Privacy Policy.

I. The data controller.

The data controller for this site is StrongBrandWords Oy ("the studio", "we"), with registered office at Topparikuja 1, 00520 Helsinki, Finland. Finnish business ID (Y-tunnus) 3148592-4. VAT number FI31485924. Contact for privacy matters: studio@strongbrandwords.com.

II. Data we collect and why.

When you submit a brief through the contact form we collect your name, email address, optional phone number, optional company name, optional country, and the message you write. The lawful basis is Article 6(1)(b) GDPR (steps prior to entering a contract). If you proceed to checkout we additionally collect the payment details necessary for the transaction — which are handled directly by Stripe and never stored on our servers. The lawful basis for checkout data is Article 6(1)(b) GDPR (performance of a contract).

If you accept analytics cookies we collect aggregated visit data through a privacy-preserving analytics provider; no individual user is identifiable from this data. The lawful basis is Article 6(1)(a) GDPR (consent). If you decline analytics cookies — or do not make a choice at all — no analytics data is collected.

III. Cookies.

The site sets one technical session cookie (used to maintain the cookie-consent state itself) and, if you accept analytics, one analytics identifier. The choice is stored in your browser's localStorage under the key sbw-cookie-consent. You can change your choice at any time by clearing the key or by writing to us. The full inventory is in the cookie policy.

IV. Sub-processors.

The studio uses the following third-party data processors. Each of them has been assessed for GDPR compliance and a data processing agreement is in place where required.

• Stripe Payments Europe Ltd. — payment processing. Card data is held by Stripe under PCI-DSS Level 1 standards; we receive only the transaction outcome.
• Hetzner Online GmbH — hosting infrastructure, located in EU data centres in Helsinki and Frankfurt am Main.
• Fastmail Pty Ltd. — business email for the studio.
• Plausible Insights OÜ — privacy-preserving analytics (only if you accept analytics cookies; hosted in the EU).

V. Retention.

Brief submissions are retained for thirty-six months from the date of submission. Engagement records — including invoices, contracts, and engagement letters — are retained for seven years from the close of the financial year in which the engagement closed, as required by the Finnish Accounting Act (Kirjanpitolaki 1336/1997). Server access logs are retained for ninety days. Cookie consent state is retained in your browser until you clear it.

VI. International transfers.

All processors listed above operate within the European Economic Area, except Stripe which operates a global payments network. Where Stripe processes data outside the EEA, transfers occur under the European Commission's Standard Contractual Clauses and Stripe's own adequacy programme. No other personal data is transferred outside the EEA.

VII. Your rights under the GDPR.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). To exercise any of these, write to studio@strongbrandwords.com and we will respond within thirty days, more typically within five.

You also have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), whose details are at tietosuoja.fi.

VIII. Security.

The site is served over TLS 1.3, with HTTP Strict Transport Security and a content security policy in place. Brief submissions are written to an append-only log file on the studio server, with access restricted to the four people in the studio. Invoicing and accounting records are kept in our Finnish-resident bookkeeping system, under multi-factor authentication.

IX. Changes to this policy.

Material changes will be notified by email to anyone with an open or recent engagement. The page itself is dated at the top; minor wording changes are not separately announced.