Privacy notice
This notice covers wulffwiden.com and wulffwiden.de, including their contact forms and email enquiries.
joel@wulffwiden.comWho is responsible
The current controller is Joel Wulff, operating under the Wulff & Widén brand. Wulff & Widén Oy is in the process of registration; it is not presented here as an already registered company. This notice will be reviewed when registration and responsibility for the data change.
For privacy questions or requests, email joel@wulffwiden.com.
Information we process
You provide your name, company, email address, enquiry text and the type of help you request. We also receive the form language, submission time and referring page where supplied, plus any details you include in later correspondence. A phone number is processed only if you provide it.
Cloudflare processes technical request and security information, such as IP address, requested URL, browser/device information and bot-verification signals. Our rate limiter stores time-bucketed hashes derived from IP and email addresses, counts and expiry times, rather than raw addresses or message contents in its database. These hashes are pseudonymous, not anonymous.
Why we use it and the legal basis
We handle enquiries, arrange discussions and prepare requested proposals. Where you ask about entering a contract yourself, the basis is steps requested before a contract (GDPR Article 6(1)(b)). For business representatives and other enquiries, we rely on our legitimate interest in responding to relevant business communications (Article 6(1)(f)).
Hosting, bot checks, abuse prevention and troubleshooting rely on our legitimate interest in maintaining a secure, functioning website and protecting the mailbox from misuse (Article 6(1)(f)). Records needed to meet a legal obligation are processed under Article 6(1)(c), where applicable. Submitting an enquiry does not subscribe you to marketing.
Services and recipients
Joel Wulff handles enquiries. Cloudflare provides website hosting, network security, Turnstile bot checks and the D1 rate-limit database. Google Workspace/Gmail sends the enquiry notification and stores email correspondence. Their authorized personnel and subprocessors may process data as needed to provide these services. Professional advisers or authorities receive information only where necessary and legally justified.
The form is not connected to an AI model for evaluating or replying to your enquiry. We do not sell enquiry data. Automatic confirmation emails to the submitted address are currently disabled; successful submission is confirmed on the page.
International processing
Cloudflare and Google operate internationally, so processing can take place outside the EU/EEA, including the United States. The rate-limit database has EU jurisdiction configured; this does not mean all website or email processing stays in the EU.
Applicable safeguards are described in the providers’ data-processing terms linked above, including EU standard contractual clauses where required, and adequacy decisions where applicable. Contact us for details or a copy of the relevant safeguards. The service-specific terms determine which mechanism applies to a particular transfer.
Retention
Routine enquiries that do not become client work are deleted within 12 months after the last substantive contact. This is a manual retention policy, not an automatic mailbox deletion feature. Ongoing client matters, records needed for legal obligations and information reasonably needed for legal claims may be retained longer for that purpose; separate client privacy information applies where appropriate.
Rate-limit counters have active windows of no more than 24 hours. Expired rows are cleared during subsequent quota checks; they can remain stored until that cleanup runs. Provider backups can retain earlier copies until their normal expiry. Technical security records follow the services’ retention arrangements and may be retained as needed to investigate an incident. Details are available on request.
Cookies and browser storage
We have not installed advertising trackers or optional visitor-analytics scripts on this website. Fonts are served with the site. Cloudflare security checks may use necessary cookies or browser storage to prevent abuse. Turnstile processes technical signals for bot detection; see its privacy addendum above. These security functions are not used by us for advertising.
Your choices and rights
You can request access, correction, deletion or restriction of your data, object to processing based on legitimate interests, and request portability where the legal conditions apply. Rights are subject to applicable exceptions. Write to joel@wulffwiden.com; we normally respond within one month. We may need proportionate information to verify your identity.
You may complain to the Finnish Data Protection Ombudsman or the supervisory authority where you live or work or where an alleged infringement occurred.
Providing information and automated checks
You are not legally required to send an enquiry. The form marks the information needed to handle it; without contact details we cannot reply. You can email us instead of using the form. Please do not send health information, identity documents, passwords or other sensitive material.
Automated bot checks and rate limits can reject a submission. We do not use this form to make solely automated decisions with legal or similarly significant effects about you. If you cannot submit, contact joel@wulffwiden.com directly.