Privacy Notice
Effective date: 10 June 2026
This Privacy Notice explains how Alku HR Oy processes personal data in connection with its website, marketing, client relationships and services.
1. Data controller
Alku HR Oy
Business ID: 3535018-2
Email: privacy@alkuhr.com
Alku HR Oy is responsible for ensuring that personal data is processed in accordance with applicable data protection legislation.
2. Personal data we process
Depending on how you interact with us, we may process:
your name and contact details
your job title, employer and other professional information
meeting bookings and calendar information
emails, correspondence and information you provide to us
information relating to enquiries, proposals, contracts, client relationships and projects
invoicing and payment-related information
newsletter subscription and consent information
website usage, device, browser, IP address, cookie and analytics information
information obtained from public professional sources, such as company websites and LinkedIn
We may receive personal data directly from you, from the organisation you represent, from a client, from public professional sources or through the systems and service providers we use.
3. Purposes and legal bases for processing
We process personal data for the following purposes:
Enquiries, meetings and client relationships
We process personal data to respond to enquiries, arrange meetings, prepare proposals and agreements, provide our services and manage client relationships.
The legal basis is the performance of a contract, taking steps before entering into a contract or our legitimate interest in managing professional and business relationships.
Customer relationship management and business development
We use a customer relationship management system to organise information about prospective and current clients, meetings, discussions and business opportunities.
We may process relevant professional contact information for reasonable and targeted B2B marketing and business development.
The legal basis is our legitimate interest in developing our business and marketing our services to relevant companies and professional contacts.
You may object to the use of your personal data for direct marketing at any time.
Newsletter
We process your name, email address and subscription information when you voluntarily subscribe to our newsletter.
The legal basis is your consent. You may unsubscribe or withdraw your consent at any time by following the instructions in our communications or contacting privacy@alkuhr.com.
Invoicing and legal obligations
We process personal data for invoicing, accounting, taxation, payment administration and compliance with other legal obligations.
The legal basis is compliance with a legal obligation, performance of a contract or our legitimate interest in managing our business operations.
Website analytics and security
We process technical and website usage information to operate and secure our website, understand how it is used and improve its content and usability.
Strictly necessary processing is based on our legitimate interest in maintaining a functional and secure website. Where consent is required for analytics or other non-essential technologies, processing is based on your consent.
Further information is available in our Cookie Policy.
4. Service providers and recipients
We use external service providers to support our website, communications, client relationships and business administration.
Personal data may be processed by or disclosed to:
website hosting and website management providers
customer relationship management and meeting booking providers
email, calendar, cloud storage and collaboration providers
website analytics providers
accounting, invoicing, banking and payment service providers
communication, video meeting and IT service providers
professional advisers and insurance providers
public authorities where disclosure is required by law
These parties may act as processors on our behalf or as independent data controllers, depending on the service.
We require service providers acting on our behalf to process personal data in accordance with applicable data protection requirements. We do not sell personal data.
5. International transfers
Some service providers may process personal data outside the European Union or European Economic Area.
Where personal data is transferred outside the EU or EEA, we use an appropriate legal transfer mechanism, such as an adequacy decision by the European Commission, Standard Contractual Clauses or another safeguard permitted by applicable law.
You may contact us for further information about the safeguards used.
Where personal data is transferred outside the EU or EEA, we use an appropriate legal transfer mechanism, such as an adequacy decision by the European Commission, Standard Contractual Clauses or another safeguard permitted by applicable law. Further information about Squarespace’s international data transfer safeguards is available in Squarespace’s GDPR documentation.
6. Retention of personal data
We retain personal data only for as long as necessary for the purposes described in this Privacy Notice and to meet applicable legal requirements.
As a general rule:
newsletter subscriber information is retained until consent is withdrawn or the newsletter is discontinued
enquiries and prospective client information are generally retained for up to two years after the last meaningful contact
ordinary client and project information is generally retained for the duration of the relationship and up to three years afterwards
agreements and information necessary for legal claims may generally be retained for up to six years after the relationship ends
accounting and invoicing records are retained for the periods required by law
cookie and analytics information is retained as described in our Cookie Policy
Information may be retained for longer where this is required by law or necessary for an ongoing legal matter.
7. Personal data in client assignments
Some consulting assignments may involve personal data relating to a client’s employees, job applicants or other individuals, such as names, roles, survey responses, workshop notes or compensation information.
Where Alku HR Oy processes this information on behalf of a client, the client generally acts as the data controller and Alku HR Oy as the data processor.
In these situations, personal data is processed according to the client’s instructions and the applicable client agreement or data processing agreement.
We seek to minimise the use of identifiable personal data and use aggregated, pseudonymised or anonymised information where reasonably possible.
8. Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss and misuse.
Access to personal data is limited to those who need it for the relevant business purpose.
9. Your rights
Depending on the circumstances, you may have the right to:
access your personal data
request correction of inaccurate or incomplete data
request deletion or restriction of processing
object to processing based on legitimate interests
object to direct marketing at any time
withdraw your consent where processing is based on consent
receive certain personal data in a portable format
lodge a complaint with a data protection supervisory authority
These rights may be subject to limitations under applicable law. For example, some information must be retained to meet legal obligations.
To exercise your rights, contact:
We may need to verify your identity before responding to your request.
The supervisory authority in Finland is the Office of the Data Protection Ombudsman.
10. Automated decision-making and children
We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We do not intentionally collect personal data relating to children through our website or marketing activities.
11. Cookies
Our website uses cookies and similar technologies.
Further information about the technologies used, their purposes and how you can manage your choices is available in our separate Cookie Policy.
12. Changes to this Privacy Notice
We may update this Privacy Notice when our services, systems or personal data processing practices change or when required by law.
The latest version and its effective date are available on our website.