Privacy policy

Last updated: 16 October 2026.

This policy explains what personal data Argnode Oy ("Argnode", "we", "us") processes, on what legal basis, who we share it with, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and Finnish data-protection law. It describes how things stand on the date above and is updated as our services change.

Who we are (data controller)

Argnode Oy is the data controller for the personal data described in this policy.

• Company: Argnode Oy (business ID 2884224-2)
• Postal address: Satotie 4 as. 7, 43100 Saarijärvi, Finland
• Data-protection contact: legal@argnode.com

We have not appointed a statutory Data Protection Officer, as we are not required to. Data-protection questions go to the address above.

What we collect and why

We keep data collection to a minimum. We only process personal data where we have a lawful basis to do so.

Website visitors

The site is served from our own servers in the EU and fronted by Cloudflare, our content-delivery network, which processes limited technical data (such as your IP address and browser type) to deliver the site securely and defend against abuse.

• Data: IP address, browser and device information, pages requested, timestamps.
• Purpose: deliver the website, keep it secure, diagnose faults.
• Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in running a secure website.

On your first visit, a cookie banner asks what you allow. Until you choose, and if you reject, the site uses only strictly necessary cookies, and Google Analytics runs in Consent Mode with all storage denied.

Statistics (with your consent). If you allow statistics, we use Google Analytics, loaded through Google Tag Manager, to count visits and see which pages are used.

• Data: a random browser ID stored in a cookie, pages viewed, the address you came from, approximate location derived from your IP address, browser and device type, timestamps.
• Purpose: understand how the site is used and fix what does not work.
• Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time from Cookie settings at the bottom of every page.

Marketing (with your consent). If you allow marketing, we use the same data to see which of our ads bring visitors and to show relevant ads, and Google may use your visit for its advertising services.

• Purpose: measure and target our advertising.
• Legal basis: your consent (Art. 6(1)(a)).

The cookie policy lists every cookie, who sets it and how long it lasts.

Customers who arrive through our portal or a personal link

Each person in our customer register has a marketing ID: a random code that contains no name or email address. It reaches this site when you sign in to our customer portal or open a personal link we sent you.

• Data: your marketing ID, and the marketing permissions you give: analytics, advertising, data sharing and personalisation. With each choice we store the time, the version of the banner text you saw and the page you were on.
• Purpose: link your visits and sessions together in Google Analytics, also across devices; respect your choices on all your devices; show that we asked for your consent.
• Legal basis: your consent (Art. 6(1)(a)) for the use of the ID in analytics and marketing. Storing the record of your choice is our legal obligation to be able to show consent (Art. 7(1) and Art. 6(1)(c)).

The ID is stored in a cookie and sent to Google Analytics only if you allow statistics or marketing. Banner choices you make on such a visit are saved to your customer record. In the banner, allowing statistics allows all analytics uses and allowing marketing allows all digital marketing uses except email. For more detailed choices, sign in to the customer portal or contact us. Email marketing is a separate permission that the banner never changes.

People who contact us

You can reach us through the contact form or by email.

The contact form. The form asks for your name, email address, organisation and message. Your phone number, role, the website you want us to work on, your marketing spend, when you would like to start and how you found us are optional. We process what you send only if you tick the box that gives us permission to do so.

• Data: what you write in the form; the time and the page you sent it from; the network your request came from, shortened so that it does not point to one device; and a random browser key (below).
• Purpose: to answer you and to take steps at your request before a contract; to stop spam and misuse of the form.
• Legal basis: your consent (Art. 6(1)(a)), given with the permission box, for handling your message. Our legitimate interest (Art. 6(1)(f)) in keeping the form free of spam and misuse, for the shortened network, the browser key and the block list.

How the form handles your data:

• Email check. When you leave the email field, the page asks our server whether the domain of your address (the part after @) can receive email. Only the domain is sent, never the whole address.
• Organisation lookup. When you leave the organisation field, our server looks up what you typed in the Finnish Trade Register (YTJ, Finnish Patent and Registration Office) and in the global LEI index (GLEIF), and offers you the closest matches. Our server makes the query, so the registers do not see your IP address. If you confirm a match, we store its business ID or LEI with your message.
• Confirmation email. We send one email to the address you gave, to confirm that we got your message. The same address gets at most two such emails in an hour and five in a day.
• Review. A person at Argnode reviews every new contact before it enters our customer register. We delete messages that are spam. To stop a sender, we can block an email address (stored only as a keyed hash, never in readable form), an email domain, or a browser key.
• Browser key. When you send the form, the page stores a random key in the ack_form_key cookie. It lets us see that messages from one browser belong together, and stop misuse. It does not identify you, and it is never sent to Google Analytics or an advertising service. If you allow statistics or marketing in the cookie banner, and we have accepted your contact, the key is exchanged once for your marketing ID (see the section above) and then deleted.
• Briefings. If you tick the briefing box, we store your request with the words you saw and the time. We send you briefings only after you confirm the subscription from an email we send to your address. You can unsubscribe at any time.
• Analytics. If you allow statistics, Google Analytics counts that the form was seen, started and sent, which fields gave an error, and the choices you made in the optional lists. It never receives your name, email address, phone number, organisation or message.

Email. When you email us, we process the information you choose to share.

• Data: your name, email address, the content of your message, and any details you include.
• Purpose: to answer you, and to take steps at your request before entering into a contract.
• Legal basis: our legitimate interest (Art. 6(1)(f)) in responding to enquiries, and steps taken prior to a contract at your request (Art. 6(1)(b)).

Email to us is pre-processed by an automated system that classifies each message and either routes it to the right person or replies directly using AI. The system runs on our own EU-based infrastructure, and it does not make decisions with legal or similarly significant effects about you. Substantive matters are always handled by a human, and a person answers every contact form message.

Job applicants

If you apply to work with us, we process your application to run the recruitment process.

• Data: your application, CV, and the information you choose to share, plus our notes and correspondence with you.
• Purpose: to assess your application and communicate with you about it.
• Legal basis: steps taken prior to a contract at your request (Art. 6(1)(b)) and our legitimate interest (Art. 6(1)(f)) in recruiting.

Clients and prospective clients

When you engage us, or we prepare a proposal for you, we process the data needed to deliver and administer the service.

• Data: contact and company details, billing and payment information, correspondence, contract and project records.
• Purpose: to provide our services, manage the relationship, invoice, and meet our legal obligations.
• Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation such as accounting law (Art. 6(1)(c)).

Data we process on behalf of clients

When we run SEO, advertising, analytics, or automation work, we are given access to systems that may hold personal data belonging to a client and their customers (for example Google Analytics, Search Console, or Google Ads accounts). For that data the client is the controller and Argnode is the processor. We process it only on the client's documented instructions, under a data processing agreement (DPA), with least-privilege, read-only access wherever possible. This policy does not govern how our clients handle their own end-users' data.

AI tools we use

To speed up work that would otherwise be slow or unreliable to do by hand (for example parsing campaign data, tracking configurations, or keyword data), we use third-party AI tools, including Anthropic's Claude. We do not send personal data to these tools. Where information could otherwise identify a person, it is anonymised before it is processed: a name is replaced with a role or a non-identifying label, using a mapping we hold ourselves and the AI provider never has access to. Where personal data does need AI processing, for example classifying incoming email, that runs on hardware we control, not a third-party AI vendor. This applies to our own work and to work we do on behalf of clients.

Cookies

This website uses strictly necessary cookies, and statistics and marketing cookies only with your consent. You can change or withdraw your choice at any time from Cookie settings at the bottom of every page. The cookie policy lists every cookie, who sets it, why and how long it lasts.

Who we share data with

We do not sell your personal data. We share it only where necessary, with:

• Service providers (processors) who help us operate. Our main providers are Cloudflare (content delivery and DNS), Proton (Proton AG, Switzerland; end-to-end encrypted email, calendar, and video meetings), and payment processing (for example Stripe for card payments). They act on our instructions under a contract.
• Google (Google Ireland Limited), for Google Analytics and Google Tag Manager, only if you allow statistics or marketing. For Google Analytics, Google acts as our processor. If you allow marketing, Google may also use the data for its own advertising services as an independent controller, under Google's privacy policy.
• Public business registers: the Finnish Patent and Registration Office (YTJ) and GLEIF receive the organisation name or ID you type into the contact form, from our server and without your IP address, to find your organisation.
• Our accountant and advisers, where needed to meet legal and financial obligations.
• Authorities, where we are legally required to disclose data.

We choose EU-based providers wherever we can and prefer to keep data within the European Economic Area (EEA).

International transfers

We aim to keep personal data within the EEA. Where a provider processes data outside the EEA, we rely on an appropriate safeguard under the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses. Cloudflare (US) and Google (US) are covered by the EU-US Data Privacy Framework, and Proton operates from Switzerland, which holds an EU adequacy decision.

How long we keep it

We keep personal data only as long as needed for the purpose it was collected for:

• Enquiries that do not lead to a contract: kept for a reasonable period, then deleted.
• Contact form messages are kept like other enquiries. Messages we find to be spam are deleted when we review them.
• The browser key (ack_form_key): 3 months, in your browser and in our system.
• Block list entries: as long as we need them to stop the misuse.
• Job applications: kept for the duration of the recruitment process and deleted afterwards, unless you agree that we may keep your application for future openings.
• Client records: kept for the duration of the relationship and afterwards as required by law. Accounting records are retained for the period required by the Finnish Accounting Act.
• Access credentials to client systems: revoked and deleted when an engagement ends.
• Website statistics in Google Analytics: deleted automatically after the retention period set in our account, at most 14 months.
• Your cookie choice on your device: 12 months, after which the banner asks again.
• Marketing permissions and the record of each choice in our customer register: kept while you are in the register, and afterwards for as long as we need them to show what you chose.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you,
• rectify inaccurate or incomplete data,
• erase your data ("right to be forgotten"), subject to our legal retention duties,
• restrict or object to processing based on legitimate interest,
• data portability for data you provided, where applicable,
• withdraw consent at any time, where processing is based on consent.

To exercise any of these, email legal@argnode.com. We will respond within one month.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi), or the supervisory authority in your own EU country.

How we protect data

We apply appropriate technical and organisational measures, including least-privilege access, encryption in transit, and access logging. Every member of our team works under their own personal account, scoped to see only what their work requires; nobody holds administrator rights to every system by default, and we never share password logins. We use read-only access to client systems where possible.

Changes to this policy

We may update this policy as our services or the law change. The current version always lives at this address, with the "last updated" date above. Material changes will be highlighted where appropriate.