PRIVACY
Privacy policy
How personal information is used for enquiries, communication and optional website analytics.
Updated: 13 November 2026
1. Controller and contact details
Jake Virtanen maintains jakevirtanen.com and is the controller for personal data collected through this website. For enquiries and privacy requests, email jakevirtanen01@gmail.com.
If responding to your request involves another service provider, I explain which information needs to be shared and why before passing it on. That provider supplies information about its own processing where applicable.
2. Information collected and its sources
You provide your name, email address, message and, optionally, website, organisation and enquiry topic when you contact me. Later correspondence may include proposal, booking, contract and billing information. Please do not send special-category personal data, identification documents, passwords or other unnecessary confidential information through the public form.
Technical information may be generated when the website is used, including IP address, request times, browser and device information, requested pages and security logs. With consent, analytics can collect pseudonymous cookie identifiers, page views, broad location, referral information and agreed interaction events.
Information is obtained from you, your use of the site, and people involved in an enquiry or agreed project.
3. Purposes and lawful bases
Enquiries and requested proposals: information is used to answer you, clarify your request and take steps towards a contract at your request (GDPR Article 6(1)(b)) when you are the prospective contracting party. When you represent an organisation, necessary business communication is based on the legitimate interest in responding to relevant enquiries and managing business relationships (Article 6(1)(f)).
Client delivery and administration rely on the contract or, for business contact persons, that legitimate interest. Statutory accounting and other legal obligations rely on Article 6(1)(c). Proportionate security, abuse prevention and the establishment or defence of legal claims rely on legitimate interests in protecting the service and legal rights.
Non-essential analytics and advertising-related processing rely on your freely given consent (Article 6(1)(a)), alongside the applicable rules for cookies and similar technologies.
4. Use of contact details
Your contact details and message are used to deal with your enquiry, a related proposal or agreed service, and necessary follow-up about that matter. Sending a form does not add you to a newsletter, an advertising audience or an unrelated sales campaign. Contact details are not sold. They are not uploaded to advertising platforms for customer matching.
If a separate subscription is introduced later, it will have its own clear information and appropriate opt-in; it is not bundled with an enquiry.
5. Google Analytics and marketing measurement
When enabled and only after the required consent, Google Analytics 4 is used to understand which content and marketing activities bring relevant visits and enquiries, evaluate the website and improve marketing decisions. Events may distinguish a contact-button click, an email-link click and a successfully sent contact form. A click is not treated as proof of a qualified lead.
The enquiry message, name and email address are not sent to Analytics by the theme. The intended setup does not use User-ID, Google Signals, customer lists or advertising-personalisation features. Remarketing, Google Ads audience sharing or other new advertising purposes require their own configuration, notice and applicable consent before use.
Pseudonymous analytics information can still be personal data; it is not described as inherently anonymous.
6. Choice, cookies and withdrawal
Non-essential measurement is optional. You can reject it without losing access to the content or contact form. The cookie controls allow you to accept or reject optional categories and change your decision later. Withdrawal stops future consent-based collection; it does not undo processing that was lawful before withdrawal. Browser settings can help remove stored cookies, but do not replace the site’s consent mechanism.
The cookie policy and preferences explain the categories and provide access to the controls. External LinkedIn, Instagram and other links do not embed those services in the page; their privacy practices apply when you visit them.
7. Recipients and service providers
Access is limited to people who need the information to handle the enquiry or perform an agreed service, and to relevant hosting, security, backup, email and analytics providers. The contact mailbox is a Gmail address provided by Google; Google Analytics is a Google service when activated. Google Ireland Limited and/or Google LLC may be involved under the applicable service terms.
Professional advisers and authorities may receive necessary information where justified by a service, legal obligation or legal claim. A WordPress plugin does not automatically become a recipient merely by being installed: the actual integrations and settings determine what is transmitted. Enquiries are handled by Jake Virtanen. Information is shared with other service providers only where needed for the agreed purpose and on an applicable lawful basis.
8. Processing outside the EEA
Google and other service providers may process data outside the EU/EEA, including in the United States. Google describes its transfer arrangements in its data-transfer framework information. An adequacy decision can apply only where the recipient and processing are covered; otherwise appropriate safeguards, such as applicable standard contractual clauses and supplementary measures where required, are needed.
You can ask the controller for current provider details, processing locations and information or copies of the safeguards relevant to your data. A transfer is not treated as lawful solely because you used this website.
9. Retention
Enquiries that do not lead to a client relationship are normally deleted or anonymised within 12 months of the last substantive contact, unless a longer period is necessary for an ongoing matter or a documented legal obligation or claim. Client records are kept for the relationship and then only as needed for agreed services, legal obligations and applicable claim periods.
Accounting records follow the statutory retention applicable to each record category. Security logs and backups follow a limited operational retention schedule proportionate to security and recovery needs; records subject to an incident may need to be preserved longer. For the intended GA4 setup, user- and event-level retention is two months, with reset on new activity disabled. Aggregated reporting can remain available longer.
Cookie expiry is separate from analytics retention and is described by the consent manager. Deletion from live systems may take longer to propagate through rotating backups, which are not used for new marketing.
10. Your rights
Depending on the legal basis and circumstances, you may request access and a copy, correction, deletion, restriction, and portability of data you provided where processing is automated and based on consent or a contract. You may object to legitimate-interest processing on grounds relating to your situation; processing then stops unless overriding lawful grounds or legal claims justify it.
An objection to direct marketing must be respected without balancing interests. Consent can be withdrawn at any time. Some data may need to be retained to comply with law or defend a claim. Contact the controller using the details below; only proportionate identity verification will be requested. Requests are normally answered within one month.
If legally permitted because of complexity or number of requests, an extension of up to two further months will be explained within the first month.
11. Complaints, security and automated decisions
You can complain to the Office of the Data Protection Ombudsman in Finland or another competent EU/EEA supervisory authority, including in your place of habitual residence or work. Necessary access controls and reasonable organisational and technical measures are used to protect the data; no internet service is completely risk-free. The website is not intended for children and does not knowingly solicit their data.
No solely automated decision producing legal or similarly significant effects is made about you through the contact form. Basic analytics does not determine your eligibility for a service.
12. Is providing information required?
Browsing does not require sending an enquiry or consenting to optional analytics. Name, email and message are needed to respond meaningfully through the form; without them a response may not be possible. Optional fields are marked. Later contractual or legally required information will be explained in the relevant context.
If personal data is processed on behalf of a client, the respective responsibilities and a data-processing agreement are established where required.
13. Changes
This notice is reviewed when the services or processing change. Material new purposes will be explained and fresh consent sought where required; an update is not used to retrospectively authorise a new use of your information. This version is dated 13 November 2026.
Privacy policy · Cookie policy and preferences · Terms of use
The service provider, responsibilities and relevant privacy information are identified before any engagement begins.