In short
- I am Nusrat and I run Pikselipolku alone, from Tampere. I am the only person who reads your enquiry.
- I use what you send to answer you and, if we agree on a project, to deliver and invoice it.
- Analytics and ads measurement run only if you accept them. Ad click IDs are saved with your enquiry only with that consent.
- Enquiries that do not lead to a project are deleted within 24 months. Analytics data is kept 14 months.
- I do not sell your data and I do not use it to make automated decisions about you.
- You can ask to see, correct or delete your data at any time by emailing [email protected].
Who is responsible for your data
The data controller is Pikselipolku, a sole trader (toiminimi) run by Nusrat in Tampere, Finland.
- Controller
- Pikselipolku, sole trader full legal name: owner to confirm
- Business ID
- [Y-tunnus] owner to confirm
- Address
- Tampere, Finland postal address: owner to confirm
- [email protected]
- Privacy contact
- The same email address. Write "Privacy" in the subject line.
No data protection officer has been appointed, because the processing described here is small in scale and not the core of the business. owner to confirm
What I collect
What you type into a form
The quote and contact forms ask for your name and email address. Depending on the form, they may also ask for your company, website or store URL, country, the service you need, a message, budget, timeline, platform details, ad platforms and monthly spend, or server details. The 3D brief form lets you upload up to three reference files of 5 MB each. All other fields are optional.
If you tick the optional newsletter box, I also keep your email address for a short practical note about once a month.
What the form adds automatically (hidden fields)
- Always: the page URL you sent the form from, the referring page, the page language, the form type and the service the page is about.
- If the link you followed had them: the campaign tags
utm_source,utm_medium,utm_campaign,utm_termandutm_content. - Only if you allowed ads measurement: the ad click IDs
gclid(Google Ads),msclkid(Microsoft Advertising),fbclid(Meta) andttclid(TikTok). Without that consent these fields stay empty and are not sent. - An empty spam-trap field that people never see. Forms that fill it in are discarded.
Email you send me directly
If you write to me, I keep your address, the message and any attachments, the same as an enquiry.
Analytics and ads measurement, only with consent
If you accept analytics, Google Analytics 4 records the pages you view, an approximate location derived by the provider, device and browser type and where you came from. If you accept ads measurement, the ad platforms' tags record that a visit or an enquiry followed an ad click. Details are in the cookie policy.
Server logs
The hosting provider's servers log the IP address, time, requested address and browser string of each request, for security and to fix faults. log retention: owner to confirm with host
Why I use it and on what legal basis
Each purpose has a legal basis under article 6(1) of the General Data Protection Regulation (GDPR).
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiry and preparing a quote | Form fields, emails, uploaded files | Steps you asked for before a contract, art. 6(1)(b); legitimate interest in replying, art. 6(1)(f) |
| Delivering a project, support and invoicing | Contact details, project material, invoices | Contract, art. 6(1)(b) |
| Keeping bookkeeping records | Invoices and related correspondence | Legal obligation under the Finnish Accounting Act, art. 6(1)(c) |
| Knowing which page or campaign an enquiry came from | Page URL, referrer, UTM tags | Legitimate interest in knowing which pages help, art. 6(1)(f) owner to confirm |
| Linking an enquiry to the ad that brought it | Ad click IDs, ad platform cookies | Consent, art. 6(1)(a) |
| Site analytics | Page views, device, approximate location, referral | Consent, art. 6(1)(a) |
| Monthly newsletter | Email address | Consent, art. 6(1)(a); unsubscribe link in every email |
| Security and spam prevention | Server logs, spam-trap field | Legitimate interest in a safe site, art. 6(1)(f) |
Giving your details is voluntary, but without an email address I cannot reply. I do not use your data for automated decision-making or profiling that has legal or similar effects on you.
How long I keep it
| Data | Kept for |
|---|---|
| Enquiries and emails that do not lead to a project | Up to 24 months from the last message, then deleted |
| Project correspondence and deliverables | For the project and any care plan, then as long as needed for possible claims owner to confirm |
| Invoices and bookkeeping records | As the Finnish Accounting Act requires confirm with your accountant |
| Google Analytics 4 data | 14 months (the GA4 retention setting) |
| Your cookie choice | 12 months in your browser, then you are asked again |
| Newsletter address | Until you unsubscribe |
| Server logs | Per the hosting provider's settings owner to confirm |
Who processes it for me
I use a small number of service providers. They act as processors on my instructions under a data processing agreement (GDPR art. 28). For some measurement, the ad platforms act as separate controllers under their own terms. I do not sell or rent your data to anyone.
| Role | Provider | When | Location and safeguard |
|---|---|---|---|
| Website hosting and server logs | [Hosting provider] owner to confirm | Always | [EU or EEA data centre] owner to confirm |
| Email and form delivery | [Email provider] owner to confirm | Always | [Location] owner to confirm |
| Analytics and tag management | Google Ireland Ltd (Google Analytics 4, Google Tag Manager) | Only with analytics consent | EU; Google LLC in the US under the EU-US Data Privacy Framework owner to confirm |
| Ads measurement | Google Ireland Ltd (Google Ads); Meta Platforms Ireland Ltd; Microsoft Ireland Operations Ltd; TikTok Technology Ltd | Only with ads consent | EU; US transfers under the Data Privacy Framework (Google, Meta, Microsoft) or standard contractual clauses (TikTok) owner to confirm |
| Newsletter | [Newsletter tool, if used] owner to confirm | Only if you subscribe | [Location] owner to confirm |
| Call booking | [Booking tool, if used] owner to confirm | Only if you book a call | [Location] owner to confirm |
| Bookkeeping | [Accountant or accounting software] owner to confirm | Clients only | [Location] owner to confirm |
Transfers outside the EEA
Some providers may process data in the United States or another country outside the European Economic Area. When that happens, the transfer relies on one of these safeguards:
- The EU-US Data Privacy Framework, for US companies certified under it (and its UK Extension for visitors from the UK).
- Standard contractual clauses approved by the European Commission, with any extra measures the provider applies.
Certification can change. Each provider's current listing is checked on dataprivacyframework.gov before publishing. owner to confirm You can ask me for a copy of the safeguards that apply.
Your rights
Under the GDPR you have the right to:
- see the data I hold about you and get a copy (art. 15);
- correct data that is wrong or incomplete (art. 16);
- have it deleted when there is no longer a reason to keep it (art. 17);
- restrict processing while a question is being sorted out (art. 18);
- take it with you in a common, machine-readable format (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw consent at any time, without affecting what happened before (art. 7(3)).
Email [email protected] with your request. I reply within one month. If a request is complex I may need up to two more months, and I will tell you why. I may ask you to confirm your identity first, so I do not hand your data to someone else.
How to complain
If you think your data has been handled wrongly, please tell me first so I can put it right. You also have the right to complain to a supervisory authority. In Finland that is the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), at tietosuoja.fi. You can also complain in the EU country where you live or work, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
How your data is protected
The site is served over HTTPS. Only I have access to enquiries. Accounts that hold your data use strong unique passwords and two-factor authentication, and providers are bound by data processing agreements. owner to confirm If a breach puts your rights at risk, I will tell you and the Data Protection Ombudsman as the law requires.
Changes to this policy
When the tools or purposes change, this page is updated and the date at the top changes. If the change affects what cookies do, the cookie banner asks you again. Last updated: 9 October 2026.
Questions? Email [email protected] or use the contact page.