Privacy on this site and when contacting us

This page explains what personal data & Two Words handles when you use this website, send us a message or book a meeting through Cal.com.

The basic idea is simple: we collect only what is actually needed to run the site and communicate with you. We do not sell your information, build advertising profiles about you or collect data just in case it might become useful one day.

Please do not use the forms to send sensitive personal data, passwords or unnecessary trade secrets.

Controller

& Two Words Oy
Business ID 3457862-8
VAT ID FI34578628
Email: hello@twowords.fi

Questions about this page and requests concerning your personal data can be sent to the same address: hello@twowords.fi.

No separate data protection officer has been appointed. Privacy questions and requests are handled through the email address above.

Technical use of the site

When you use the site, its hosting and deployment provider, Netlify, processes technical information needed to deliver the pages and maintain the security and reliability of the service.

This information may include:

• your IP address
• browser and device information
• the page requested
• the time of the request
• technical and security log information

We do not use this information to identify or profile individual visitors. It may be reviewed when investigating a technical problem, misuse or a security incident.

The processing is based on our legitimate interest in maintaining a secure, reliable and functional website under Article 6(1)(f) of the GDPR.

Technical log data is retained according to Netlify’s service settings and retention practices, and only for as long as it is needed to operate and secure the site or investigate possible incidents.

Contacting us

When you contact us through the website form or by email, we process the information you choose to provide. This may include:

• your name
• your email address
• your company or organisation, if provided
• the content of your message

Contacting us is voluntary, but without contact details and a message we may not be able to reply or look into the matter.

The website form uses Netlify Forms. Messages submitted through the form are stored in Netlify’s form service and passed on to us from there. The form also contains a hidden field used to identify automated spam. An ordinary visitor leaves it empty, and it is not intended for collecting personal data.

We use the information to:

• respond to your message
• assess the matter or a possible engagement
• arrange a follow-up conversation
• prepare a proposal or service you have requested

Depending on the situation, processing is based either on taking steps at your request before entering into a contract under Article 6(1)(b) of the GDPR or on our legitimate interest in responding to enquiries addressed to us under Article 6(1)(f).

Cal.com booking

When you book a meeting, we process the information needed to arrange it. This will normally include:

• your name
• your email address
• your time zone
• the time you selected
• your answer to “What would you like to discuss?”

Cal.com provides the technical booking service. If the meeting is held through Cal Video, the meeting link is provided using Daily.co, a service used by Cal.com.

The booking page loads Cal.com’s booking interface as an embed from cal.eu. This means that simply opening the booking page establishes a connection to Cal.com and may pass it ordinary technical information such as your IP address and browser and device information.

If the embed does not load, the page provides a link to open the same booking page separately. The information is processed through Cal.com in that case as well.

Booking information is used to arrange, confirm, conduct and, where necessary, reschedule or cancel the meeting. Processing is based on taking steps at your request before entering into a contract or on performing a contract with you under Article 6(1)(b) of the GDPR.

Cal.eu states that information handled through its scheduling service is stored and processed within the European Union. Cal.com’s own privacy policy provides further information about technical data, cookies and subprocessors used by its service.

Analytics

The site uses Plausible Analytics to understand how the site is used.

Plausible produces aggregate statistics such as:

• page views
• pages visited
• referring websites
• approximate country-level location
• device and browser type

Plausible does not set analytics cookies, store visitor IP addresses or create cross-site profiles of individual visitors. The statistics are used to understand the site as a whole, not to follow individual people around.

The processing is based on our legitimate interest in understanding the use of the site and improving its content and functionality under Article 6(1)(f) of the GDPR.

Aggregate statistics produced by Plausible may be retained for as long as they remain useful for developing the site. They cannot normally be linked to an identified individual visitor.

Cookies and browser storage

The & Two Words website does not itself set cookies.

One value, twowords-theme, is stored in your browser’s local storage if you switch between the site’s light and dark themes.

The value remembers your choice for your next visit. It remains in your browser and is not sent to us or to another server. You can remove it by clearing the site data in your browser settings.

The Cal.com booking interface is a third-party embed and may set its own cookies on the booking page. Cal.com is responsible for those cookies and their use under its own privacy policy.

Retention

Enquiries and booking information are retained for as long as they are needed to deal with the enquiry, arrange the meeting or assess possible work together.

If the enquiry does not lead to a client relationship, the information is deleted or unnecessary personal data is removed within a reasonable period after the matter has ended. This will normally be no later than 12 months after the latest contact, unless there is a specific reason to retain it for longer, such as investigating a dispute or establishing, exercising or defending a legal claim.

If the enquiry develops into a client relationship, the necessary information becomes part of the client and engagement records. It is then retained for as long as needed to perform the agreement and meet applicable accounting, tax and other legal obligations.

Information may be retained for longer where this is necessary to establish, exercise or defend a legal claim.

Service providers and recipients

The site uses the following external service providers:

Netlify
Website hosting, technical infrastructure, logs and contact form submissions.

Cal.com
Scheduling, booking notifications and meeting links.

Daily.co
The technical video connection used for Cal Video meetings.

Plausible Analytics
Aggregate, cookieless website analytics.

These service providers may use their own subprocessors to provide their services.

Personal data may also be processed through the email, calendar and other work tools used by & Two Words where this is necessary to reply to your message, arrange a meeting or manage a client relationship.

The information is not sold or disclosed to third parties for their own direct marketing.

Transfers outside the European Economic Area

Plausible states that it processes and stores the site’s analytics data within the European Union. Cal.eu states that information handled through its scheduling service is stored and processed within the European Union.

Netlify is a service provider based in the United States, and it or its subprocessors may process some information outside the European Economic Area. Under Netlify’s Data Processing Agreement, these transfers are primarily based on the EU–US Data Privacy Framework and, where necessary, the European Commission’s standard contractual clauses.

The use of other work tools, integrations or service providers may also result in information being processed outside the European Economic Area in some situations.

Where personal data is transferred outside the European Economic Area, an appropriate transfer mechanism under applicable data protection law is used, together with supplementary safeguards where required.

Where the information comes from

We receive personal data mainly directly from you when you:

• submit the contact form
• book a meeting
• send us an email
• continue a conversation or become a client

Technical information about the use of the site is generated automatically when you visit it.

Automated decision-making

We do not use the personal data described on this page for automated decision-making or profiling.

Your rights

Depending on the situation and the legal basis for processing, you have the right to:

• know whether we process personal data concerning you
• request access to your personal data
• request correction of inaccurate or incomplete information
• request erasure of your information
• request restriction of processing
• object to processing based on legitimate interests
• receive certain information you have provided in a machine-readable format and transmit it to another controller where processing is automated and based on consent or a contract

These rights are not absolute in every situation. For example, a legal retention obligation or the handling of a legal claim may prevent immediate erasure.

Requests can be sent to hello@twowords.fi. We may ask for additional information where reasonably necessary to verify your identity.

If you believe that your personal data has not been handled properly, you have the right to lodge a complaint with a supervisory authority. The supervisory authority in Finland is the Office of the Data Protection Ombudsman: tietosuoja.fi.

We hope you will contact us first, so we can look into the matter and put it right if something has gone wrong.

Changes to this page

We update this page if the operation of the site, the services we use or our processing of personal data changes materially.

Updated 27 July 2026.