This page is our privacy notice. It covers what the site collects, what happens when you get in touch, what we hold if we wrote to you first, and how client material is treated during an engagement.
The site is static HTML. It sets no cookies and loads no analytics script, no tag manager, no advertising pixel and no embedded third-party widget, so there is no cookie banner, because there is nothing to consent to. The fonts and the case-study films are served from our own host, and the site makes no third-party requests at all. There is no account to create and no form to fill in.
The pages are hosted by Netlify, a company based in the United States, and the access logs it keeps are held there. Those logs record the IP address, the time and the page requested, for security and for running the service. They are held on Netlify’s standard rotation and are not used to identify visitors or to build a profile of anyone. The legal basis for keeping them is our legitimate interest in running a secure site.
The site also counts page views on the server, without running a script in your browser or storing anything on your device. Each view records the day, which page was visited, the hostname of the referring site (if you came from another site) and a two-letter country code. No IP address, no information about your device or browser and no identifier is recorded, so one view cannot be linked to another. Netlify works out the country from the visitor’s IP address as part of serving the page, and the address itself is never stored. Individual records are kept in Netlify’s EU region (Frankfurt) for ninety days and then replaced by daily totals that hold only counts. The legal basis for counting them is our legitimate interest in understanding which content is read.
Netlify is certified under the EU–US Data Privacy Framework, an arrangement recognised by the European Commission for transfers of personal data to the United States, and that certification is the basis for the transfer. The European Commission’s standard contractual clauses apply as a fallback if the framework ceases to be available. A copy of either is available on request.
If you write or call, we use what you tell us in order to reply. The legal basis is steps taken at your request before a possible contract and our legitimate interest in answering enquiries.
Our email runs on Google Workspace. Our contract is with Google’s Irish company, and messages may be stored or processed by Google in the United States. Google is certified under the EU–US Data Privacy Framework, and the standard contractual clauses apply as a fallback if the framework ceases to be available. A copy of either is available on request.
Enquiries are kept for up to twenty-four months, or for as long as a client relationship lasts if one forms, and are then deleted.
You can ask what we hold about you and have it corrected, deleted or restricted. Write to enquiries@hapax.fi and we answer within a month, free of charge. If our answer does not satisfy you, the Finnish Data Protection Ombudsman takes complaints at tietosuoja.fi.
If you received an email or a call from us without contacting us first, we hold your name, job title, employer and work contact details (a work email address or your company’s switchboard number), together with a note on why the role looked relevant. All of it came from public professional sources: your employer’s website, press releases, public registries, business directories and LinkedIn. We hold no private contact details and we buy no marketing lists.
The legal basis is legitimate interest under GDPR Article 6(1)(f). Under Finnish direct-marketing guidance, consent is not required for business-to-business contact that is essentially tied to the person’s role. We have made and documented the balancing assessment, and you may request a summary of it.
We contact you personally and infrequently about services relevant to your role. Nothing else. We do not sell or share your details for others’ marketing. A CRM and an email provider process the data for us under data-processing agreements.
One reply asking us to stop ends it, permanently and without our asking why. After an objection we keep only your name, your employer and the date of the objection, so that we never write to you again. Everything else is deleted. Records with no engagement behind them are deleted at twenty-four months in any case.
You can also, at any time and free of charge, ask what we hold about you, have it corrected, deleted or restricted. Write to enquiries@hapax.fi and we answer within a month. If our answer does not satisfy you, the Finnish Data Protection Ombudsman takes complaints at tietosuoja.fi.
Anything a client shares that is not already public is confidential by default, including strategy, financials, internal documents and what gets said in a workshop room. It lives in Hapax’s business accounts rather than on personal accounts or personal devices, and the two founders are the only people who see it, as far as the engagement requires.
We use AI tools in our own work, and our contracts say so. Client personal data goes into such a tool only where there is a signed processing agreement with that vendor covering that use; confidential client information only where the engagement contract permits it. The working default is to anonymise, aggregate, or build a synthetic stand-in and work on that instead.
A client’s name, logo or story appears in anything we publish only with written permission. At the end of an engagement, or whenever you ask, client material is returned or deleted, apart from the invoices and contracts that Finnish bookkeeping law requires us to keep. If material is ever exposed by accident we tell you, and where personal data is involved the Data Protection Ombudsman is notified inside the seventy-two hours the regulation allows.
The case studies we publish run on data we generate ourselves. Each dataset is engineered so that the right answer is known in advance and held out of the analysis, which is what lets us mark our own results honestly. Where a study uses real documents they come from a public, openly licensed dataset. No client data appears in any of them, and none of them needs a client’s permission to exist.
Behind this page are the documents it summarises: the confidentiality and client-data policy, the AI-use and AI-literacy policy, the retention and data-rights procedure, and the record of processing activities kept under Article 30 of the GDPR. If a procurement or security team wants to read them before an engagement, write to enquiries@hapax.fi and we will send them. Hapax holds no security certifications.
Hapax Oy, Tyynenmerenkatu 3 B 38, 00220 Helsinki (Business ID 3657514-8, Finnish Trade Register). For anything on this page, write to enquiries@hapax.fi or call +358 45 322 3026.
Reviewed · November 2026