Privacy Policy
KOOK Management Oy
Last updated: 1.7.2026 Version: 2.0
This policy explains what personal data KOOK Management Oy processes, on what legal basis, for how long, and what rights you have. It is issued under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Finnish Data Protection Act (1050/2018).
1. Controller
KOOK Management Oy Business ID: 2913931-3 Registered address: Kaarina, Finland
Website: kookmanagement.fi
Contact for all privacy matters: privacy@kookmanagement.fi
KOOK Management Oy has not designated a Data Protection Officer under Article 37 GDPR. Designation is not mandatory for KOOK: it is not a public authority, its core activities do not consist of large-scale systematic monitoring, and it does not process special categories of data on a large scale. All privacy matters are handled by the controller at the address above.
2. What this policy covers
This policy covers personal data processed through the kookmanagement.fi website, through direct business contact, and in the course of client engagements where KOOK acts as controller.
It does not cover personal data contained in client materials that KOOK processes on a client’s behalf during an engagement. In those cases KOOK acts as a processor under Article 28 GDPR, and processing is governed by the data processing agreement forming part of the relevant engagement contract, not by this policy.
3. Categories of personal data
| Category | Data | Source |
|---|---|---|
| Contact and enquiry data | Name, email address, telephone number, company, role, content of the enquiry | Provided by you |
| Client relationship data | Contact details of client representatives, engagement correspondence, meeting notes, contract and invoicing data | Provided by you or generated during the engagement |
| Financial and statutory records | Invoicing details, payment records, accounting entries | Generated by the engagement |
| Technical data | IP address, timestamp, browser and device type, pages requested, referring URL | Collected automatically by the web server |
| Pre-engagement research data | Publicly available information about prospective client organisations and their named representatives, drawn from public registers, company websites, official company social media accounts, and published media | Public sources (see section 8) |
KOOK does not process special categories of personal data under Article 9 GDPR, and does not process data relating to criminal convictions or offences.
4. Purposes and legal bases
Processing is carried out only for the purposes below, each on the legal basis stated.
4.1 Responding to enquiries and preparing engagements
Data: contact and enquiry data. Legal basis: Article 6(1)(b) — steps taken at your request prior to entering into a contract. Where no contractual relationship is contemplated, Article 6(1)(f) — legitimate interest in responding to business correspondence addressed to KOOK.
4.2 Delivering and administering client engagements
Data: client relationship data. Legal basis: Article 6(1)(b) — performance of a contract to which you or your organisation is party.
4.3 Invoicing, accounting and statutory record-keeping
Data: financial and statutory records. Legal basis: Article 6(1)(c) — compliance with a legal obligation, in particular the Accounting Act (1336/1997) and the Value Added Tax Act (1501/1993).
4.4 Website operation and security
Data: technical data. Legal basis: Article 6(1)(f) — legitimate interest in operating the website, maintaining availability, and detecting and preventing misuse and attacks. The processing is limited to what is necessary for these purposes and is not used to profile visitors.
4.5 Pre-engagement research
Data: pre-engagement research data. Legal basis: Article 6(1)(f) — legitimate interest in preparing for a business meeting on an informed basis.
KOOK restricts this research to sources that are lawfully public and to information published by organisations in their own name. KOOK does not analyse the personal social media profiles or personal posts of individual employees. Research material is used internally to prepare for a meeting and is deleted once the meeting has taken place or the opportunity has lapsed. Where you are named in such material, section 8 sets out your right to object.
4.6 Newsletter and marketing communications
Data: name and email address. Legal basis: Article 6(1)(a) — your consent, given at the point of subscription.
Consent may be withdrawn at any time using the unsubscribe link in any message or by writing to privacy@kookmanagement.fi. Withdrawal takes effect without undue delay and does not affect the lawfulness of processing carried out before withdrawal.
5. Is provision of data required?
Providing your contact details is voluntary. If you do not provide them, KOOK cannot respond to an enquiry or enter into an engagement. Provision of invoicing and accounting data by a client is a statutory requirement arising from the legislation cited in section 4.3.
6. Recipients and processors
KOOK does not sell personal data and does not disclose it for the marketing purposes of any third party.
Personal data is disclosed to the following categories of recipient:
| Recipient | Purpose | Role and location |
|---|---|---|
| Hostingpalvelu Oy | Hosting and serving kookmanagement.fi; hosting of KOOK email, including correspondence sent to privacy@kookmanagement.fi | Processor — Finland |
| Google Ireland Limited / Google LLC | Storage of client engagement documents and bookkeeping records in Google Drive [CONFIRM — add calendar here if a Google calendar is used] | Processor — EU with processing in the United States |
| Calendly LLC | Scheduling the initial conversation | Processor — United States |
| Authorities | Where disclosure is required by law | Independent controller |
Each processor operates under a written agreement meeting the requirements of Article 28(3) GDPR and processes personal data only on KOOK’s documented instructions.
6.1 Storage of client engagement material
All client engagement material is stored in Google Drive under a business account held by KOOK Management Oy. KOOK does not store client material containing personal data in consumer cloud services that are not covered by a data processing agreement under Article 28(3) GDPR. Personal accounts and personal cloud storage used by the controller for private purposes contain no KOOK client data and fall outside the scope of this policy.
7. Transfers outside the EU/EEA
Some of the service providers listed in section 6 process personal data outside the EU/EEA, in the United States. This applies to Google and Calendly. Hosting of kookmanagement.fi takes place in Finland.
Such transfers are carried out on one of the following bases:
- Article 45 GDPR — an adequacy decision, where the recipient is an active participant in the EU–US Data Privacy Framework; or
- Article 46(2)(c) GDPR — the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures following a transfer impact assessment.
A copy of the safeguards applying to any given transfer is available on request from privacy@kookmanagement.fi.
8. Retention
Personal data is retained only for as long as one of the periods below applies. Data is deleted or anonymised at the end of the applicable period.
| Data | Retention period | Basis |
|---|---|---|
| Enquiries that do not lead to an engagement | 12 months from last contact | Legitimate interest in follow-up; no longer necessary thereafter |
| Client relationship and engagement records | 10 years from the end of the engagement | General limitation period, Limitation Act (728/2003) |
| Accounting material and invoices | 6 years from the end of the accounting period, as a statutory minimum | Accounting Act (1336/1997), Chapter 2, Section 10 |
| Web server and access logs | 12 months | Security and misuse detection |
| Pre-engagement research material | Deleted once the meeting has taken place or the opportunity has lapsed, and in any event within 6 months of creation | Purpose exhausted |
| Newsletter subscriber data | Until consent is withdrawn, then 30 days | Consent; short window retained to honour the unsubscribe |
Where retention periods overlap, the longest applicable period governs.
9. Your rights
You have the following rights in relation to personal data KOOK holds about you. Requests are handled free of charge and answered within one month of receipt, extendable by two further months where a request is complex, in which case you will be informed within the first month.
- Access (Art. 15) — to obtain confirmation of whether your data is processed, and a copy of it.
- Rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17) — to have your data deleted where one of the grounds in Article 17 applies. This right does not extend to data KOOK is required by law to retain, in particular accounting records.
- Restriction of processing (Art. 18) — to have processing limited while a dispute over accuracy or lawfulness is resolved.
- Data portability (Art. 20) — to receive data you have provided, in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
- Objection (Art. 21) — to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, including the pre-engagement research described in section 4.5. KOOK will cease processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms.
- Withdrawal of consent (Art. 7(3)) — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of prior processing.
How to exercise these rights. Write to privacy@kookmanagement.fi. Requests may be made in the same manner and channel in which you contacted KOOK. No signed paper form, postal submission or specific format is required. KOOK may ask you to verify your identity where there is reasonable doubt as to who is making the request.
Automated decision-making. KOOK does not carry out automated decision-making or profiling producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 GDPR.
10. Right to lodge a complaint
If you consider that KOOK’s processing of your personal data infringes data protection law, you have the right under Article 77 GDPR to lodge a complaint with the supervisory authority, regardless of any other remedy.
11. Cookies and tracking
kookmanagement.fi uses only cookies and similar technologies that are strictly necessary for the website to function and remain secure. These are permitted without consent under Section 205 of the Act on Electronic Communications Services (917/2014).
KOOK does not use advertising cookies, social media pixels, or cross-site tracking technologies. The Google Analytics and Meta pixel tags referenced in earlier versions of this policy have been removed from the site.
Aggregate visitor statistics are compiled from server logs. This does not involve tracking individuals across sessions or across websites.
You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the site from working.
12. Security
Personal data is stored on access-controlled systems protected by unique user credentials and multi-factor authentication. Access is limited to those who need it to perform their duties. Any material held in physical form is kept in locked premises. Personal data is not stored on unencrypted portable media.
KOOK does not store payment card details or bank credentials.
KOOK assesses personal data breaches without undue delay and, where a breach is likely to result in a risk to the rights and freedoms of data subjects, notifies the Office of the Data Protection Ombudsman within 72 hours in accordance with Article 33 GDPR, and notifies affected individuals where Article 34 requires it.
13. Changes to this policy
KOOK reviews this policy at least annually and whenever its processing activities change materially. The current version is always published at kookmanagement.fi. Material changes affecting your rights will be communicated directly where KOOK holds contact details for you and the change requires it.
14. Supersession
This policy replaces all previous privacy and register statements issued by KOOK Management Oy, including versions issued under Sections 10 and 24 of the Personal Data Act (523/1999), which was repealed on 1 January 2019.