Privacy Policy

Updated August 4, 2026

1. Data controller

Komi Media Ky
Business ID: 3263348-6
Koulukatu 13 c/o Laskentaplussa Oy, 30100 Forssa, Finland
contact@komimedia.fi

Privacy contact: Oona Komi, oona@komimedia.fi or contact@komimedia.fi. The controller is not legally required to appoint a separate data protection officer.

2. What personal data we process

• Contact form details: name, email address, company name, service of interest, advertising budget range, goal and timeline.
• Details you provide when booking a time via Calendly (name, email and booking-related information).
• Contact details and message content shared via email, phone or LinkedIn.
• Information related to managing the client relationship, such as contact person details, contract details and billing information.
• AI assistant (website chat) conversation messages: the messages you write and the assistant's replies, plus any contact details you voluntarily provide in the chat (name, email, company name and a description of your need).
• Technical data about website use, such as IP address, browser, device and pages viewed, if you have accepted analytics or marketing cookies.

3. Purpose and legal basis of processing

• Responding to inquiries and preparing proposals – legitimate interest and pre-contractual measures (GDPR Art. 6(1)(f) and 6(1)(b)).
• Managing the client relationship and delivering services – performance of a contract (GDPR Art. 6(1)(b)).
• Website development, visitor measurement and marketing targeting – consent (GDPR Art. 6(1)(a)), given via the cookie banner.
• Operating the AI assistant, answering questions and passing on contact requests – legitimate interest and pre-contractual measures (GDPR Art. 6(1)(f) and 6(1)(b)).
• Fulfilling statutory obligations, such as bookkeeping – legal obligation (GDPR Art. 6(1)(c)).

4. Is providing data mandatory?

Providing the mandatory fields in the contact form is not a statutory requirement, but the information is necessary for us to respond to your inquiry and to assess a possible collaboration. Without the mandatory information we cannot process your inquiry. Using the AI assistant is entirely voluntary and does not require you to provide personal data.

5. AI assistant (chat)

• What is stored: the conversation is shown in your browser for the duration of the session. Only the contact requests you choose to submit in the chat (name, email, company name and a short description of your need) are stored persistently on our side.
• Purpose: answering questions and forwarding contact requests to Komi Media.
• Legal basis: legitimate interest and pre-contractual measures (GDPR Art. 6(1)(f) and 6(1)(b)).
• Technical providers: our website platform and hosting provider, Google (Gemini language model via the language model interface) and our database service (EU region) where chat-submitted contact requests are stored.
• Retention: the conversation is discarded when you close the browser window. Contact requests submitted via the chat are retained like other inquiries, for up to 24 months.
• Transfers outside the EU/EEA: data is not transferred outside the EU or EEA; we use our providers' EU-region processing.
• Model training: conversations are not used to train AI models.
• Please note: do not share sensitive personal data (such as health data) or other people's personal data in the chat. The assistant is an AI and its answers may contain errors.

6. Sources of data

We collect data primarily from you directly: via the website form, bookings, email or phone. We may also supplement company contact details from public sources, such as a company's website or LinkedIn.

7. Retention period

• Inquiries that do not lead to a client relationship: up to 24 months from the contact.
• Data related to client relationships: for the duration of the relationship and up to 24 months after it ends.
• Accounting records are retained in accordance with the Finnish Accounting Act, either for at least six years from the end of the year in which the financial period ended, or for at least ten years from the end of the financial period, depending on the type of record.
• Cookie-based data: according to the retention periods described in the Cookie Policy.

8. Recipients and processors

• Website platform and hosting provider.
• Supabase – database storing inquiries submitted via the form and the chat (EU region).
• Email service used to reply to inquiries.
• Calendly – booking the free discovery call.
• Google Analytics – visitor measurement, only with consent.
• Meta Pixel and TikTok Pixel – advertising measurement and targeting, only with consent.
• Accounting and invoicing service.

We never sell or disclose personal data to third parties for their marketing purposes.

9. Transfers outside the EU or EEA

As a rule, personal data is not transferred outside the EU or EEA; we use providers and their EU-region processing. Should a provider process data outside the EU or EEA in the future, such transfers will rely on the European Commission's approved standard contractual clauses or certification under the EU–US Data Privacy Framework, together with any necessary supplementary safeguards.

10. Data security

Personal data is handled with care. Access is limited to those who need it for their work. Systems are protected with usernames, passwords and two-factor authentication, and data transfers are encrypted. We do not keep personal data in paper form.

11. Automated decision-making and profiling

We do not make automated decisions based on personal data that would produce legal effects on you. Ad targeting on advertising platforms is based on consent and takes place at the audience level.

12. Your rights

• The right to access your own data.
• The right to have data corrected.
• The right to have data erased.
• The right to restrict processing.
• The right to object to processing based on legitimate interest.
• The right to data portability.
• The right to withdraw consent at any time, for example via cookie settings.
• The right to lodge a complaint with a supervisory authority (the Office of the Data Protection Ombudsman, tietosuoja.fi).

13. Exercising your rights

You can exercise your rights by sending a request to oona@komimedia.fi. We will respond within one month at the latest. We may ask you to verify your identity before processing your request.

14. Cookies

This website uses cookies. Optional cookies are only enabled with your consent, and you can change your choice at any time via the Cookie Settings button in the footer. Read more in our Cookie Policy.

15. Changes to this policy

We update this policy as needed, for example when our services or applicable law change. Last updated: August 4, 2026.