Privacy policy

Studio Titta respects your privacy and processes personal data carefully and in accordance with applicable data protection legislation. This privacy policy explains what personal data Studio Titta processes, the purposes for which it is used, how long it is kept, and what rights you have in relation to your own data.

1. Controller

Titta Winquist / Studio Titta
Business ID: 1991549-7
Email: titta@studiotitta.fi

For any questions or requests concerning data protection, please contact the email address above.

2. What personal data is processed?

Studio Titta processes only the personal data necessary for carrying out its activities and services.

The following data may be processed through the website's contact form:

• name
• email address
• company name, if the user provides it voluntarily
• the message written on the contact form and any information given in it
• an estimate of the project's scope, if the user chooses one voluntarily
• IP address, in order to prevent misuse of the form and automated spam.

The contact form's spam protection processes the IP address temporarily in order to limit the number of submission attempts. Studio Titta's application retains this information for that purpose for approximately 10 minutes, after which it is removed from the application's temporary memory.

Studio Titta also uses a separate Brand Discovery form, sent to the client via a personal link in order to gather the starting information for a brand or website project. The form is not openly listed in the website's menus and is not intended for general enquiries. The following data may be processed through it:

• the respondent's name
• email address
• company name
• the answers given on the form concerning the business, its services, its audience, the intended character of the brand and visual preferences
• a link to inspiration images added by the respondent, along with any website addresses given as examples
• IP address, in order to prevent misuse of the form and automated spam.

Answers to the Brand Discovery form are saved in the respondent's own browser while the form is being completed, so that an interrupted session can be continued later on the same device. This information stays only on the respondent's own device and is not sent to Studio Titta until the respondent submits the form. After a successful submission, the copy stored in the browser is deleted. This is not a cookie but the browser's local storage, and it is not used for tracking or analytics.

The website's technical service provider Vercel may additionally process IP addresses and other technical data in its server logs for the purposes of providing the service, security and technical maintenance. Vercel's visitor analytics also processes the IP address momentarily in order to count visitors, in such a way that the address is not stored. This is described in more detail in section 8.

In connection with a client and project relationship, the following may also be processed:

• the name of the client or contact person
• the company and the person's position in it
• email address and other contact details provided by the client
• quotation, contract and project information
• materials supplied by the client relating to websites, brand or other assignments
• information relating to invoicing and payments
• necessary information relating to communication with the client.

Studio Titta does not, as a rule, collect special categories of personal data — that is, sensitive personal data — through the website.

3. What is personal data used for?

Personal data may be processed for the following purposes:

• responding to enquiries
• handling requests for quotations
• establishing and maintaining a client relationship
• planning and delivering agreed services and projects
• communicating with the client
• invoicing and meeting accounting obligations
• customer service and any subsequent follow-on projects
• ensuring the security of the website and preventing spam and misuse
• developing Studio Titta's activities and website
• meeting statutory obligations.

Personal data is not used for automated decision-making or for profiling users.

Studio Titta does not currently use email addresses given on the contact form to send newsletters or other electronic direct marketing.

4. Legal basis for processing

Depending on the situation, the processing of personal data is based on:

• the user's own enquiry and the carrying out of the measures they have requested
• the conclusion or performance of a contract between Studio Titta and the client
• Studio Titta's legitimate interest in managing client relationships, enquiries and business
• Studio Titta's legitimate interest in protecting the website, preventing spam and misuse, and maintaining the security of the service
• Studio Titta's statutory obligations, such as accounting obligations
• where necessary, the consent given by the data subject.

The short-term processing of the contact form's IP address in order to prevent spam and misuse is based on Studio Titta's legitimate interest in maintaining the security and reliability of the website.

Where processing is based on consent, that consent may be withdrawn at any time.

5. Where does the data come from?

Personal data is obtained primarily from the person themselves, for example through:

• the website's contact form
• the Brand Discovery form
• email
• client and project discussions
• quotations and contracts
• project and other materials supplied by the client.

IP addresses and other technical data relating to the operation of the website arise in the course of using the website.

In connection with projects and references, publicly available information and material concerning the client's business or project may also be processed.

6. Website forms and Resend

Information given on Studio Titta's contact form and Brand Discovery form is delivered to Studio Titta by email to titta@studiotitta.fi using the Resend service. The answers to the Brand Discovery form are also sent with the message as a structured attachment, so that the material is preserved exactly as the respondent wrote it.

Studio Titta's website has no separate database in which form responses are stored. Responses are kept in Studio Titta's email and project materials.

In this context Resend acts as a service provider used by Studio Titta and as a processor of personal data.

Resend may process personal data in the United States. Where personal data is transferred outside the European Union or the European Economic Area, appropriate transfer mechanisms and safeguards under the GDPR are used.

Resend has stated that it is certified under the EU–U.S. Data Privacy Framework. In addition, Resend's Data Processing Addendum (DPA) includes, where required, the Standard Contractual Clauses (SCC) approved by the European Commission.

Further information about the data protection practices used by Resend and the safeguards applied to international transfers, together with a copy of the applicable contractual terms, may be requested from Studio Titta by email at titta@studiotitta.fi. Information is also available in Resend's own privacy and GDPR materials.

7. Technical service providers

Studio Titta uses external technical service providers in delivering the website and client projects.

These currently include, among others:

• Vercel – website hosting, technical infrastructure, the processing of technical data relating to the operation and security of the service, and cookieless visitor analytics (Vercel Web Analytics), described in more detail in section 8.
• Google – visitor analytics (Google Analytics), described in more detail in section 8.
• Resend – delivering the contact form's email messages.
• Zoho Mail – Studio Titta's email service. Messages sent through the contact form are received and stored in Studio Titta's Zoho Mail account.
• Microsoft OneDrive – electronic storage of client and project materials.

Service providers may process personal data on Studio Titta's behalf only to the extent necessary for delivering the services they provide.

If processing by a service provider requires the transfer of data outside the EU or EEA, the transfer is made using a transfer mechanism under Chapter V of the GDPR and, where necessary, appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission. If the recipient falls within the scope of an adequacy decision approved by the European Commission — including, where applicable, the EU–U.S. Data Privacy Framework — the transfer may be based on that adequacy decision.

Further information about the processing of personal data by the service providers used by Studio Titta, and about the safeguards applied to international transfers, may be requested at titta@studiotitta.fi.

Studio Titta does not sell personal data and does not disclose it to third parties for their own direct marketing purposes.

Data may, however, be disclosed to authorities or other parties where required by law.

8. Analytics and cookies

Studio Titta's website does not use cookies stored on the user's device.

The website uses the cookieless visitor analytics provided by Vercel (Vercel Web Analytics). Its purpose is to obtain general information about how the site is used and how it performs, and to develop the site's content and usability.

The analytics collects information about the use of the site such as:

• the page viewed and the number of page views
• the number of visitors
• the site or service the visitor arrived from
• the visitor's country
• browser, operating system and device type.

The analytics does not store a cookie or any other information on the visitor's device, and does not read information previously stored on the device. For this reason the site does not ask for cookie consent.

In order to count visitors, Vercel forms an identifier from the technical details of the request, such as the IP address and the browser's identifying information, from which the visitor cannot be identified and the original details cannot be recovered. The IP address is not stored, and the identifier changes daily, so the same visitor is not tracked from one day to the next or from one site to another.

The visitor analytics is not used for profiling visitors, for automated decision-making or for targeted advertising, and its data is not combined with enquiry or client data. The processing is based on Studio Titta's legitimate interest in monitoring the use and performance of its website and in developing the site.

In the visitor analytics, Vercel acts as a service provider used by Studio Titta and as a processor of personal data. Data may also be processed outside the European Union or the European Economic Area. The transfer mechanisms and safeguards used for international transfers are described in section 7.

In addition to Vercel Analytics, the site uses Google Analytics (Google LLC). The site is configured so that Google Analytics does not store a cookie or any other information on the visitor's device: measurement starts with the consent setting "denied" (Google's Consent Mode), and the site has no feature that would ever change this setting. In this mode, Google Analytics collects general information similar to Vercel Analytics above, but data from cookieless measurement is partly estimated and not as precise as cookie-based measurement would be. In this processing, Google acts as a service provider used by Studio Titta and as a processor of personal data, and data is also processed in the United States; the transfer mechanisms and safeguards used for international transfers are described in section 7.

The Brand Discovery form saves incomplete answers in the respondent's own browser so that the form can be completed later. This is not a cookie or a tracking technology but local storage essential to the usability of the form: the information stays only on the respondent's own device, is not used for analytics or profiling, and is removed once the form has been submitted. This is described in more detail in section 2.

If analytics, marketing or other tracking technologies requiring the user's consent are introduced on the site at a later date, appropriate consent will be requested from the user before any such technology is used, and this privacy policy will be updated accordingly.

The technical server logs and security-related data of the website's hosting service are not used by Studio Titta for profiling users or for targeted marketing.

9. Retention period

Personal data is kept only for as long as its processing is necessary.

Personal data relating to enquiries and potential client relationships is generally kept for no more than two years from the most recent contact, unless there is a justified or statutory reason for keeping it longer.

Information given on the Brand Discovery form is processed as part of the client and project relationship and is kept in accordance with this section. An incomplete response saved in the respondent's own browser is removed once the form has been submitted successfully, or when the respondent clears their browser's storage.

The IP address used in the forms' spam protection is kept in the temporary memory of Studio Titta's application for approximately 10–30 minutes. Retention periods for the hosting provider's own server logs are determined by that provider's practices. Visitor analytics data is retained in Vercel's service in statistical form for the period determined by the provider's practices and the service level used by Studio Titta; the identifier used to distinguish an individual visitor is valid for no more than 24 hours.

Necessary information relating to the client relationship and completed projects may be kept for the duration of the client relationship and afterwards for as long as is justified, for example because of the further development of the project, the client relationship, contractual obligations or potential legal claims.

Information relating to accounting and invoicing is kept in accordance with accounting legislation and other statutory retention obligations.

Personal data that has become unnecessary is deleted or anonymised.

10. Protection of personal data

Studio Titta processes personal data carefully and protects it with appropriate technical and organisational measures.

Data is kept primarily in secured email and cloud services and on secured computers used by Studio Titta.

Access to personal data is limited to the data Studio Titta needs in order to run its business and manage client projects. External service providers used by Studio Titta process data in accordance with their own access control, information security and data protection practices.

11. References and presenting client projects

Studio Titta may present client projects it has delivered on its website and in its own communication channels as references.

References may use, for example, the client company's name, website, a description of the project, publicly available material relating to the client, and image and other material supplied or approved by the client.

If a reference publishes personal data concerning an identifiable natural person — such as a person's name, personal statement or photograph — an appropriate legal basis for processing that personal data is ensured.

12. Your rights as a data subject

Under data protection legislation, and depending on the situation, you have the right to:

• know whether Studio Titta processes personal data concerning you
• obtain access to your own personal data
• request the correction of inaccurate or incomplete data
• request the erasure of your personal data
• request the restriction of processing
• object to the processing of your personal data where the processing is based on legitimate interest
• in certain situations, have the data you have provided transferred from one system to another
• withdraw your consent where the processing of personal data is based on consent.

These rights are not absolute in every situation. A statutory obligation may, for example, require certain data to be retained despite a request for erasure.

You can send a request concerning your rights to titta@studiotitta.fi.

Studio Titta may, where necessary, ask for further information in order to verify your identity before acting on a request.

13. Right to lodge a complaint with a supervisory authority

If you consider that your personal data has been processed contrary to data protection legislation, you have the right to lodge a complaint with the competent data protection authority.

In Finland the supervisory authority is the Office of the Data Protection Ombudsman.

14. Changes to this privacy policy

Studio Titta may update this privacy policy if its services, the technologies used, the processing of personal data or the legislation change.

The current privacy policy is always available on Studio Titta's website. The date of the most recent update is shown at the top of this page.