How UtterFocus handles personal information.

Effective date: 18 May 2026 · Applies to utterfocus.com and UtterFocus enquiries, audits, proposals, and client communications

UtterFocus is a digital infrastructure studio that designs and builds growth websites, structured CMS platforms, operational web systems, automation workflows, and technical support arrangements. To operate this website and respond to people who contact us, we process a limited amount of personal information.

We do not sell personal data. We do not use personal information to make automated decisions that produce legal or similarly significant effects. We aim to collect only the information needed to understand a request, respond professionally, deliver agreed services, maintain security, and improve the usefulness of the website.

This policy covers personal data submitted through this website, email, project enquiry forms, audit forms, newsletter forms, calendar-booking links, proposal discussions, and normal client communication connected to UtterFocus services.

The controller for personal data processed through this website is UtterFocus Studio, operated as part of We Doing Good Oy in Finland.

• Website: utterfocus.com

• Contact email: hello@utterfocus.com

• Location: Finland

If you become a client, additional project-specific privacy, confidentiality, data-processing, or security terms may be included in the relevant proposal, service agreement, data-processing agreement, or statement of work.

The data we collect depends on how you interact with the website and with UtterFocus. It may include:

• Identity and contact details: name, email address, phone number, role, company or organization name, country, and preferred contact method.

• Enquiry and project details: website URL, project goals, budget range, timeline, current tools, technical issues, business context, service interests, and information you include in forms, emails, briefs, or discovery calls.

• Audit and diagnostic information: information about your website, CMS, workflows, integrations, analytics setup, lead-capture process, operational bottlenecks, and growth or infrastructure needs.

• Client communication data: proposal history, meeting notes, decisions, feedback, implementation requests, support tickets, handover records, billing-related correspondence, and project administration details.

• Newsletter and marketing preferences: subscription status, consent records, unsubscribe requests, content preferences, and engagement with UtterFocus communications.

• Technical and usage data: IP address, approximate location, device and browser information, pages viewed, referral source, session behaviour, error logs, cookie choices, and analytics events where analytics tools are enabled.

We ask that you do not submit unnecessary sensitive personal data through general website forms. If a project requires handling special-category data, confidential user data, or regulated information, this must be addressed separately in the project scope and data-processing arrangements.

We use personal data for the following purposes:

• To respond to enquiries, audit requests, consultation requests, and project discussions.

• To assess whether UtterFocus is a suitable partner for a requested project.

• To prepare proposals, estimates, scopes of work, project plans, and service recommendations.

• To deliver agreed services, including design, development, CMS configuration, automation, integrations, technical support, documentation, and handover.

• To manage client relationships, scheduling, communication, invoicing coordination, and project administration.

• To operate, secure, maintain, and improve the website.

• To understand which content, services, and pages are useful to visitors.

• To send newsletters, insights, or service updates where you have subscribed or where we are otherwise permitted to contact you.

• To comply with legal, tax, accounting, contractual, and record-keeping obligations.

• To protect our rights, prevent misuse, investigate security incidents, and enforce agreements.

Where EU or Finnish data-protection law applies, we rely on one or more of the following legal bases:

• Consent: for newsletter subscriptions, optional analytics or marketing cookies, and other situations where we ask for clear permission.

• Contract: when processing is necessary to take steps before entering into an agreement or to deliver services under an agreement.

• Legitimate interests: for responding to business enquiries, improving the website, securing systems, managing client relationships, keeping business records, and developing services, where those interests are not overridden by your rights and freedoms.

• Legal obligation: where processing is necessary for accounting, tax, compliance, or statutory obligations.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing that happened before withdrawal.

This website may use cookies and similar technologies to provide essential functionality, remember preferences, measure website performance, and understand how visitors use the site. Essential cookies may be used without consent when they are necessary to provide the website or a service requested by the visitor. Non-essential analytics, advertising, or retargeting cookies should only be used after appropriate consent has been given.

For more detail, see the Cookie Policy

We may share personal data with trusted service providers where necessary to operate the website, communicate with visitors, manage projects, deliver services, or meet legal obligations. These may include:

• website hosting and infrastructure providers;

• email, newsletter, and communication providers;

• analytics and consent-management providers;

• CRM, project-management, support, and scheduling tools;

• payment, accounting, invoicing, or bookkeeping providers;

• development, security, backup, and monitoring tools;

• professional advisers where needed, such as legal, accounting, tax, or insurance advisers.

Service providers are expected to process personal data only for the relevant service purpose and under appropriate confidentiality, security, and data-processing terms. We may also disclose information where required by law, court order, regulator request, or to protect legal rights and system security.

Some service providers may process data outside Finland or the European Economic Area. Where this happens and applicable law requires safeguards, we use appropriate transfer mechanisms such as adequacy decisions, standard contractual clauses, provider contractual commitments, or other lawful safeguards.

We keep personal data only as long as necessary for the purpose for which it was collected, unless a longer retention period is required or justified by law, contract, accounting obligations, dispute resolution, or legitimate business needs.

• General enquiries: normally kept for up to 24 months after the last meaningful interaction, unless the enquiry becomes a client relationship.

• Audit, proposal, and discovery records: normally kept for up to 36 months to support follow-up, business records, and service development.

• Client project records: kept for the duration of the relationship and then retained as needed for support, warranty, legal, accounting, and documentation purposes.

• Accounting and invoicing records: retained according to applicable Finnish accounting and tax requirements.

• Newsletter data: retained until you unsubscribe or the mailing list is discontinued, plus a limited record of unsubscribe status to respect your choice.

• Analytics data: retained according to the settings of the analytics tool in use and, where possible, configured to avoid unnecessary personal identification.

Depending on your location and applicable law, you may have the right to:

• request access to the personal data we hold about you;

• request correction of inaccurate or incomplete data;

• request deletion of your personal data;

• request restriction of processing;

• object to processing based on legitimate interests;

• withdraw consent where consent is the legal basis;

• request portability of data you provided to us in a structured, commonly used, machine-readable format;

• lodge a complaint with a data-protection supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. We encourage you to contact us first so we can try to resolve any concern directly.

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include access controls, secure hosting, encrypted connections, administrative safeguards, backups, software updates, security monitoring, and limiting access to people who need the data for legitimate work purposes.

No website or online service can guarantee absolute security. If we become aware of a data incident that requires notification, we will act according to applicable legal obligations.

When UtterFocus builds or supports a client website, CMS, portal, automation, or integration, the client is usually the controller for data collected through that client system. UtterFocus may act as a processor, technical provider, or implementation partner depending on the project. In those cases, roles, responsibilities, access rights, data categories, retention, sub-processors, security expectations, and handover obligations should be defined in the relevant service agreement or data-processing agreement.

This website and UtterFocus services are intended for business, organizational, and professional audiences. We do not knowingly collect personal data from children through this website.

We may update this Privacy Policy to reflect changes in law, services, website functionality, tools, or operating practices. The effective date at the top of this page indicates the latest version.

For privacy questions, data-rights requests, or concerns about how your information is handled, contact:

• Email: hello@utterfocus.com

• Website: utterfocus.com

• Location: Finland

Please include enough information for us to identify the relevant interaction, such as the email address you used, the form submitted, or the project name. We may need to verify your identity before responding to certain requests.