Privacy

1. Scope and controller

This statement applies to the website scalepoint-ops.com, its localized pages and the forms provided on it. The controller for the processing described here is:

ScalePoint Ops is a specialist operations brand of ScalePoint Ventures Oy. ScalePoint Ventures Oy is the contracting entity for every engagement.

2. Hosting and technical operation

This website and its forms run on Lovable Cloud, provided by Lovable Labs Incorporated. The primary cloud region configured for this project is the European Union, Ireland (eu-west-1). Lovable Cloud builds on Supabase infrastructure and its open-source foundation for the database and the private file storage used by this website.

To deliver and secure the website, technical information may be processed, in particular:

• IP address and approximate location derived from it
• browser and device information
• requested pages and API routes
• date and time of the request
• session, security and error information

This processing serves hosting, security, abuse prevention, troubleshooting and the reliable operation of the website. The legal basis is our legitimate interest in a secure and functioning website, Art. 6(1)(f) GDPR.

Lovable's current privacy policy states that operational log data may be retained for up to 90 days.

Lovable privacy policy

3. Contact enquiries

When you use the contact form, we process the data you enter:

• name
• work email address
• company
• website (optional)
• requested service scope
• delivery language
• your message

We use this data to respond to your enquiry and, where relevant, to take steps prior to entering into a contract. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a possible contract, and Art. 6(1)(f) GDPR for our legitimate interest in handling business enquiries efficiently.

The active form record is deleted automatically no later than 12 months after submission, unless the data has to be retained separately because a contract was established, because of a legal obligation, or for the establishment, exercise or defence of legal claims.

4. Talent Network

If you share a profile with our Talent Network, we process the data you provide:

• name
• email address
• location
• languages
• primary area
• LinkedIn URL (optional)
• short profile text (optional)
• CV file (optional)

Either a LinkedIn URL or a CV is required so that we can assess a profile at all. We use the data to review your profile and to contact you about suitable future assignments.

The legal basis is your explicit consent, Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by writing to our privacy contact address. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Your profile and any private CV file are deleted automatically after 12 months, or earlier following a valid withdrawal request, subject only to legal retention obligations.

Joining the Talent Network does not by itself send your profile or CV to clients or delivery partners. If sharing your profile is relevant for a specific opportunity, we contact you first and provide the appropriate legal basis and information for that step.

The form asks you not to submit unnecessary sensitive data, such as health information, religious or political affiliation, or identification documents.

5. Email communication

Direct correspondence to our published addresses is handled through Google Workspace. When you write to us, we process your sender and contact data, the content of your message and any attachments in order to answer you and to manage the relevant business or talent relationship.

The legal basis mirrors the purpose of your message: Art. 6(1)(b) GDPR for contract-related correspondence, Art. 6(1)(a) GDPR for talent profiles you send us voluntarily, Art. 6(1)(f) GDPR for our legitimate interest in secure business communication, and Art. 6(1)(c) GDPR where retention is legally required.

When you submit the contact form or the Talent Network form, we send two automatic transactional emails: an internal notification to the responsible ScalePoint Ops address, and an acknowledgement to the email address you entered, in the language of the form you used. These emails contain the details you submitted; an uploaded CV is never attached or linked, only flagged as present. Sending happens through Lovable's email infrastructure using our own sender domain notify.scalepoint-ops.com. These are confirmation and notification emails only, never marketing. The legal basis is Art. 6(1)(b) and Art. 6(1)(f) GDPR.

Google Cloud data processing addendum

6. Cookies and analytics

We do not use marketing or advertising cookies on this website. Lovable may process technical connection and log data required to host, secure and operate the website, as described above.

We use Microsoft Clarity for website analytics, heatmaps and session reconstructions (session recordings). Clarity starts by default when you visit the website, unless you decline tracking in the cookie banner or under Cookie settings.

Clarity sets cookies such as _clck, _clsk and CLID and records interactions such as page views, clicks, scrolling, mouse movement and device and browser information, which are used to reconstruct your visit.

According to Microsoft, session recordings are retained for up to 30 days, and click and heatmap data for up to 9 months.

You can decline tracking at any time via the Cookie settings link in the footer. When you decline, Clarity is signalled that analytics storage is denied, the Clarity tag is removed, the _clck, _clsk and CLID cookies are deleted, and Clarity is no longer loaded on subsequent visits. You can allow it again at any time under Cookie settings.

Your choice itself is stored in your browser's local storage so that the banner does not reappear on every visit and so that a decline is respected on future visits.

7. Recipients and processors

Access to personal data is limited to authorised ScalePoint Ventures personnel and, only where necessary for a specific enquiry or assignment, to project-specific senior experts bound by confidentiality.

In addition, we rely on service providers that are necessary to operate the website and our business communication: Lovable for hosting, database and private file storage, and Google Workspace for business email. Supabase technology is used as the infrastructure foundation of Lovable Cloud.

We do not sell personal data and we do not use it for advertising purposes.

8. International transfers

The primary cloud region for this project is the European Union, Ireland (eu-west-1), so personal data submitted through this website is stored inside the European Economic Area. Depending on the providers' own infrastructure, supporting processing such as operational log data or business email may still take place outside the EEA, in particular in the United States.

Lovable's current privacy policy states that transfers from the EEA are safeguarded through the EU Standard Contractual Clauses, Module 2. Google provides its applicable data processing and transfer terms for Google Workspace.

You can request information about the safeguards that apply to a specific transfer through our privacy contact address.

9. Retention

• Contact form record: maximum 12 months
• Talent profile and CV file: maximum 12 months, or earlier after withdrawal of consent
• Hosting and log data: according to the provider's policy, generally up to 90 days for operational logs
• Direct business correspondence, contract and legal records: only as long as needed or legally required
• Backups: copies may persist for a limited provider backup cycle after active deletion

Expired form records and private CV files are removed automatically by a daily clean-up routine, so deletion does not depend on a manual step.

10. Security

Data is transmitted over an encrypted HTTPS connection. Form submissions are validated on the server, submitted records are stored with strict access controls, and CV files are kept in private storage that is not publicly accessible. There is no direct public access to the underlying data tables from the browser, and human access is limited to what is required for the stated purposes.

To prevent automated abuse of the forms, we operate a submission limiter. An anonymous site-wide attempt counter is increased before the request body is read, parsed or validated. Only after a form entry has been validated and checked against the duplicate-submission identifier do we derive a keyed pseudonymous digest (HMAC) of the normalized email address and count it. The limiter table stores only these keyed identifiers, counters and an expiry time; no raw email address, IP address, user agent or form content is stored in it. Limiter entries are removed automatically no later than the end of their time window plus a clean-up cycle that runs every 15 minutes. The legal basis is our legitimate interest in protecting our forms against misuse, Art. 6(1)(f) GDPR. If a submission is successful, the email address you entered is of course still stored with the submitted record and deleted under the retention rule described above for contact enquiries and Talent Network profiles.

No method of transmission or storage can be considered absolutely secure, and this section does not state any certification.

11. Your rights

Under the GDPR you have the right to access your personal data and to request rectification, erasure or restriction of processing. You also have the right to data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent at any time with effect for the future.

Please send requests to our privacy contact address. Where necessary, we may ask for information to verify your identity before we act on a request.

12. Supervisory authority

You also have the right to lodge a complaint with a supervisory authority. The competent authority for the controller is:

13. Automated decisions, external links and changes

We do not use solely automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

This website links to external websites. Their operators are responsible for the content and for the data processing on those sites.

We update this privacy statement when our processing activities or legal requirements change. The current version and its date are shown on this page.