Privacy Policy

1 Data Controller

Creative Media by ST is the data controller responsible for personal data collected through this website. As a Finnish sole trader, we are subject to the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).

2 What Personal Data We Collect

We only collect personal data that you voluntarily provide to us. This website collects data through the contact / quote request form:

We do not collect sensitive personal data (special categories under GDPR Article 9), financial information, or data from minors.

3 Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Pre-contractual measures (Art. 6(1)(b)): Processing your enquiry and preparing a quote at your request.
• Legitimate interests (Art. 6(1)(f)): Following up on an enquiry you initiated, where our interest in responding does not override your rights.
• Legal obligation (Art. 6(1)(c)): Where required by Finnish law, e.g. accounting records under the Finnish Accounting Act (Kirjanpitolaki 1336/1997).

We do not use your data for automated decision-making or profiling.

4 How We Use Your Data

Your personal data is used exclusively to:

• Respond to your enquiry or quote request
• Communicate with you about a potential or active project
• Fulfil contractual obligations if you become a client
• Meet legal obligations (invoicing, accounting)

We will never sell, rent, or share your personal data with third parties for marketing purposes.

5 Third-Party Services & Data Processors

We use the following third-party services that may process your data as data processors on our behalf:

Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework as the lawful transfer mechanism.

6 Data Retention

We retain your personal data only for as long as necessary:

• Enquiry emails (no contract formed): Up to 12 months from last contact, then deleted.
• Client project data: For the duration of the project plus 3 years, in line with Finnish limitation periods (Laki velan vanhentumisesta 728/2003).
• Accounting and invoice records: 6 years from the end of the financial year, as required by the Finnish Accounting Act.

7 Cookies & Tracking

This website does not use tracking cookies, analytics cookies, or advertising cookies.

Google Fonts is loaded from Google's servers, which may result in Google logging your IP address. This is a technically necessary service. No personal profiling is performed by us as a result.

If we add analytics or advertising tools in the future, this policy will be updated and a cookie consent banner will be displayed as required under Finnish law (Sähköisen viestinnän palvelulaki 917/2014, Section 205).

8 Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at hello@creativemediabyst.fi. We will respond within 30 days as required by GDPR Article 12.

9 Right to Lodge a Complaint

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):

We would, however, appreciate the opportunity to address your concerns directly before you contact the supervisory authority.

10 Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing activities. The date at the top of this page indicates when it was last revised.

For significant changes, we will make the update clearly visible on this page. Continued use of our website after changes constitutes acceptance of the updated policy.

11 Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or your personal data: