Privacy Policy

1. Who is responsible for your personal data?

The data controller is:

If you have any questions about how your personal data is handled, you can contact me at the email address above.

I have not appointed a Data Protection Officer (DPO), as the nature and scale of my business do not require one.

2. What personal data do I process?

Depending on how you use the Website and how you contact me, I may process information such as your first name or full name, email address, the information you include in a contact-form message, details of your enquiry about coaching, mentoring or another service, and information you choose to provide when arranging or taking part in a session.

If you voluntarily share additional information during our correspondence or during a session, I may process it where this is necessary to respond to your enquiry or provide the service you have requested.

Please do not send information through the contact form that is not necessary for your enquiry, particularly sensitive information or special categories of personal data.

3. Why do I process your personal data?

I may process personal data in order to:

• respond to an enquiry sent through the contact form or by email;
• communicate with people interested in coaching or mentoring;
• arrange, organise and deliver coaching or mentoring sessions;
• provide requested services, including career coaching, CV review, cover-letter review and LinkedIn profile review;
• keep documentation that is necessary in connection with the services I provide;
• comply with legal obligations, including tax and accounting requirements where applicable;
• establish, exercise or defend legal claims;
• keep the Website secure and prevent misuse.

I will not use your data for purposes outside those described above without informing you and, where required, establishing an appropriate legal basis first.

4. Legal bases for processing

Depending on the circumstances, I rely on one or more of the legal bases set out in Article 6 GDPR, in particular:

• Article 6(1)(b) GDPR – where processing is necessary to take steps at your request before entering into a contract or to perform a contract, for example when arranging and delivering a session;
• Article 6(1)(c) GDPR – where processing is necessary to comply with a legal obligation;
• Article 6(1)(f) GDPR – where processing is necessary for my legitimate interests, such as communicating with people interested in my services, maintaining Website security, or establishing, exercising or defending legal claims;
• Article 6(1)(a) GDPR – where processing is based on your consent.

If I process your data on the basis of consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before consent was withdrawn.

5. Do you have to provide your personal data?

Providing information through the contact form is voluntary. However, I need certain information in order to respond to your enquiry and get back to you.

If you do not provide the information necessary to handle your enquiry or deliver a requested service, I may be unable to respond or provide that service.

6. Who may receive your personal data?

I may share personal data with service providers that support me in running my business and process data on my behalf, including:

• Netlify, Inc. – Website hosting and technical infrastructure;
• Netlify, Inc. – technical handling of the contact form through Netlify Forms, including security and anti-spam features;
• Google – Gmail, which I use for email correspondence;
• providers of online meeting tools where used, including Google Meet and Microsoft Teams;
• accounting or legal service providers where their involvement is necessary;
• providers of other IT tools where they are necessary to run the business or deliver the services.

Personal data may also be disclosed to public authorities or other authorised bodies where I am legally required to do so.

I use external providers only where their involvement is appropriate and necessary, and I take reasonable steps to ensure that personal data is processed lawfully.

7. Transfers outside the European Economic Area

Some of the services I use may be provided by organisations based outside the European Economic Area (EEA), or may otherwise involve transfers of personal data outside the EEA.

Where this happens, the transfer will be made in accordance with the GDPR, for example on the basis of a European Commission adequacy decision or appropriate safeguards such as Standard Contractual Clauses, where required.

As at the date of this Privacy Policy, this is particularly relevant to Netlify, which provides Website hosting and contact-form services, and Google, which provides Gmail. These companies may use infrastructure or subprocessors located outside the EEA, including in the United States. Where a transfer outside the EEA takes place, an appropriate mechanism under Chapter V GDPR will be used, such as an adequacy decision, the EU–US Data Privacy Framework where applicable to the relevant recipient, or Standard Contractual Clauses together with any additional safeguards required in the circumstances.

8. How long do I keep your personal data?

I keep personal data only for as long as it is needed for the purpose for which it was collected.

In particular:

• information sent through the contact form will be kept for as long as necessary to handle the enquiry and any follow-up contact, and afterwards for a period that is reasonable in light of the nature of the matter;
• information connected with the delivery of a service will be kept for as long as necessary to provide that service and for any further period required by law or needed to establish, exercise or defend legal claims;
• information that must be retained for tax, accounting or other legal purposes will be kept for the period required by the applicable rules;
• information processed on the basis of consent will be kept until consent is withdrawn, unless another legal basis justifies keeping it for longer.

Once the relevant retention period has expired, the data will be deleted or anonymised unless keeping it for longer is required or permitted by law.

9. Your rights

Subject to the conditions set out in the GDPR, you may have the following rights:

• the right to access your personal data;
• the right to receive a copy of your data;
• the right to have inaccurate or incomplete data corrected;
• the right to have your data erased (“the right to be forgotten”) where the GDPR requirements are met;
• the right to restrict processing;
• the right to data portability where applicable;
• the right to object to processing based on legitimate interests;
• the right to withdraw consent at any time where consent is the legal basis for processing.

To exercise any of these rights, please email me at irma.rosenvik@gmail.com.

I will respond to requests relating to your data protection rights without undue delay and within the time limits required by the GDPR.

10. Your right to complain

If you believe that your personal data is being processed in breach of applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority.

Where the Finnish supervisory authority is competent, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

You are also welcome to contact me first so that I have an opportunity to explain the situation and address your concerns.

11. Contact form

If you use the contact form on the Website, I process the information you enter so that I can deal with your enquiry and contact you. The form is technically handled through Netlify Forms. Your submission may be stored within Netlify’s infrastructure and, according to Netlify’s documentation, form submissions are automatically screened for spam using Akismet.

As a rule, the form asks for your name, email address, and the message or information needed to deal with your enquiry.

I do not use information submitted through the contact form to send unsolicited marketing messages unless I have an appropriate legal basis to do so.

12. Arranging a session

As at the date of this Privacy Policy, the Website does not offer self-service appointment booking or online payments. The contact form is used only to send an enquiry. Once I receive it, I may contact you by email or by phone, if you have provided a phone number, to agree the date, scope of the service and the next steps.

If an external booking system is introduced in the future, this Privacy Policy will be updated before that system is put into use.

13. Online sessions

Where coaching or mentoring sessions are held online, external online communication platforms may be used.

In that case, participant data may also be processed by the operator of the chosen platform under its own privacy policy.

As at the date of this Privacy Policy, the Website is not integrated with one permanent video-conferencing platform. If a session is to take place online, the specific tool — for example Zoom, Google Meet, Microsoft Teams or another agreed platform — will be confirmed before the meeting. The platform operator may process information needed to establish and secure the connection, including identification and technical data, in accordance with its own terms and privacy policy. I limit the information shared to what is necessary to conduct the session.

Sessions are not recorded unless you have been clearly informed in advance and there is an appropriate legal basis for the recording, including your consent where consent is required.

14. Cookies and similar technologies

The Website may use cookies and similar technologies.

They may be used, in particular, to ensure that the Website functions correctly, remember user settings and maintain security.

Cookies that are strictly necessary for the Website to function may be used without consent where permitted by applicable law. Where consent is required, it will be obtained through an appropriate consent mechanism.

As at the date of this Privacy Policy, the Website does not use Google Analytics, Meta Pixel, remarketing tools or other technologies for advertising profiling. The Website may use only cookies or similar technologies that are necessary for its proper operation, security, or to provide functionality expressly requested by the user where such technologies are used by the underlying infrastructure.

The hosting provider may also process technical connection logs — for example an IP address, browser type, the date and time of a request, and security-related information — where this is necessary to provide and protect the service.

The Website currently has no integrated booking or online payment system. If Cal.com, Stripe or another tool using cookies or similar technologies is introduced in the future, this Privacy Policy and, where required, the consent mechanism will be updated before the tool is launched.

15. Data security

I use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.

The safeguards I use are appropriate to the nature, scope and risk of the processing.

However, no method of transmitting information over the Internet and no form of electronic storage can guarantee absolute security.

16. Automated decision-making and profiling

I do not use the personal data of Website visitors to make decisions based solely on automated processing, including profiling, that have legal effects or similarly significant effects on the person concerned.

17. Changes to this Privacy Policy

I may update this Privacy Policy from time to time, particularly if the way the Website operates changes, the services I use change, or applicable law is amended.

The current version of the Privacy Policy will be published on the Website together with the date of the latest update.

18. Contact

If you have any questions about this Privacy Policy or how I process personal data, please contact me:

Last updated: 27 August 2026