We collect and process the following personal data:

Basic details

• Name

• Email address

• Telephone

• Postal address

Identification details

• Personal identification number (where required in connection with an authority-related engagement)

• Tax identification number (from non-Finnish clients)

Data collected via our website

• Information you provide through the contact form (e.g. name, email address and message)

Engagement-related data

As controller, we also process the following engagement-related data relating to our private clients:

• country of residence and country of employment

• documents and information relating to residence permits and work permits

• information relating to social insurance and the coordination of social security within the EU

• other documents and information necessary for carrying out the engagement.

In some engagements relating to social insurance, we may process sensitive data relating to health. We only process such data when it is necessary for carrying out the engagement, and solely on the basis of your explicit consent.

We only process your personal data for specific purposes and always on an appropriate legal basis:

Purpose:

• Carrying out the engagement (consultancy, training, dealings with authorities) and invoicing

• Accounting

• Communication with the client

• Processing of sensitive data as part of an engagement (social insurance, possible health data)

• Newsletter or current updates

  (if introduced)

Legal Basis:

• Performance of a contract

• Legal obligation

• Performance of a contract or

  legitimate interests

• Explicit consent

• Consent

View the table illustration here.

We only share your personal data in the following situations:

• Authorities. We share your data with authorities when your engagement so requires (e.g. Kela, the Digital and Population Data Services Agency, the tax authority, or a corresponding authority in another country) or when we have a legal obligation to do so.

• Accounting firm. We share invoicing details with our accounting firm for bookkeeping purposes.

We also use service providers that process your personal data on our behalf under a valid data processing agreement:

• Microsoft and Elisa (email, Teams communications, document management in OneDrive) and our website platform Squarespace.

We process your personal data primarily within the EU/EEA. Data transmitted via our website platform Squarespace (such as contact form submissions) may also be processed outside the EU. However, Squarespace is committed to complying with EU data protection requirements, and transfers are protected by internationally recognised contractual and certification arrangements (the Data Privacy Framework).

We store your personal data only for as long as is necessary for the purposes described below or to fulfil our legal obligations.

Data Type:

• Material relating to private client

  engagements

• Invoicing and accounting data

• Contact form data (not leading to an engagement)

Storage Period:

• Delivered to the client upon completion of the engagement. Copies are deleted within one year of the end of the engagement.

• 6 years (obligation under the

  Accounting Act)

• 6 months from the date of contact

We follow the principle of data minimisation: we do not collect or store data beyond what is necessary.

View the table illustration here.

We have implemented technical and organisational measures to protect your data:

• Data is stored in secure cloud services (the Microsoft environment).

• Access to data is restricted to those who need it to carry out their duties.

• Material relating to the engagement is delivered to the client upon completion of the engagement and is not retained unnecessarily.

You have certain rights under the GDPR regarding the processing of your personal data. You may exercise these rights by contacting us by email (privacy@nolaworks.fi). We will respond to your request within one month.

Right of access

You may request a copy of your personal data that we hold.

Right to rectification

If your data is inaccurate or incomplete, you may request that we correct it.

Right to erasure

You may request the deletion of your data. This right does not apply to data that we are required to store by law (e.g. accounting records).

Right to restriction of processing

You may request that we restrict the processing of your data, for example when its accuracy is contested.

Right to object

You have the right to object to the processing of your personal data when the processing is based on legitimate interests. We will always inform you of this right separately whenever legitimate interests are the basis for processing.

Right to withdraw consent

If the processing of your personal data is based on your consent, you may withdraw that consent at any time with effect for the future.

Right to lodge a complaint with a supervisory authority

If you believe that your data is not being processed lawfully, you may lodge a complaint with the data protection authority:

• In Finland: Office of the Data Protection Ombudsman –

  www.tietosuoja.fi/en

• You may also lodge a complaint with the data protection authority of your country of residence.

We do not make automated decisions based on your personal data, nor do we use profiling that would significantly affect you.

Our website runs on the Squarespace platform. The website uses only technically necessary cookies required for basic functionality. We have made a conscious decision not to use analytics or marketing cookies.

As we do not use cookies that require consent, there is no separate cookie consent banner on the website.

If Squarespace sets technical cookies for its own purposes, these are governed by Squarespace’s own privacy policy.

Information you provide through the contact form is stored solely for the purpose of handling your enquiry.

We reserve the right to update the content of this notice in case of changes to our operations or applicable legislation. We will notify you of any material changes on our website.

Version 1.0 (June 2026)