Privacy policy

Last updated: 28 October 2026

This Privacy Policy explains how San Francisco Oy collects and uses personal data through sanfrancisco.fi and in connection with enquiries, business relationships, events, newsletters and marketing. It also explains the use of cookies and your privacy choices.

1. Who is responsible for your personal data?

The controller is:

San Francisco Oy
Business ID: 2296311-5
Kaivokatu 10 B
FI-00100 Helsinki, Finland
Email: legal@sanfrancisco.fi

Where San Francisco Oy processes personal data on behalf of a client, that processing is governed by the applicable client agreement and Data Processing Agreement.

2. What personal data is collected?

Depending on how you interact with San Francisco Oy, the following information may be processed:

Contact and professional details: name, email address, telephone number, employer, job title and other relevant professional information.
Enquiries and correspondence: information submitted through contact forms, appointment bookings, emails, meetings and other communications.
Business relationship information: information relating to proposals, services, contracts, transactions and business interactions.
Newsletter and event information: subscription details, preferences, registration information, consent records and unsubscribe requests.
Email engagement information: information about newsletter opens and link clicks, including associated timestamps and technical information.
Website and advertising information: online identifiers, IP address, browser and device information, pages visited, referral sources and interactions with the website and advertising, depending on the technologies used and your consent choices.
Privacy request information: information needed to verify and respond to requests concerning personal data.

Please do not submit sensitive personal information through general contact or booking forms unless specifically requested through an appropriate channel.

3. Where does the information come from?

San Francisco Oy receives personal data:

directly from you when you submit a form, book a call, subscribe, register for an event or communicate with San Francisco Oy;
from your organisation or another person involved in a relevant business relationship;
from publicly available professional sources, such as company websites;
from social media platforms when you submit a San Francisco Oy lead or registration form on those platforms; and
through website, email and advertising technologies, subject to applicable consent requirements.

4. How and why is personal data used?

Purpose	Legal basis
Responding to enquiries and arranging calls or meetings	Legitimate interests in responding to requests and developing business relationships. Where you are personally a prospective contracting party, taking steps at your request before entering into a contract.
Providing services and managing client, supplier and partner relationships	Legitimate interests in conducting business and maintaining professional relationships. Performance of a contract where you are personally a contracting party.
Managing event registrations and event-related communications	Legitimate interests in organising events and communicating with participants, or performance of a contract where applicable.
Sending newsletters and other electronic direct marketing	Consent where required. Where permitted by applicable law, legitimate interests in marketing relevant services to professional contacts.
Measuring newsletter engagement	Consent where required for tracking technologies; otherwise legitimate interests in assessing and improving communications, subject to applicable law and your rights.
Website analytics, advertising measurement and personalised advertising	Consent for technologies and associated processing requiring consent.
Maintaining security and preventing misuse	Legitimate interests in protecting information, services and business operations, and compliance with applicable legal obligations.
Accounting and other statutory duties	Compliance with legal obligations.
Establishing, exercising or defending legal claims	Legitimate interests in protecting legal rights.

Where processing is based on legitimate interests, San Francisco Oy considers its necessity and the effects on individuals’ rights and reasonable expectations.

You may object to direct marketing at any time. Where processing is based on consent, you may withdraw consent without affecting the lawfulness of processing carried out before withdrawal.

5. Contact forms, customer relationship management and appointment bookings

Information submitted through website forms is processed to respond to your request and manage the relevant interaction.

Form submissions may be stored in Webflow and transferred to Google Workspace, including Google Drive and email. Relevant enquiries and validated leads may also be recorded in Severa, the customer relationship management system used by San Francisco Oy.

San Francisco Oy uses Google Calendar appointment scheduling to offer call and meeting bookings, including during the initial testing of the booking service. Booking information is processed within Google Workspace and is accessible to personnel who need it to arrange or attend the meeting.

Submitting an enquiry or booking a meeting does not, by itself, subscribe you to a newsletter.

6. Newsletters, events and Mailchimp

San Francisco Oy uses Mailchimp to manage newsletter subscriptions, event communications and email marketing.

Information processed may include your contact details, employer, job title, subscription status, preferences, registration information and records of interactions with communications.

Newsletter subscribers join through website forms or request a subscription through other channels. Event registration information is also processed where you register for an event.

Mailchimp emails use opening and link-click tracking to help San Francisco Oy understand engagement and improve communications. Opening information is obtained through tracking technologies such as small images loaded in an email. Click tracking records interactions with links. These measurements may be affected by email privacy features and do not always accurately indicate an individual’s actions.

You can unsubscribe from marketing emails using the unsubscribe link or by contacting legal@sanfrancisco.fi. Unsubscribing does not prevent necessary service-related or event administration messages.

A limited record of an unsubscribe request or objection may be retained to ensure that your preferences are respected. Archiving a contact in Mailchimp does not permanently delete that contact’s information.

7. Website analytics and advertising

Google Analytics

San Francisco Oy uses Google Analytics to understand website use and improve content and performance.

Depending on your consent choices, information may include website interactions, referral sources, online identifiers, device and browser details and approximate location.

Google Signals is enabled. Where the applicable consent conditions are met, Google may associate website activity with information from Google accounts whose users have enabled the relevant advertising personalisation settings. This supports advertising features and aggregated audience insights.

Granular location and device data collection is also enabled, subject to applicable consent choices.

Google Ads

San Francisco Oy uses Google Ads for advertising, conversion measurement and remarketing.

Conversion measurement helps determine whether advertising leads to actions such as enquiries or bookings. Remarketing allows advertisements to be shown to eligible users who have previously interacted with the website.

San Francisco Oy also uses enhanced conversions. Where the required consent has been obtained, contact information supplied during a conversion, such as an email address or telephone number, may be converted into a cryptographic hash and shared with Google to improve conversion measurement. Hashing does not make this information anonymous.

Meta and LinkedIn

San Francisco Oy uses Meta Pixel and LinkedIn Insight Tag to measure advertising effectiveness and support advertising audiences, subject to applicable consent choices.

These technologies may provide the platforms with information about website visits, interactions, online identifiers and device details. The platforms may associate this information with their users in accordance with their terms and users’ settings.

San Francisco Oy may also receive information you choose to submit through advertising lead forms on Meta or LinkedIn. That information is used for the purposes explained in the relevant form.

Platform information

Google, Meta and LinkedIn may act as independent controllers or, for certain activities, joint controllers under the applicable service terms. Their privacy notices explain their processing and available controls:

8. Cookies and consent choices

Cookies and similar technologies store or access information on your device.

San Francisco Oy uses CookieYes to collect and manage consent choices and provide information about the technologies used on the website.

Necessary technologies

Strictly necessary technologies support functions such as security, consent preferences and services you expressly request. They do not require consent where the applicable legal exemption applies.

Analytics technologies

Analytics technologies help San Francisco Oy understand how the website is used. Optional technologies requiring consent are used according to your analytics choices.

Advertising technologies

Advertising technologies support conversion measurement, remarketing and personalised advertising. Optional technologies requiring consent are used according to your advertising choices.

You can accept or reject optional categories and change or withdraw your consent through Cookie settings, available in the website footer.

Rejecting optional cookies does not prevent you from contacting San Francisco Oy or accessing the website’s core content. Some optional third-party features may remain unavailable until the relevant consent is given.

The cookie information below describes the technologies identified on the website, their providers, purposes and durations.

You may also manage cookies through your browser. Deleting cookies may remove your saved preferences, in which case you may be asked to choose again.

Website cookie settings apply to website technologies. Newsletter subscriptions and email marketing preferences are managed separately through email unsubscribe links or by contacting San Francisco Oy.

9. Who receives personal data?

Personal data may be accessible to authorised employees, contractors and service providers where necessary for the purposes described in this policy.

Principal service providers include:

Provider	Purpose
Google Cloud EMEA Limited and relevant Google service entities	Google Workspace, email, file collaboration, appointment scheduling, analytics and advertising.
Visma Solutions Oy	Severa customer relationship management and related business administration.
The Rocket Science Group, LLC, doing business as Mailchimp	Newsletter subscriptions, event communications, email distribution and engagement measurement.
Webflow, Inc.	Website hosting and website form processing.
CookieYes Limited	Cookie consent management and related consent records.
Relevant Meta and LinkedIn service entities	Advertising, campaign measurement and lead forms.

Google’s contracting entity and role depend on the particular service used; the Google Workspace billing entity does not necessarily provide Google Ads or Google Analytics.

Providers acting as processors are subject to appropriate data processing terms.

Information may also be disclosed to professional advisers, authorities where legally required, and parties involved in a business transaction where necessary and subject to appropriate safeguards.

San Francisco Oy does not sell personal data.

10. International transfers

Some providers and their subprocessors may process personal data outside the European Economic Area, including in the United States and the United Kingdom.

Where a transfer takes place, San Francisco Oy uses an applicable mechanism under Data Protection Law. Depending on the recipient and circumstances, this may be an applicable European Commission adequacy decision or Standard Contractual Clauses supported by any necessary supplementary safeguards.

Reliance on the EU–US Data Privacy Framework is limited to recipients whose valid certification covers the relevant processing.

You may contact legal@sanfrancisco.fi for information about the safeguards applicable to your personal data and to request a copy, subject to necessary redactions protecting confidential information and other individuals.

11. How long is personal data retained?

San Francisco Oy retains personal data for as long as necessary for its specified purpose, taking account of the relationship, the relevance of the information, legal obligations and the need to establish, exercise or defend legal claims.

In particular:

Enquiries and leads: information is retained while needed to answer the enquiry, conduct a relevant sales discussion or manage a related business relationship. Information that is no longer necessary for these purposes is deleted or anonymised unless another lawful retention reason applies.
Client and supplier information: information is retained for the business relationship and afterwards where necessary for outstanding matters, legal obligations or claims.
Newsletter information: subscriber information is retained while needed to provide the subscribed communications. Following an unsubscribe request, information is limited to what remains necessary for respecting preferences, demonstrating compliance or another lawful purpose.
Event information: registration information is retained for event administration and necessary follow-up. Continued newsletter marketing is assessed separately from event participation.
Accounting and contractual records: applicable statutory retention periods and relevant legal claim requirements apply.
Privacy requests and consent records: records are retained where necessary to document and demonstrate compliance.

The current Google Analytics retention settings are:

Event-level data: two months.
User-level data: 14 months, with the retention period reset on new user activity.

These settings do not apply to all aggregated Analytics reports. Cookie durations are set out in the cookie declaration. Advertising platforms also apply their own retention rules.

Copies may remain in protected backups until removed through the applicable backup lifecycle.

12. How is information protected?

San Francisco Oy maintains technical and organisational measures appropriate to the information and risks involved.

These include access controls, confidentiality obligations, appropriate multi-factor authentication, encryption, device protection, personnel guidance and procedures for responding to security incidents.

Secure collaboration

Access to shared client files is limited to authorised individuals who need it for the agreed work.

Client representatives are expected to use an individual work account approved by their organisation when accessing files shared by San Francisco Oy. Personal email accounts should not be used unless separately agreed with San Francisco Oy.

Clients should promptly notify San Francisco Oy when a representative leaves their organisation or no longer requires access.

Further information relevant to client security assessments is available on request.

13. Your rights

Subject to the applicable conditions and exceptions, you may have the right to:

obtain access to your personal data;
request correction of inaccurate or incomplete information;
request deletion;
request restriction of processing;
object to processing based on legitimate interests;
receive certain personal data in a portable format; and
withdraw consent.

You may object to direct marketing, including related profiling, at any time.

To exercise your rights, contact legal@sanfrancisco.fi. San Francisco Oy may request information reasonably necessary to verify your identity.

Requests are normally answered within one month. If an extension is permitted and necessary, San Francisco Oy will explain the reasons and timeframe.

Deletion is not an absolute right. Certain information may need to be retained to meet legal obligations or establish, exercise or defend legal claims.

You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland or another competent supervisory authority.

14. Is providing information mandatory?

Providing personal data is generally voluntary. Certain information is necessary to respond to an enquiry, arrange a meeting, administer an event or provide agreed services.

Required form fields are identified when information is collected. If necessary information is not provided, San Francisco Oy may be unable to fulfil the relevant request.

15. Automated decision-making

San Francisco Oy does not use the personal data covered by this policy to make solely automated decisions producing legal or similarly significant effects on individuals.

Advertising measurement and audience selection may involve automated processing and profiling, subject to applicable consent choices.

16. Changes to this policy

San Francisco Oy may update this policy to reflect changes in services, processing or legal requirements.

The current version and update date are available on this page. Additional notice will be provided where required by law.