Privacy policy

This policy explains how we process personal data submitted through the website’s contact and quote request form.

1. Controller

Privacy Policy

Groovehand – Creative Digital Studio

This Privacy Policy explains how we collect, use, store, and protect personal data obtained through the Groovehand website (groovehand.com) and our services.

1. Data Controller

Brand name: Groovehand
Legal business name: Grooveneck
Business ID: 3640189-3
Address: Malagankatu 3, 00220 Helsinki
Email: hello@groovehand.com

Groovehand operates as a service brand under the business identified above.

2. Privacy Contact

For questions, requests, or concerns regarding the processing of your personal data, please contact:

hello@groovehand.com

3. Purposes of Processing Personal Data

We process personal data for the following purposes:

• Responding to inquiries and quotation requests
• Understanding customer requirements and project scope
• Preparing and delivering quotations
• Managing customer relationships and delivering agreed services
• Managing contracts, invoicing, and legal obligations
• Maintaining website functionality, security, and technical operations

Personal data submitted through our contact forms will not be used for separate direct marketing activities without an appropriate lawful basis.

4. Personal Data We Collect

When submitting a contact or quotation request, we may collect the following information:

Required information:

• Name
• Email address
• Project description or message

Optional information:

• Company name
• Phone number
• Existing website URL
• Services of interest
• Estimated project budget
• Preferred project timeline

Our systems may also record the submission date and time, selected language, and technical information necessary for security purposes.

[To be verified: Whether the website, WordPress, hosting server, or spam protection tools collect IP addresses and how long such information is retained.]

Personal data is primarily collected directly from individuals who contact us.

5. Legal Basis for Processing

We process personal data in accordance with Article 6 of the EU General Data Protection Regulation (GDPR).

Contractual necessity and pre-contractual measures (Article 6(1)(b)): We process personal data to prepare quotations, enter into agreements, and deliver contracted services where the processing is necessary for a contract with the individual or pre-contractual steps requested by that individual.

Legitimate interests (Article 6(1)(f)): We process personal data to respond to general inquiries, communicate with business customer representatives, and maintain website security. Our legitimate interests include effective customer communication, business operations, and protection of our services.

Legal obligations (Article 6(1)(c)): Certain personal data must be processed and retained to comply with applicable accounting, tax, and other legal requirements.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

• Quotation requests that do not result in a customer relationship: Up to 12 months after the last communication, unless longer retention is justified, for example, in connection with legal claims.
• General inquiries: Up to 12 months after the inquiry has been resolved.
• Customer relationship data: For the duration of the customer relationship and afterwards where required by contractual obligations, potential legal claims, or applicable legislation.
• Accounting records containing personal data: For the retention periods required by applicable accounting legislation.

Personal data that is no longer required will be securely deleted or anonymized.

[To be confirmed: The 12-month deletion policy must also be implemented in practice, including WordPress and email records.]

7. Data Recipients and Service Providers

Personal data may be accessed only by individuals and service providers who require it for the purposes described in this Privacy Policy.

We use Hostinger services for website hosting and email operations.

Additional service providers may be involved in contact form delivery, security, backups, accounting, or project delivery.

Where necessary, relevant project information may be shared with subcontractors involved in delivering our services, provided that such processing or disclosure is lawful and limited to what is necessary.

We do not sell personal data to third parties.

[To be verified: The WordPress quotation request plugin, email delivery service, and any additional personal data processors.]

8. International Data Transfers

We aim to use services that process personal data within the European Union (EU) and European Economic Area (EEA).

If personal data is transferred outside the EU or EEA, we ensure that an appropriate transfer mechanism and any necessary safeguards are in place in accordance with applicable data protection legislation.

[To be verified before publication: Whether any service providers transfer personal data outside the EU/EEA and which legal transfer mechanisms apply.]

9. Cookies and Browser Storage

Our website may use technically necessary cookies or similar browser storage technologies to support essential website functionality.

Service selections and information related to preparing a quotation request may be stored temporarily in your browser’s session storage.

[To be verified: The website does not currently use analytics cookies, marketing cookies, or other non-essential tracking technologies.]

If we introduce analytics or marketing technologies that require consent, we will request the necessary consent before using them.

10. Data Security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure.

Access to personal data is restricted to individuals who have a legitimate need to process it as part of their responsibilities.

We use appropriate security measures, including access controls, software updates, and secure connections, to protect our website and related systems.

11. Your Data Protection Rights

Under applicable data protection legislation, you may have the right to:

• Receive information about how your personal data is processed
• Access the personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data where the legal conditions are met
• Request restriction of processing
• Object to processing based on legitimate interests for reasons relating to your particular situation
• Request data portability where applicable
• Withdraw consent at any time where processing is based on consent

These rights are not absolute in all circumstances. For example, legal retention obligations may prevent the immediate deletion of certain information.

To exercise your rights, please contact:

hello@groovehand.com

We will generally respond to requests within one month of receiving them.

12. Automated Decision-Making

We do not use personal data collected through contact or quotation request forms for solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

13. Right to Lodge a Complaint

If you believe that your personal data has been processed in violation of applicable data protection legislation, you have the right to lodge a complaint with a supervisory authority.

In Finland, the relevant authority is:

Office of the Data Protection Ombudsman
Website: https://tietosuoja.fi/en/home

We encourage you to contact us first so that we can investigate and address your concerns.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, data processing practices, or applicable legal requirements.

The latest version will be available on the Groovehand website at groovehand.com.