Skip to content
Tove Zilliacus
Menu

Privacy policy

Data protection statement of ChangeSales Oy under the EU General Data Protection Regulation (GDPR). Last updated: 15 October 2026

1. Controller

ChangeSales Oy, Business ID 3306591-9, Helsinki, Finland

2. Contact person

Tove Zilliacus, tove@changesales.fi, +358 40 778 9245

3. Name of the register

Customer and marketing register

4. Purposes and legal basis

I process personal data to:

  • answer enquiries sent through the contact form, by email or by phone (legitimate interest, or steps taken at your request before a contract)
  • send you the book you request through the download form (your request). The data is not used for marketing or follow-up.
  • manage customer relationships and contracts (contract and legal obligations)
  • keep the website secure and running (legitimate interest)

Personal data is not used for automated decision-making or profiling.

5. Data collected

  • Contact and download forms: name, company, email address, phone number (optional), your message, and the time of submission
  • Customer relationships: position, organisation, contact details, ordered services, billing information and other information related to the customer relationship
  • Website server logs: IP address, time of visit, page requested, browser type

6. Sources

Information comes from you: through the website forms, email, phone, meetings and events. Contact details of company representatives may also come from public sources such as company websites and directories.

7. Cookies and tracking

This website uses no cookies and no analytics or tracking tools. Visitor statistics are produced by the hosting provider from server logs, without cookies.

8. Processors and data transfers

I use the following service providers to process personal data on my behalf:

  • Noisy Stream Oy (Avaruus.net), Finland: website hosting and server logs
  • The Bell CRM, operated by ChangeSales Oy: storage of form submissions and customer data. The Bell uses these infrastructure providers: Supabase (database, EU), Clerk (authentication, EU), Vercel (hosting, EU/US) and SendGrid (email delivery, US).
  • Proton AG, Switzerland: email. Switzerland has an EU adequacy decision.

Where data is processed outside the EU/EEA, transfers are covered by the European Commission’s Standard Contractual Clauses. Personal data is not sold or otherwise disclosed to third parties.

9. Retention

  • Contact and customer data: 3 years from the last contact, unless a longer period is required by law (e.g. accounting records)
  • Book download data: at most 3 years from the download
  • Server logs: kept by the hosting provider for a limited period for information security and visitor statistics, then deleted

10. Security

Data is stored in protected systems with restricted access. Only I have access to the register.

11. Your rights

You have the right to:

  • access the data held about you
  • have incorrect data corrected
  • have your data deleted
  • restrict or object to processing
  • withdraw consent at any time, without affecting processing that took place before withdrawal
  • receive your data in a portable format, where applicable

Send requests to tove@changesales.fi. I may ask you to confirm your identity. I reply within one month, as required by the GDPR.

12. Right to lodge a complaint

If you believe your data is processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), www.tietosuoja.fi.