Yasa

Privacy policy

How Yasa uses your information, the choices you have, and how to contact us about your privacy.

Last updated: 21 October 2026. This shared notice covers Yasa Oy, yasa.fi, Yasa Account at account.yasa.fi, Nexus hosting, Hercules and Midas, including their public websites, accounts and applications. SkillJobber is coming soon: we do not describe its planned functions as active processing. Before launching a new service or materially changing how information is used, we will update this notice and provide any additional notice or choice required. A customer’s own privacy notice still applies to processing that customer controls.

On this page

Who is responsible for your information?

Yasa Oy / Yasa Ltd.
Business ID: 3381986-4 · VAT ID: FI33819864
Fredrikinkatu 61, 00100 Helsinki, Finland
Privacy questions and requests: [email protected].

Yasa is the controller for the processing described here. For website, hosting or other work carried out for a customer, that customer may be the controller and Yasa its processor. Requests about information held on behalf of a customer should be directed to that customer; we assist under the applicable service agreement.

What we collect and why

  • Enquiries and support. Your name, email address, company, website, message and any details you choose to provide help us answer questions, prepare an offer and investigate a reported issue. The basis is steps requested before a contract, performance of a contract with you, or our legitimate interest in communicating with business contacts and providing support.
  • Meetings. We use your booking details, contact information and appointment time to arrange the meeting and send related messages. This supports your request for a consultation or our contract. Enabling an optional Google embed is a separate choice from booking a meeting.
  • Customer and billing records. Contact and business details, agreed work, project correspondence, invoices, payment references and transaction information support delivery, invoicing and accounting. We rely on contract, legal obligations and legitimate interests in administering business relationships and handling legal claims.
  • Website and security information. Servers and security providers process IP addresses, request times, requested pages, browser/device details and error or abuse information to deliver and protect the website. Our legitimate interests are service availability, fraud prevention and investigating faults; necessary device storage is used only for the relevant requested or security function.
  • Analytics and advertising. Google services can process cookie or device identifiers, page visits, interactions, referral information, approximate location and advertising events for audience measurement, reporting and advertising. Optional tracking and personalised advertising depend on consent where required and applicable opt-out rights. See Cookies & Google.
  • Account access. Where you choose Google sign-in, we receive the account identifier and the name, email address and profile information authorised by the sign-in flow to authenticate and administer your account. We do not receive your Google password. Yasa, Nexus, Hercules and Midas use Yasa Account for shared sign-in, personal information and regional preferences. App sessions are bound to the central account session; workspace permissions remain separate. Nexus separately requires an invitation and authorised resource access. An account in one service does not grant access to another organisation’s records.

We normally receive information from you, your browser or the services you choose to use. Business contact information may also come from your employer, a colleague acting for your organisation, a referral or public business sources. Where required, we tell you the source and provide this notice when first contacting you or within one month.

Fields marked as required are needed to handle that request. If you leave them out, we may be unable to respond, arrange a meeting or provide the service. Optional details are your choice. Please do not send passwords, payment-card details or sensitive personal information through enquiry forms. Sending an enquiry does not subscribe you to a newsletter or give consent to advertising.

Accounts, hosting and application records

For account administration we process names, email addresses, account identifiers, password hashes where email/password sign-in is used, verification and recovery records, memberships, invitations and preferences. We rely on our contract with the account holder or our legitimate interest in administering an organisation’s service and controlling access. Workspace members can see only information their roles allow.

  • Nexus — hosting. Invited users, roles, assigned resources, hosting settings, files and operational records enable hosting and infrastructure management. Website visitors, WordPress users and game players are separate from Nexus panel accounts. The customer controls its hosted content and its notices to those users.
  • Hercules — collaboration. Projects, tasks, comments, assignments, estimates, schedules, notifications and saved views are supplied by users and their collaborators to organise their work.
  • Midas — billing. Company and customer information, products, invoices, payment records, attachments, billing history and reports support the workspace’s business records. An authorised user can add selected Hercules work to a Midas invoice draft. This does not automatically send an invoice or grant access to another workspace.
  • SkillJobber — coming soon. It is part of the planned Yasa ecosystem. Its launch notice will describe actual functions, data and purposes before the service begins collecting information.

For organisation-controlled workspace and hosted data, Yasa normally acts as processor under the organisation’s documented instructions and applicable data-processing terms. The organisation determines its lawful basis, notices and retention needs. Yasa is controller for its own accounts, security, support and customer relationships. We do not use private account or workspace content for advertising or sell that content.

Google sign-in requests the openid, email and profile scopes. It does not request access to Gmail, Drive, contacts or Calendar. Google handles your Google password. You can review or revoke the connection in your Google Account; revocation does not itself erase Yasa records. Optional Calendar bookings are a separate service from account sign-in.

Who receives information

  • Hosting and delivery: Yasa’s Nexus infrastructure on Hetzner and Cloudflare provide hosting, network delivery, DNS and website protection. Cloudflare Turnstile may process browser and interaction signals to distinguish legitimate visitors from abuse.
  • Google: Google Analytics measures website use; Google’s advertising services, including AdSense, support advertising and related measurement. Google Calendar and Meet support bookings and meetings, and Google sign-in supports account access where offered. Their purposes and your choices are explained below.
  • Customer work and administration: authorised Yasa personnel, relevant project collaborators, email providers, accounting advisers, banks and payment service providers receive the information needed for their role. Yasa uses Hercules for project work and Midas for billing records.
  • Legal disclosures: information may be supplied to competent authorities where required by law, or to professional advisers where necessary to establish, exercise or defend legal claims.

Service providers may act on our instructions or, for their own legally defined purposes, as independent controllers. A link to an external site does not itself transfer the information you enter in our forms; following the link places you under that provider’s own notice.

Cookies, Google services and your choices

Scope matters. The analytics and advertising description below concerns the yasa.fi company website. The Nexus, Hercules and Midas apps and their public pages currently use necessary service storage and interface preferences, without advertising cookies or third-party marketing analytics. Sharing this policy does not share consent between domains or enable tracking in an app. Any optional tracking introduced later needs the appropriate prior choice and an updated notice.

Application storage. Necessary host-only cookies protect central sign-in, request state and the bound application sessions. Hercules also has a native application session bound to the same central session. Account and application access expire no later than eight hours after sign-in. Signing out of Yasa revokes the current browser session across the connected services; signing out all devices is a separate Account security action. Browser storage may retain language, display preferences and saved-view choices. Blocking necessary storage can prevent sign-in or those requested features. Our public contact forms use a short-lived request-protection cookie. Their operational submission copy is retained for seven days; support correspondence in the receiving mailbox is kept according to the enquiry and legal-claims purposes below.

Cookies and similar storage can keep you signed in, remember choices, protect forms, measure visits or support advertising. Necessary functions are distinct from optional analytics and advertising. Consent to optional tracking is not a condition of making an enquiry, and continuing to browse does not by itself give consent.

  • Necessary and requested functions: WordPress authentication/session cookies for signed-in users, security checks, and storage needed to remember your privacy choice or a language preference you request. These are not permission to use information for advertising.
  • Analytics: Google Analytics 4 uses identifiers and event information to report how visitors find and use the site. Google Analytics cookies commonly include _ga and _ga_*; their default lifetime is up to two years unless shortened. Cookie expiry and Analytics data-retention settings are different controls.
  • Advertising: Google and advertising partners can use cookies, device identifiers and visits to this and other sites to select, deliver and measure ads. Personalised advertising uses information about your interests or previous activity. Advertising disclosures may count as “sale”, “sharing” or targeted advertising under some US state laws.
  • Booking: choosing “Load Google calendar” connects your browser to Google and enables the calendar inside this page. Google can receive your IP address, browser details and existing Google cookies, and may link activity to your Google account. You can remove the embed using its privacy control or arrange a meeting by email instead.

Use the consent choices presented for optional services to accept, refuse or change your preferences. Where consent is required, it must be obtained before the relevant optional storage or processing. Withdrawal applies going forward and does not undo processing that was lawful beforehand. You can also remove stored cookies in your browser; doing so may sign you out or reset preferences. Removing our calendar embed cannot delete cookies on Google’s domain or cancel a booking already made.

Google explains its processing in Google’s Privacy Policy and How Google uses information from sites and apps that use its services. Further controls are available through My Ad Center and the Google Analytics opt-out browser add-on. These controls have different scopes and do not replace your rights against Yasa.

Some Google measurement uses limited signals without storing analytics or advertising cookies. Depending on the consent configuration, refusing cookie storage does not necessarily prevent every connection or measurement signal from reaching Google. Any such processing still needs an applicable legal basis. We do not send enquiry text, names or email addresses as Analytics event data.

The older “Do Not Track” browser setting is not a uniform consent mechanism. Where applicable law recognises Global Privacy Control or another opt-out preference signal, it gives you a way to object to covered sale, sharing or targeted advertising. It does not request deletion of customer or accounting records. You may also send a privacy-choice request to [email protected].

Privacy requests are submitted in Yasa Account using the central sign-in session and request-protection checks. There is no separate privacy-form sign-in session. These necessary cookies verify access and protect the form; they are not used for advertising. Signing out of Yasa also ends authenticated access to the privacy request form, without signing you out of Google.

Where information is processed

Our hosting is on Yasa’s Hetzner infrastructure. Network, email and Google services can involve processing outside Finland and the EEA, including in the United States. We do not promise that all information stays in Finland or the EU.

A restricted international transfer needs a valid legal mechanism, such as an applicable adequacy decision or approved contractual safeguards with any necessary additional protections. US adequacy arrangements apply only to eligible, certified recipients and covered data; they are not a blanket exemption for US services. UK transfers require the corresponding UK mechanism where UK law applies. You can ask us which recipients and safeguards apply to your information and request a copy of the relevant safeguards, subject to necessary redactions.

See Google’s transfer safeguards, Cloudflare’s privacy information and Hetzner’s privacy information for their published arrangements.

How long information is kept

  • Enquiries and meeting correspondence: the relevant criteria are whether the enquiry is still open, whether it leads to customer work, and whether the correspondence is needed for a dispute or legal obligation. There is no single automatic expiry that applies to all correspondence.
  • Customer and project records: retention depends on the service relationship, continuing support, contractual obligations and the need to document or defend work. Closing an account or archiving a project does not automatically erase shared records.
  • Accounting: under Finnish accounting law, financial statements, ledgers and specified accounting records generally have a minimum retention of ten years from the end of the financial year. Vouchers, transaction correspondence and other accounting material generally have a minimum of six years from the end of the calendar year in which that financial year ended. Other legal duties may require longer periods.
  • Business archives and backups: Midas currently retains business records and revision history without automatic expiry. Cancellation and archiving preserve those records. This does not remove your right to request erasure or restriction, or create a legal basis to retain all personal information indefinitely; requests require assessment against the records and legal obligations involved.
  • Technical and optional-service records: security logs, consent records, authentication data and analytics identifiers have different lifecycles according to their function and provider settings. A browser cookie’s expiry does not establish how long every server-side record is retained. Ask us for the retention details relevant to your request.

Your rights and how to use them

Under the GDPR and applicable UK data-protection law, you can request access, correction, erasure, restriction and, where the conditions are met, a portable copy of your information. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent without affecting earlier lawful processing. Exceptions can apply, including duties to keep accounting records or protect other people’s rights.

Email [email protected] or write to our postal address. Tell us what you want us to do and which service or relationship is involved. We may request proportionate information to verify identity or an authorised representative’s authority. Do not send an identity document unless we explain why it is needed and how to provide it securely.

GDPR rights requests normally receive a response within one month. Where a lawful extension is necessary, we explain the reason and timing within that first month. Requests are normally free. If we cannot fulfil a request, we explain the reason and the available complaint route.

This website does not make solely automated decisions producing legal or similarly significant effects about you. Analytics and personalised advertising can involve profiling for measurement or ad selection; that is separate from deciding whether to provide professional services.

Request removal of your personal data

You can request deletion or another data-protection action by emailing [email protected] or using the account-verified request form where it is offered. The online form requires your Yasa ecosystem account using Google or email and password. We will verify the request and explain what can be removed, restricted or retained under a legal obligation. Sending the form does not automatically delete an account, invoice or shared project.

When you use the online form, we attach your verified Yasa account ID and email to the request. We use these and your request details to identify and handle your request and meet our data-protection obligations. We may ask for proportionate verification through a secure channel. Do not upload or paste identity documents, passwords, payment-card details or other people’s sensitive information.

You can also email [email protected]. We normally respond to GDPR requests within one month; if a lawful extension applies, we explain why within that first month. We retain the request and verification outcome only as needed to resolve it and document our response to a legal obligation or claim.

Privacy complaints

Send a complaint to [email protected], explaining what happened and the outcome you seek. We acknowledge privacy complaints within 30 days, investigate the relevant facts and communicate our outcome without undue delay. This complaint route does not replace or extend the deadlines for a separate data-rights request.

You can complain to Finland’s Office of the Data Protection Ombudsman or the competent authority where you live or work. For UK matters, you can contact the Information Commissioner’s Office. You do not have to obtain our permission to contact a regulator.

Additional information for US residents

US privacy rights depend on your state, the processing involved and whether the law covers the business. Where applicable, these may include access, correction, deletion, portability, information about disclosures, and opting out of sale, sharing, targeted advertising or certain profiling. Some laws also let you limit certain uses or disclosures of sensitive information, use an authorised agent, or appeal a refused request. We do not discriminate against you for exercising a protected privacy right.

The information categories and recipient categories are listed above. Google advertising can involve cross-site collection by Google and its partners; such disclosures can qualify as sale or sharing even when no money is paid for the data. Use the advertising choices presented to you, a recognised opt-out signal where supported by applicable law, or email us a US privacy request. Identify your state so we can apply the relevant rules.

For a covered US request, we respond within the applicable statutory period, commonly 45 days, with notice of any permitted extension. If we refuse a request, you can reply asking for a review or statutory appeal where available. We explain the outcome and the relevant regulator route. California residents can read more about CCPA/CPRA rights; statutory coverage and exceptions still apply.

Security, children and policy updates

We use access controls, HTTPS and operational safeguards appropriate to the service. No website, email or storage system can guarantee absolute security. Where a personal-data breach triggers a legal notification duty, we notify the relevant authority and affected people as required.

Our professional website and enquiry services are intended for adults and business users, not directed to children under 13. If a child has supplied information that should not have been collected, contact us so we can assess and remove it where required. Local rules may protect older children too; this statement does not replace any parental-consent obligation that applies.

We update this notice when our services or processing change and show the revision date above. Where a change requires a new notice or fresh consent, we provide it before using information for that new purpose.

Banking and payment information

These are Yasa’s payment details, not a request to provide your bank credentials. Use the reference and instructions on your invoice.

Beneficiary: Yasa Oy
Bank: OP Financial Group
IBAN: FI22 5788 0020 0999 71
BIC / SWIFT: OKOYFIHH