Privacy
Privacy notice
This notice covers website analysis, contacting companies about the results, and buying reports. Version 1.1, updated 5 September 2026. English translation for convenience; the Finnish tietosuojaseloste prevails.
Want to stop receiving our messages?
Reply to any of our messages with the word "poista" (or "remove") or email tietosuoja@aamucompliance.fi. We remove your contact details from our marketing list and keep a record of your opt-out so that we do not contact you again. There is no charge, and you do not need to give a reason.
Controller
Aamu Advisory Oy (Business ID 3435542-4), service name Aamu Compliance
Kauppakatu 14 8, 33210 Tampere, Finland
Email: tietosuoja@aamucompliance.fi
Why did you hear from us?
We analyse the public websites of Finnish companies for accessibility (the European Accessibility Act), technical baseline, search visibility and cookie practices, and offer reports on the findings as well as remediation services. We contact people at work only when the subject is directly relevant to their role.
What data we process and where it comes from
| Data | Source |
|---|---|
| Name, job title, work email address | Your company's public website |
| Company name, business ID, industry, web address | YTJ / PRH open data (avoindata.prh.fi) and the trade register |
| Technical findings about the website (e.g. accessibility gaps, headers, cookies) | Your site's public pages, fetched like an ordinary browser |
| Contact history (messages sent, replies, marketing opt-outs) | Our own system |
We do not process special categories of personal data or your private contact details.
Purpose and legal basis
- B2B direct marketing and customer acquisition: legitimate interest of the controller (GDPR Art. 6(1)(f)). A balancing test has been drawn up and is available on request.
- Maintaining marketing opt-outs: legal obligation and legitimate interest: honouring your objection requires recording it.
Electronic direct marketing to organisations is based on section 202 of the Finnish Act on Electronic Communications Services (917/2014); we message named individuals only where the matter substantially relates to their duties (section 200).
How long we keep data
| Data | Retention |
|---|---|
| Contact details, if you do not reply | 12 months from the last contact, then deleted |
| Website scan results | 12 months |
| Marketing opt-outs | Permanently, so that we do not contact you again |
| Contacts that became customers | Under the retention policy for customer records (separate notice) |
Recipients and transfers
We use service providers (processors) in the EU/EEA for sending email and storing data. Where a provider transfers data outside the EU/EEA, the transfer is based on a European Commission adequacy decision (for example the EU-US Data Privacy Framework) or standard contractual clauses. We do not sell or disclose your data to third parties for marketing.
Your rights
- The right to object to direct marketing at any time (GDPR Art. 21(2)). This right is absolute. The easiest way is to reply "remove" to any of our messages.
- The right of access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18).
- The right to lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman, tietosuoja.fi.
Contact: tietosuoja@aamucompliance.fi. We reply within one month at the latest.
Buying reports and personal links
When we send a company a message, it may contain a personal link (address of the form raportti.aamuadvisory.com/r/…) through which the reports made for the company's site can be bought. The link is tied to the company and the site, not to a person: the page contains neither your name nor your email address, it sets no cookies and it runs no tracking scripts. We record the dates and number of link openings on our own server, with at most one entry per day. We do not store IP addresses, browser or device details, or any other information about the visitor. We use it only to see whether our message was of interest, and it is deleted together with the link, within 60 days at the latest. The lawful basis is the same legitimate interest as the outreach itself.
When you buy a report, payment is processed by Stripe Payments Europe Ltd (Ireland) as an independent controller for payment data and as our processor for receipts and invoices. From Stripe we receive the email address you give at payment, the company name and any business ID or VAT number, the products bought and the payment identifier. We use these to perform the contract (GDPR Art. 6(1)(b)) and keep them for the period required by the Finnish Accounting Act (6 years from the end of the financial year). Reports and order records are stored with Cloudflare, Inc. (EU region) as our processor.
Cookies on this site
This site sets no cookies and uses no analytics or tracking services.
Website analysis (the Luotain bot)
We analyse only publicly available pages using the same methods as an ordinary browser. The
bot identifies itself with the user-agent LuotainAudit; its behaviour and the
opt-out instructions are on the Luotain bot page.