Privacy notice
Updated 27 September 2026
1. Controller
SamppaEdit, Business ID 3148390-6, Finland
Contact person: Samppa Vatanen
info@samppaedit.com, +358 44 239 5570
All privacy requests can be sent to info@samppaedit.com.
2. What data I process and where it comes from
Enquiries. When you email or call me, I process your name, contact details, company name, the content of your message and any attachments, such as product photos. You provide this data.
Bookings. When you book a time through my Google Calendar booking page, I process your name, email address, the time you booked and any message you add. You provide this data.
Sales outreach to companies. I contact online stores that advertise actively. Messages go to the company's general email address or to a person whose work includes advertising. I process the company name, the store's web address, the contact person's name, role and work email, the company's public advertising data, and the dates of and replies to my messages. This data comes from public sources: the company's website and the public ad libraries of Meta, Google, TikTok and LinkedIn.
Clients. Client contact persons' details, billing details, the contract, delivered material, and per-creative ad figures if the client chooses to share them.
Use of this website. This website uses no cookies and no analytics or tracking services. The hosting provider Netlify processes technical log data, such as IP addresses, to deliver the site and keep the service secure.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering enquiries, test concepts and bookings | Steps taken at your request before entering into a contract (GDPR Article 6(1)(b)) |
| Sales outreach to companies | Legitimate interest in offering ad creative production to online stores that advertise actively (Article 6(1)(f)) |
| Performing a client contract | Contract (Article 6(1)(b)) |
| Bookkeeping and invoicing | Legal obligation (Article 6(1)(c)) |
Your right to stop sales messages. You can stop my messages at any time by replying "no thanks" or by writing to info@samppaedit.com. The messages stop immediately and you do not need to give a reason. When a company objects, I stop contacting all of its addresses. I keep only the fact that you do not want to be contacted, so that I can respect it.
4. Retention
| Data | Retention |
|---|---|
| Sales outreach that does not lead to a client relationship | 6 months from the last contact |
| Requests not to be contacted | As long as needed to respect the request |
| Enquiries and bookings that do not lead to a client relationship | 12 months |
| Client data | For the duration of the contract and 3 years after it ends |
| Material supplied by the client | 3 months after the contract ends, unless agreed otherwise |
| Accounting records, such as invoices | 6 years from the end of the financial year, as required by the Finnish Accounting Act |
5. Who receives the data
Data is never sold or disclosed for marketing. I use the following service providers.
Processing on my behalf under a data processing agreement:
- Google Cloud EMEA Limited, Ireland: Google Workspace, meaning email, calendar and booking, spreadsheets and files
- Netlify, Inc., United States: website hosting
- Lemon Tree, accounting firm: bookkeeping and invoicing
Independent controller:
- Anthropic Ireland, Limited, Ireland: the AI service Claude, which I use to look up and assess public advertising data and to draft messages. A contact person's name and work email may pass through the service. Processing is governed by Anthropic's own privacy policy. I have opted out of my data being used to train AI models.
6. Transfers outside the EU and EEA
Some of my service providers are based in the United States or transfer data there, so your data may be processed outside the European Economic Area.
- Google: data may be transferred to Google LLC in the United States. The transfer relies on the EU-US Data Privacy Framework, under which Google LLC is certified.
- Netlify: the transfer relies on the Data Privacy Framework, under which Netlify, Inc. is certified.
- Anthropic: transfers data to the United States under the European Commission's standard contractual clauses.
An appeal concerning the validity of the Data Privacy Framework is pending before the Court of Justice of the European Union. If the framework ceases to apply, the Google and Netlify transfers rely on the Commission's standard contractual clauses. More information on the safeguards is available from info@samppaedit.com.
7. Automated decision making
I make no automated decisions with legal or similarly significant effects on you. Companies are ranked on public advertising data by how likely the service is to suit them. This concerns the company, not the person, and I decide on every contact myself.
8. Your rights
You have the right to:
- know what data I process about you and receive a copy of it
- have inaccurate data corrected
- have your data erased
- restrict processing
- object to processing based on legitimate interest, in particular sales outreach
- receive the data you provided in a machine readable format
Send requests to info@samppaedit.com. I reply within one month.
If you believe the processing of your data breaks data protection law, you can lodge a complaint with the Finnish Data Protection Ombudsman, tietosuoja.fi, or with the supervisory authority in your own country.