Privacy and cookies
A clear account of the data we process.
Google advertising code status
This site does not load Google advertising code or its consent message. Google ad requests are blocked.
Privacy, enquiry and paid-placement purchase pages load neither Google’s advertising code nor its consent message.
This notice covers the directory’s business information, voluntary enquiries, paid visibility and technical operation. Forms and payments are available only when the relevant feature is open on the site. The current Google advertising-code and consent status is described above.
Controller and privacy contact
The directory’s controller and operator is William Zimmerman / Zimmerman Consulting, Tampere, Finland.
For privacy requests and the exercise of your rights: pesulat@zimmermanconsultingfinland.com
Business information from public sources
Business names, services, premises, service areas and published professional telephone numbers come from businesses’ own public websites. Each listing shows its source and review date. General Google ratings are separate dated observations; we do not copy reviewer names or review text. A sole trader, a professional trading under a personal name or an identifiable professional contact detail can be personal data. Information about a legal entity as such differs from information about a person connected to it.
The information helps visitors find and compare local services. Checked public work-email addresses are retained in private research records and the server-side recipient register for organic customer-selected enquiries; they are not published in listings. We do not use the register for marketing mail or sell contact lists. A public contact detail does not establish consent, partnership or participation in the directory.
Purposes and lawful basis
Maintaining limited professional directory information and checking sources rely on legitimate interests (GDPR Article 6(1)(f)): helping people find local services, keeping information accurate and providing the directory service. The documented assessment requires limiting data to necessary professional facts, avoiding private information, and handling correction, erasure and objection requests. We make no automated decisions about individuals and do not compile private-life profiles. Public availability does not itself remove the duty to inform individuals about processing.
Using the enquiry form is voluntary; you can contact a business directly. Forwarding to your chosen businesses and processing the private administrative copy disclosed on the form rely on your separate consent (GDPR Article 6(1)(a)). You can decide not to submit; delivery may start immediately when you press send. The message is used to handle your enquiry, not to create a marketing list.
Contact enquiries
You can contact a business through its own website or published telephone number. If the directory’s enquiry form is available, you can use it to request information from selected businesses. The form shows availability and recipients before sending.
When you use the form, we process your name, reply email, message, service type, area and selected recipients, plus any optional telephone, date, group-size, service-need and budget details you provide. A reference and delivery status are stored. Daily hashes of IP and email addresses help prevent abuse; they are pseudonymised data, not anonymous data. Do not include health information or other sensitive information in your message.
You choose up to five matching businesses and give separate consent before sending. Each business receives a separate message. The directory team receives the mandatory private copy disclosed on the form; its address is not shown among business recipients. Directory questions and requests without a matching business go only to the directory team. Businesses are independent controllers of subsequent processing of their copies. Ownership of your supplied reply address is not verified. We send customers no confirmation request or automatic reply. An enquiry is not a booking.
Spam protection and email delivery
When you use the form, Cloudflare Turnstile processes IP addresses and technical browser signals for spam protection. Cloudflare also provides hosting, the database and delivery of the private administrative copy to a restricted verified address. Security, abuse prevention and limited delivery records rely on legitimate interests (GDPR Article 6(1)(f)). Cloudflare Turnstile Privacy Addendum.
Resend delivers enquiry messages to businesses and processes their content and reply address. The sending region is Ireland (eu-west-1), but Resend stores customer data in the United States; the sending region does not confine storage to Ireland. Email open and click tracking are disabled. Resend data processing and retention.
Retention and deletion
Database records for enquiries, recipient copies and delivery status have a 30-day retention period and are deleted at the next daily cleanup. This does not delete messages already delivered to recipients’ mailboxes. The administrative mailbox copy is normally deleted within 30 days after the matter closes; a specific dispute or legal claim may require limited longer retention of a necessary copy. Resend’s own retention, deletion and backup terms apply separately in its systems.
You can request access, correction or deletion through the privacy contact below. You may also contact the business that received your message directly about the copy it retains.
Directory-record retention
Necessary source and contact facts are retained while an active listing is maintained. They are reviewed when changes are reported and at least annually. Raw source captures have a target retention of 90 days after checking; only necessary limited evidence is kept longer when accuracy or a legal claim requires it. When a listing is removed, unnecessary personal and contact data is erased or withheld from publication. Any objection record is limited to preventing reintroduction. Contract and accounting information is kept for the period required by the relevant obligations.
Service providers and transfers outside the EEA
Cloudflare processes data for hosting, databases, security and email delivery; Resend delivers business-bound messages; Stripe handles payments; Google processes advertising data when advertising features are used. Some processing may take place outside the European Economic Area, including in the United States. Provider terms describe applicable safeguards, such as adequacy decisions and EU standard contractual clauses. You can request more information and applicable safeguards through the privacy contact.
Provider transfer safeguards: Cloudflare, Resend, Stripe, Google.
Review privacy
The directory’s own customer reviews are moderated before publication.
When enabled, we process the display name, stars, review text, email and technical submission reference. Salted hashes of IP and email addresses limit abuse. We do not verify ownership of the supplied email or a purchase. Cloudflare Turnstile processes technical signals for spam protection.
Every review is checked before publication. We publish your display name, stars, text and date. Your email is never published or sent to the business. Do not include other people’s personal details. This is not a verified-purchase review.
Payment does not influence reviews or moderation. Google ratings and this directory’s own ratings remain separate.
An approved review can trigger a one-time notification to the business’s checked contact address. It contains the public review and its link, never the reviewer’s email. Sending uses Resend and the directories’ shared free-service allowance.
Unpublished reviews and reviewers’ private contact details are removed after 90 days by the next cleanup run. Published reviews remain until removed. You can request correction or removal from the directory team using the review reference.
Contact the directory teamDemand measurement
When demand measurement is enabled, cookie-free first-party counters store the company, action, day and daily total for profile openings and clicks on website, telephone and email links. Counters do not store IP addresses, browser identifiers or individual event records. Technical data needed for service security is handled separately.
Payments and business customers
When you buy paid visibility, Stripe processes payment and billing data under its own privacy policy. The directory retains technical customer and subscription identifiers, the selected placement and status to provide the purchased visibility. Contract performance relies on GDPR Article 6(1)(b), and statutory accounting obligations on Article 6(1)(c). Payment data is not used in customer enquiries forwarded to businesses.
Advertising
Paid listings and sponsor placements are labelled as advertising. Illustrative advert examples are distinguished from real customer placements. Consent for any optional Google advertising processing is separate from enquiry-form consent. You can use the directory and contact businesses without accepting optional advertising.
Your rights
You can request information about processing, access to your personal data, correction, erasure or restriction. Data portability applies where the GDPR’s conditions are met. We normally respond within one month of receiving a request; any lawful extension and its reason will be communicated within the first month. We verify identity or business connection only to the extent needed to handle the request securely.
Your right to object
You can object to processing of your personal data based on legitimate interests on grounds relating to your particular situation. Send your objection to the privacy contact above.
You can withdraw consent to future enquiry processing at any time through the privacy contact above. Withdrawal does not affect earlier lawful processing or recall email already delivered. We handle requests to erase the copy we retain and, where necessary, direct you to the business that received the message.
You may also bring the matter to a competent supervisory authority. In Finland: Office of the Data Protection Ombudsman.
Contact
Zimmerman Consulting operates the directory. Privacy enquiries: pesulat@zimmermanconsultingfinland.com