Privacy Policy

The controller of your personal data is:

When you submit an inquiry or request a proposal, we collect the information you provide, which may include:

• Name
• Company name
• Email address
• Telephone number
• Information included in your message or project request, such as the occasion, quantity, budget, timeline and customisation requirements

When you visit our website, our hosting and technical service providers may process limited technical information necessary to operate and secure the website, such as IP address, browser or device information, server logs and request data.

Please do not submit unnecessary sensitive personal data through our contact form or by email.

We process personal data only where necessary for the following purposes:

When you submit a form on our website, the information you provide is transmitted through our backend services and sent to our business email address so that we can respond to your inquiry.

We do not store contact-form submissions in a separate customer database through Supabase.

We use:

• Vercel, to host and deploy our website and related technical services.
• Supabase, to provide backend functionality used to process and transmit contact-form submissions.
• Resend, to deliver transactional email messages relating to your inquiry.

Your inquiry and subsequent communication may be retained in our business email mailbox for as long as necessary to respond to your request, manage a potential or active customer relationship, and meet legal or record-keeping obligations.

We do not currently use analytics or advertising cookies.

Our website and technical providers may use strictly necessary technologies required to operate, secure and maintain the website. These are not used to track you for analytics or advertising purposes.

If we introduce analytics cookies or other non-essential tracking technologies in the future, we will update this Privacy Policy and, where required, request your consent before activating them.

We do not sell personal data.

We may share personal data only where necessary to operate our business, respond to your inquiry, fulfil an order or comply with legal obligations. Recipients may include:

• Vercel, for website hosting, deployment and technical infrastructure
• Supabase, for backend functionality used to process and transmit contact-form submissions
• Resend, for transactional email delivery
• Accounting, invoicing, payment, delivery or logistics providers, where relevant to an order
• Suppliers or production partners, only where necessary to fulfil an order
• Professional advisers, insurance providers or public authorities where required by law or necessary to protect our legal rights

Some of our service providers may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will use appropriate safeguards required by applicable data-protection law, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another valid transfer mechanism.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

• Inquiry and proposal correspondence: retained in our business email mailbox for up to 24 months after our last meaningful communication, unless a longer retention period is necessary to manage an active customer relationship, meet legal obligations, or establish, exercise or defend legal claims.
• Customer, project, order and delivery information: retained for the duration of the customer relationship and afterwards as required by law or necessary to manage legal claims.
• Invoices and accounting records: retained for the period required by applicable Finnish accounting and tax legislation.
• Information required for legal claims: retained for as long as necessary to establish, exercise or defend a claim.

Subject to applicable law, you have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request deletion of personal data in certain circumstances
• Request restriction of processing in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent
• Request data portability where applicable
• Object to direct marketing at any time
• Lodge a complaint with the Finnish Data Protection Ombudsman

To exercise your rights, please contact us at giftedstudio.hki@outlook.com.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No online service can be completely secure. Please avoid sending unnecessary sensitive personal information through our contact form or by email.

Our website may link to third-party websites or services. We are not responsible for their privacy practices. Please review the privacy policy of any third-party website before providing personal data.

We may update this Privacy Policy to reflect changes to our website, services, service providers, data-processing practices or legal requirements.

The latest version will always be published on this page with its “Last updated” date.

If you have questions about this Privacy Policy or our processing of personal data, please contact: