Privacy Policy

Updated 4 February 2026

Controller

Kulta Creative Oy
Heurlinintie 5 as. 24
02620 Espoo
Business ID: 3125151-5

Contact person for data protection matters

Janni Kitti
janni@kultacreative.fi

Purposes and legal bases for processing personal data

Kulta Creative Oy processes personal data for managing, developing and maintaining customer and cooperation relationships, providing services, customer communication, responding to contact requests, entering into and fulfilling contracts, and complying with legal obligations.

Personal data may also be processed for marketing and business development purposes.

The legal bases for processing personal data are:

  • consent given by the data subject

  • performance of a contract or steps taken prior to entering into a contract

  • legitimate interest of the controller

The controller’s legitimate interest is based on managing customer relationships, developing services and business operations, direct marketing to existing customers, and communication with representatives of companies and organisations. The processing is not in conflict with the fundamental rights and freedoms of the data subject.

Providing personal data is partly a contractual requirement. If the data subject does not provide the information necessary for entering into a contract, the contract cannot be concluded or the service cannot be provided.

Personal data processed

The register may include the following types of data:

  • name

  • address

  • phone number

  • email address

  • company name and position in the company

  • social media username

  • information about services the data subject is interested in

  • messages and contractual information related to customer and cooperation relationships

Regular sources of data

Personal data is collected from the data subject themselves, for example via email, phone, website contact forms, social media services, contracts, and customer meetings.

Contact details of representatives of companies and other organisations may also be collected from public sources, such as company websites and directory services.

Processors of personal data and data disclosures

Personal data is primarily processed by the shareholders and personnel of Kulta Creative Oy.

External service providers (such as IT and communication services) may be used in providing services, and they process personal data on behalf of the controller. Data is processed confidentially in accordance with data protection legislation.

Personal data is not regularly disclosed to third parties. Data may be disclosed to authorities when required by law, and in connection with corporate or business arrangements in accordance with applicable legislation.

Transfers of personal data outside the EEA

Personal data is primarily processed within the European Economic Area (EEA). If personal data is transferred outside the EEA to a country without an adequacy decision by the European Commission, transfers are carried out using standard contractual clauses approved by the European Commission or other safeguards in accordance with data protection legislation.

Protection of personal data

Personal data is protected using appropriate technical and organisational measures. Data is processed confidentially and access is limited to individuals whose duties require it. Secure connections (SSL) are used for data transfers.

Retention periods of personal data

Personal data is retained only as long as necessary to fulfil the purposes of processing or as required by contract or law.

  • data related to customer and cooperation relationships is retained for the duration of the contractual relationship and for up to 6 years thereafter

  • marketing data is retained until the data subject withdraws their consent or objects to processing

  • accounting-related data is retained in accordance with accounting legislation

Rights of the data subject

The data subject has rights under data protection legislation, including:

  • the right to access personal data

  • the right to withdraw consent without affecting the lawfulness of prior processing

  • the right to rectification

  • the right to erasure

  • the right to restriction of processing

  • the right to data portability

  • the right to object to processing, particularly for direct marketing

Kulta Creative Oy does not use personal data for automated decision-making or profiling that would have legal effects concerning the data subject.

Cookies

The website uses necessary cookies to enable its functionality. In addition, analytics and marketing cookies may be used based on the user’s consent.

Cookie settings can be adjusted in the browser settings. The website uses the Squarespace platform.

Exercising rights and right to lodge a complaint

The data subject may exercise their rights by contacting the controller’s contact person via email. If necessary, additional information may be requested to verify identity.

The data subject has the right to lodge a complaint with a data protection authority if they consider the processing of personal data to be in violation of data protection legislation.

Changes to the privacy policy

This privacy policy may be updated due to changes in legislation or operations. The latest version is available on the website.