Privacy Policy

1. Controller

The controller of personal data processed under this policy is:

2. Scope

This policy covers the one-off WasalaOptima diagnostic engagement, including enquiries, contracting, NDA acceptance, secure material transfer, analysis, report delivery and separately agreed follow-on discussions.

3. Personal data we process

• Contact and order data: name, work email, telephone number, organisation, role and additional information you submit.
• Contract data: the order agreement, NDA acceptance, invoicing details and engagement communications.
• Customer material: financial statements and any other financial, operational or organisational information supplied for the diagnostic.
• Diagnostic data: analysis inputs, working material, findings, estimates, report content and delivery records.
• Technical and security data: IP address, browser and device information, timestamps, authentication events and audit logs.

4. Purposes and legal bases

• Handling enquiries and preparing the order agreement and NDA — steps at the customer's request before entering into a contract (GDPR Art. 6(1)(b)).
• Producing and delivering the agreed diagnostic report — performance of a contract (GDPR Art. 6(1)(b)).
• Protecting confidential material, preventing misuse and maintaining auditability — legitimate interest (GDPR Art. 6(1)(f)).
• Invoicing, bookkeeping and compliance with legal obligations — legal obligation (GDPR Art. 6(1)(c)).

5. Recipients and processors

Authorised Wasala Oy personnel and vetted providers for hosting, private file storage, authentication, email and AI processing may process data only as needed to deliver and secure the engagement and under contractual confidentiality and data-protection obligations.

AI processing is performed server-side. Customer material is not used to train general-purpose AI models. Where processing outside the EU/EEA is necessary, appropriate safeguards such as EU Standard Contractual Clauses are used.

We may disclose data to accounting, legal or other professional advisers and public authorities where required by law. We do not sell customer data.

6. Retention

Order, invoicing and accounting records are retained for statutory periods. Enquiries are normally retained for up to 24 months. Customer material, working files and reports are retained only for the engagement and an agreed or reasonably necessary delivery and follow-up period, after which they are deleted or anonymised unless law or the contract requires longer retention. Backup copies may remain for a limited period.

7. Your rights

Subject to the GDPR, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to data portability. You may exercise these rights by contacting us via the contact form at wasalaoptima.com. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

8. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, row-level security in our database, and logging.

9. Cookies

The Service uses strictly necessary cookies and local storage to maintain your session and preferences. We do not use advertising cookies.

10. Changes

We may update this Privacy Policy from time to time. The current version is always available at wasalaoptima.com/privacy.

11. Applicable law

These terms are governed by Finnish law. Disputes shall be resolved primarily by negotiation, and secondarily settled finally by arbitration under the Arbitration Rules of the Finland Chamber of Commerce.

• (a) The arbitral tribunal consists of one member.
• (b) The seat of arbitration is Helsinki, Finland.
• (c) The language of the arbitration is English.