Futuuri Works – privacy policy (futuuriworks.com and futuuriworks.fi)
EU General Data Protection Regulation (EU) 2016/679, Articles 13 and 14. Policy version: 10 November 2026.
1. Controller
Futuuri Works (Samu Metso)
Business ID 3508293-1
Yliopistonkatu 23, 53850 Lappeenranta
Email: yhteys@futuuriworks.fi (contact person Samu Metso)
Websites: futuuriworks.com (English) and futuuriworks.fi (Finnish)
This policy applies to the Futuuri Works websites futuuriworks.com (English) and futuuriworks.fi (Finnish), which process data in the same way. Below, “the website” means either of them. Roast My Page orders are placed on the roastpage.com and roastmypage.fi websites, which have their own privacy policies, for example: roastmypage.fi/tietosuoja.html.
2. Who this policy concerns
- visitors to the futuuriworks.com and futuuriworks.fi websites
- people who write to yhteys@futuuriworks.fi.
3. Personal data processed
The website has no ordering, payments, forms or email address collection, and the website does not process data with AI.
3.1 Technical data: IP address, browser details, the requested address and request times in the request logs of the website platform (Vercel).
3.2 Analytics data (only with consent, section 9): a random visitor identifier stored in a cookie, pages viewed and website events (for example, moving to the roastpage.com or roastmypage.fi website), traffic source, device and browser details, and an approximate location that Google infers from the IP address. The IP address is not stored. No email address, name or other contact details are sent to analytics, neither in plain text nor as a hash.
3.3 Marketing data (only with consent, section 9): advertising cookie identifiers and information on advertising results (for example, whether a visitor who came from an ad moved on to the roastpage.com or roastmypage.fi website).
3.4 Email messages to yhteys@futuuriworks.fi: the sender's name, email address and the content of the message.
4. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Publishing the website, security and abuse prevention (request logs) | Legitimate interest (Art. 6(1)(f)) |
| Remembering the cookie choice | Legitimate interest (Art. 6(1)(f)); strictly necessary storage (Act 917/2014, section 205) |
| Visitor analytics (Google Analytics 4, section 9) | Consent (Art. 6(1)(a); Act 917/2014, section 205) |
| Measuring advertising effectiveness and targeting (marketing, section 9) | Consent (Art. 6(1)(a); Act 917/2014, section 205) |
| Replying to email messages and storing them | Legitimate interest (Art. 6(1)(f)): replying to the message and later verification of the matter |
The data is not used for direct marketing or newsletters.
5. Where the data comes from
From the visitor's browser and the website's technical logs, from the sender of a message themselves, and, for visitors who have given consent, from Google Analytics.
6. Recipients and processors of personal data
| Provider | Task | Data | Location |
|---|---|---|---|
| Vercel Inc. (United States) | Publishing the website, request logs | Section 3.1 | Static pages are served from Vercel's global network. Server-side functions run in Vercel's Stockholm region (arn1, Sweden). |
| Google Analytics (Google Ireland Limited, Ireland; Google LLC, United States) | Visitor analytics and measuring and targeting advertising, only with consent (section 9) | Sections 3.2 and 3.3 | EU and United States |
| Cloudflare, Inc. (United States) | Name servers (DNS) for the futuuriworks.com and futuuriworks.fi domains, and forwarding of email arriving at futuuriworks.fi addresses (Email Routing). Website traffic does not pass through Cloudflare's proxy servers. | Incoming emails (in transit), DNS queries | Global network |
| Google LLC (Gmail) | Receiving mailbox where messages are read and replied to | Section 3.4 | United States and Google's other locations |
| Authorities | Data is disclosed to authorities only on the basis of law. | Case by case | Finland |
The data is not sold or disclosed for marketing. futuuriworks.com and futuuriworks.fi use the same Google Analytics property, and the Roast My Page websites have their own separate property. The visitor identifier is not transferred from one website to another, and the cookie choice is made separately on each futuuriworks website.
7. Transfers outside the EU and EEA
All providers are US companies or their subsidiaries, so data may be transferred to or accessed from the United States. The transfers are based on the EU–US Data Privacy Framework (Commission decision of 10 July 2023), under which the recipients are certified: Vercel Inc., Cloudflare, Inc. and Google LLC (Gmail and Google Analytics). The certifications were checked on the dataprivacyframework.gov website on 25 October 2026. In addition, the providers' data processing terms include the European Commission's standard contractual clauses (2021/914).
8. Retention periods
| Data | Retention period |
|---|---|
| Request logs (Vercel) | Up to 30 days |
| Google Analytics data (sections 3.2 and 3.3) | 14 months, after which Google deletes the user- and event-level data |
| Analytics cookies _ga and _ga_<id> (in the visitor's browser) | Up to 2 years; deleted when consent is withdrawn via the Cookie settings link, and the visitor can delete them in the browser settings at any time |
| Marketing cookies, for example _gcl_au (in the visitor's browser) | Up to 90 days; deleted when marketing consent is withdrawn via the Cookie settings link |
| Cookie choice fw_suostumus (in the visitor's browser) | 12 months from the choice |
| Email messages (3.4) | 3 years from the message |
9. Cookies and browser storage
This section describes the current situation of the website. If the use of cookies or tracking changes, the policy will be updated, and consent will be requested for new non-essential cookies before they are used.
The website uses strictly necessary browser storage, without which the website does not work, and analytics and marketing cookies only with the visitor's consent. The choice is made in the cookie banner on the first visit, and analytics and marketing can be allowed independently of each other. Accepting and rejecting are equally easy, and analytics and marketing are not preselected. When the banner's categories change, the earlier choice is asked again.
| Name | Type | Purpose | Duration | Basis |
|---|---|---|---|---|
| fw_suostumus | Browser storage (localStorage) | Remembers the visitor's cookie choice (analytics and marketing allowed or not), the time of the choice and the banner version | 12 months, after which the choice is asked again | Strictly necessary |
| fw_oma | Browser storage (localStorage) | The site administrator's own browser is marked so that the administrator's visits do not show up in analytics. Set only through the administrator's separate link, not for ordinary visitors. | Until the marking is removed | Strictly necessary |
| _ga | Cookie (Google Analytics 4) | Distinguishes visitors from each other with a random identifier | Up to 2 years in the browser | Consent |
| _ga_<id> | Cookie (Google Analytics 4) | Stores the session state | Up to 2 years in the browser | Consent |
| _gcl_au and other cookies starting with _gcl | Cookie (Google, marketing) | Measuring advertising results. Set only with marketing consent | Up to 90 days in the browser | Consent (marketing) |
Strictly necessary storage. The cookie choice (fw_suostumus) is stored only in the visitor's browser, and it is not sent to the website or to Google. It does not require consent.
Analytics (Google Analytics 4, only with consent). If the visitor allows analytics in the cookie banner, the website uses Google Analytics 4 visitor analytics, provided by Google Ireland Limited (Ireland). The measurement ID is G-GJPYV1F186, and it is different from the one on the roastmypage.fi website. Before consent, Google's analytics tag is not loaded, no analytics cookies are set and no data is sent to Google (Google Consent Mode v2, basic mode). If the visitor rejects analytics, the tag is not loaded at all. Analytics is used to follow the use of the website at an aggregate level. What is measured:
- page views, also when the page address changes without a new load
- scrolling to the end of the page
- clicks on links and calls to action leading to the roastpage.com and roastmypage.fi websites (button text, position on the page and destination address) and other moves to other websites (the destination website's address without the query part)
- file downloads, internal site search, video views and form use, if the website has them (currently it does not)
- opening the cookie settings, as well as the traffic source and campaign identifiers.
Identifiers of personal links and query parameters are removed from the page and referrer addresses sent to analytics; only campaign identifiers (utm parameters) are left in the address. The same applies to automatically measured events: identifiers and the query part are removed from the destination addresses of links, file names and forms, and email addresses are filtered out of event data before sending. Google signals are in use only if the visitor has allowed marketing. In that case Google may link analytics data to the Google accounts of visitors who are signed in to Google and have allowed ad personalisation in their Google account settings. The data is used for cross-device aggregate reports and ad targeting, and no individual visitor is identified in the reports.
The browser may shorten the validity of cookies. According to Google, Google Analytics 4 does not log or store IP addresses. Google Analytics retains user- and event-level data for 14 months, after which Google deletes it (section 8). Google Ireland Limited may also process data in Google LLC's systems in the United States. The transfer to the United States is based on the EU–US Data Privacy Framework, under which Google LLC is certified (section 7).
Marketing (only with consent). If the visitor allows marketing in the cookie banner, the website allows Google advertising cookies and advertising measurement (Google Consent Mode v2: ad_storage, ad_user_data and ad_personalization). The purpose is to measure advertising effectiveness and to target advertising. Marketing alone does not load Google's tag: the tag is loaded only if analytics is also allowed. Without marketing consent, no advertising cookies are set and no advertising data is sent. Google signals are in use only if the visitor has allowed marketing. In that case Google may link analytics data to the Google accounts of visitors who are signed in to Google and have allowed ad personalisation in their Google account settings. The data is used for cross-device aggregate reports and ad targeting, and no individual visitor is identified in the reports.
Links to the Roast My Page websites. The links from the futuuriworks.com website to the roastpage.com website, and from the futuuriworks.fi website to the roastmypage.fi website, carry campaign identifiers (utm_source=futuuriworks, utm_medium=referral and the link's position), from which roastmypage.fi can see that the visitor came from the futuuriworks.fi website. The identifiers contain no personal data. roastmypage.fi asks for its own cookie consent, and its processing is described in its own privacy policy (roastmypage.fi/tietosuoja.html).
The legal basis for analytics and marketing is consent (Act 917/2014, section 205, and Article 6(1)(a) of the General Data Protection Regulation). Refusing analytics or marketing does not affect the use of the website. Consent can be withdrawn at any time from the Cookie settings link at the bottom of the page, separately for analytics and marketing. When analytics consent is withdrawn, the website stops analytics, deletes the analytics cookies _ga and _ga_<id> from the browser and reloads the page. When marketing consent is withdrawn, the website stops advertising measurement, deletes cookies starting with _gcl and reloads the page. Cookies can also be deleted in the browser settings. Withdrawal does not affect the lawfulness of processing carried out before it.
The website's fonts and images are loaded from the website's own address (futuuriworks.com or futuuriworks.fi), not from third parties (no Google Fonts).
10. Automated decision-making
The processing does not involve automated decision-making or profiling within the meaning of Article 22 of the General Data Protection Regulation.
11. Security
Traffic is encrypted (HTTPS). The website's source files are not shared with the browser. Access to the systems is limited to the controller.
12. Rights of the data subject
The data subject has the right to
- access their own data (Art. 15)
- demand the rectification of inaccurate data (Art. 16)
- demand the erasure of data (Art. 17)
- demand the restriction of processing (Art. 18)
- transfer the data they have provided from one system to another when the processing is based on consent (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw their consent at any time when the processing is based on consent (analytics and marketing, section 9; Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before it.
Requests: send a message to yhteys@futuuriworks.fi. Identity is verified when necessary, for example by replying from the same email address from which an earlier message was sent. Analytics data is linked only to the browser's random identifier, so the controller cannot connect it to a named person unless the visitor themselves provides their browser's identifier (Art. 11). Requests are answered within one month; the time may be extended by two months if the request is complex.
13. Right to lodge a complaint
The data subject has the right to lodge a complaint with the supervisory authority if they consider that the processing of personal data infringes the General Data Protection Regulation: Office of the Data Protection Ombudsman, PL 800, 00531 Helsinki, tietosuoja.fi.
14. Changes
The policy is updated when the processing changes. Current version: futuuriworks.com/privacy.html (in Finnish futuuriworks.fi/tietosuoja.html). Policy concerning Roast My Page orders: roastmypage.fi/tietosuoja.html.
Futuuri Works · Business ID 3508293-1 · Yliopistonkatu 23, 53850 Lappeenranta · yhteys@futuuriworks.fi · futuuriworks.com