Privacy policy.

Controller

SC Audit Studio Oy is the controller for personal data processed through this website and our related business communications.

You can contact us at info@scauditstudio.com for privacy questions or data subject requests.

Scope

This policy covers scauditstudio.com, inquiry emails, and business communications with SCAS. If you use Havu or another SCAS product, additional product notices or terms may apply.

Personal data we process

We keep website data collection limited. We do not ask you to send credentials, production secrets, or sensitive personal data through this public site.

• Contact and business details, such as name, email address, company, role, and social or professional profile links you choose to share.
• Inquiry and project context, such as security review requests, audit scope, technical background, scheduling needs, and related correspondence.
• Technical website data, such as IP address, browser and device metadata, request times, pages requested, error logs, and security logs generated when the site is served.
• Public professional information that is relevant to a business inquiry or collaboration.

How we use personal data

• Respond to inquiries and communicate about potential or active work.
• Evaluate, scope, deliver, and support security reviews, audits, research, and advisory projects.
• Operate, maintain, troubleshoot, and secure the website and related systems.
• Manage business records, contracts, invoicing, legal obligations, and dispute prevention.
• Improve our services using aggregated or de-identified learning where possible.

Legal bases

Depending on the context, we process personal data because it is needed before entering into or performing a contract, because we have legitimate interests in running and securing our business, because we must comply with legal obligations, or because you have given consent where consent is requested.

Cookies and analytics

The public website uses Google Analytics to understand aggregate traffic and page usage. Google Analytics may process technical data such as page views, device and browser information, approximate location, and interaction data. Hosting, security, browser, and linked third-party services may also process technical data needed to serve pages, protect systems, or open external links.

Sharing

We do not sell personal data.

• Service providers that help us host, secure, communicate, operate, or administer the business.
• Professional advisers, insurers, auditors, or legal representatives where needed.
• Clients, partners, or collaborators where this is necessary for requested work and appropriate for the engagement.
• Authorities, courts, or regulators where required by law or needed to protect rights and security.

International transfers

Some providers may process data outside Finland or the European Economic Area. Where required, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, or equivalent protections.

Retention

We keep personal data only for as long as needed for the purpose it was collected, including business communication, service delivery, legal, tax, accounting, security, and dispute-prevention needs. Technical logs are generally kept for shorter operational periods unless needed for security investigation or legal reasons.

Security

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, and disclosure. No public website or internet communication can be guaranteed to be completely secure, so avoid sending highly sensitive material until an appropriate secure exchange path has been agreed.

Your rights

Subject to the limits and conditions under applicable law, you may have the right to access, correct, erase, restrict, transfer, or object to the processing of your personal data. Where processing is based on consent, you may withdraw that consent at any time.

Complaints

Please contact us first if you have a privacy concern. You also have the right to contact your local data protection authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

Changes

We may update this policy as our services, systems, or legal obligations change. The latest version will be posted on this page.