under Finnish accounting law, and performance of a contract.
- Sending our newsletter: consent, which you can withdraw at any time.
- B2B marketing to business contacts: legitimate interest in promoting our services.
- Website analytics and improvement: consent, via cookie settings.
- Advertising and measuring ad performance: consent, via cookie settings.
- Using results or quotes as customer stories: consent.
- Protecting our rights and the security of our services: legitimate interest and legal obligations.
Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (see section 8).
We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
4. Cookies, analytics and advertising
We use cookies and similar technologies on haamu.io, managed through our consent tool Cookiebot. Strictly necessary cookies are always on. All other cookies are used only with your consent, which you give or decline in the cookie banner when you first visit. You can change or withdraw your consent at any time using the cookie settings button on the site.
- Strictly necessary: running the website, remembering your cookie choices and the shopping cart (Webflow, Cookiebot, HubSpot, HeadQ).
- Analytics: understanding how visitors use the site so we can improve it (Google Analytics, Google Tag Manager, HubSpot).
- Marketing: measuring ad performance and showing relevant ads on other platforms (LinkedIn Insight Tag, HubSpot ads tracking).
Advertising platforms may combine data from our site with data they already hold about you, under their own privacy policies. We may also use audiences such as website visitors to show you ads on LinkedIn or Google.
You can also block or delete cookies in your browser settings. Blocking some cookies may affect how the site works.
5. Who we share data with
We do not sell your personal data. We share it only with service providers who help us run our business, under data processing agreements, and only as far as they need it.
- Website hosting: Webflow, for hosting haamu.io, Cloudflare, for bot protection on our forms, and Cookiebot, for managing cookie consent.
- CRM, booking and email: HubSpot, for website forms, call bookings, customer records and our newsletter.
- Payments and invoicing: Stripe and HeadQ, for online purchases, and Procountor, for invoicing and bookkeeping.
- Content and analytics platform: the Haamu platform and LinkedIn, for planning, publishing and tracking your posts.
- Communication and productivity: Slack, Google Workspace and Riverside, for working with you and storing interview recordings.
- Transcription and writing tools: Riverside and third-party AI models, for transcribing interviews and drafting content. Our agreements with these providers prevent them from using your content to train their models.
- Analytics and advertising: Google, for Analytics and Tag Manager, and LinkedIn and HubSpot, for advertising and measuring it.
- Professional advisers and authorities: accountants, lawyers and authorities, when required by law or to protect our rights.
Our team includes people in several countries. Team members outside Finland access data only as needed to deliver your service.
6. International transfers
Some providers, such as Google, LinkedIn, HubSpot, Webflow, Slack, Stripe and Riverside, may process data outside the EU/EEA, including in the United States. When this happens, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, with extra safeguards where needed.
7. How long we keep data
We keep personal data only as long as needed for the purpose it was collected for.
- Customer and service data, including recordings: for the contract term plus 12 months, unless you ask us to delete it sooner.
- Accounting records: 6 years after the end of the financial year, as required by the Finnish Accounting Act.
- Sales leads and enquiries: 24 months from last contact.
- Newsletter data: until you unsubscribe.
- Cookie data: as described in our cookie settings, at most 13 months.
When you disconnect your LinkedIn account from the Haamu platform, we stop accessing it. Content already published on your profile stays there unless you delete it.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data deleted, where there is no legal reason to keep it
- restrict how we use your data
- object to processing based on legitimate interest, and to direct marketing at any time
- receive your data in a portable format
- withdraw consent at any time, without affecting earlier processing
To use your rights, email sari@haamu.io. We reply within one month. You can unsubscribe from our newsletter using the link in any email.
If you think we have handled your data unlawfully, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi), or to the data protection authority in your own EU country.
9. Security
We protect personal data with access controls, two-factor authentication where available, encrypted connections, and by giving team members access only to the data they need. No system is fully secure, but we work to prevent unauthorised access, loss or misuse.
10. Changes to this policy
We may update this policy when our services or the law change. The latest version is always on this page, with the date it was last updated.
11. Contact
Haamu Technologies Oy · Rantaniityntie 10 A 6, 02390 Sarvvik, Finland · sari@haamu.io
