Privacy Policy

A plain-language description of how we handle personal data (GDPR, Article 13).

1. Data controller

Kelvo Brook Media, Linnukkatie 4 91900 Liminka, Finland. General enquiries: [email protected]. Privacy matters: [email protected] (we reply within 30 days).

2. Personal data we process

  • User account: name, email address and a salted password hash.
  • Premium subscription: plan type, validity period and billing history.
  • Payments: the payment provider's transaction ID, payment method and last four card digits. Card details go directly to a PCI DSS certified payment provider.
  • Newsletter: email address and subscription date.
  • Enquiries: the message content and contact details you provide.
  • Technical data: the cookie choice saved in your browser and server security logs (IP address and timestamp).

We do not collect location data, carry out profiling or use advertising tracking.

3. Purposes and legal bases

  • Performance of a contract (Art. 6(1)(b)): maintaining your account, delivering Premium and billing.
  • Legal obligations (Art. 6(1)(c)): retaining records under accounting legislation.
  • Consent (Art. 6(1)(a)): sending the newsletter. You can withdraw consent at any time.
  • Legitimate interest (Art. 6(1)(f)): security and the prevention of abuse and payment fraud.

4. Retention periods

  • Account data: while the account is active and up to 30 days after a deletion request.
  • Accounting records: six years from the end of the financial year.
  • Security logs: 90 days.
  • Newsletter subscription: until you unsubscribe.
  • Enquiries: 12 months after the matter is resolved.

5. Recipients and transfers

We never sell, rent or hand over personal data for marketing. We use carefully selected processors: an EU/EEA hosting provider, an email delivery service and a payment provider, each bound by a data processing agreement. Any transfer outside the EU/EEA relies on Standard Contractual Clauses.

6. Your rights

  • Right of access (Art. 15) and rectification (Art. 16).
  • Right to erasure (Art. 17) and restriction of processing (Art. 18).
  • Right to data portability (Art. 20).
  • Right to object (Art. 21) and to withdraw consent (Art. 7).
  • Right to lodge a complaint with the Office of the Data Protection Ombudsman.

7. Automated decision-making

We make no automated decisions with legal or similarly significant effects, and we do not profile users.

8. Security

Traffic is encrypted, passwords are stored only as hashes and access to data is limited to those who need it.

9. Changes

We update this policy when needed and notify registered users of material changes at least 14 days in advance.

Last updated 21 October 2026