Privacy policy

1. Data controller

Pohja Studio (Borignis OÜ)
Registration number: 16627712
Address: Maarjamõisa tee 35-9, 73501 Aravete, Estonia
Email: info@pohjastudio.fi
Phone: +358 40 054 7270

2. Contact person for privacy matters

Boris Penkin, info@pohjastudio.fi

3. Personal data we process

Through the contact form we process the following data:

• Name and email address
• Company name (optional)
• Phone number (optional)
• The content of your message
• IP address and technical log data (Supabase infrastructure)

Analytics identifiers (Google Analytics, Meta Pixel) are collected only with your consent.

If we enter into a contract with you, we also process data related to the signature. It is listed in section 5.

4. Purpose and legal basis of processing

• Responding to quote requests: legal basis is entering into a contract (GDPR art. 6(1)(b))
• Developing the website: legal basis is legitimate interest (art. 6(1)(f))
• Marketing and analytics: legal basis is consent (art. 6(1)(a))

5. Contracts and electronic signature

When we enter into a contract with you, the contract is signed in the browser. For each contract we then store the following data:

• Name and title of the signatory
• The drawn signature as an image
• Company name, business ID, VAT number and address
• The email address the contract is sent to
• E-invoicing address and operator ID, if you provide them
• The content of the contract and the time of signing
• The IP address at the time of signing and the browser version string (user agent, up to 300 characters)
• An event log: when the contract was created, sent, opened and signed, and from which IP address

The signed contract is rendered into a PDF that is emailed to you and to us. The same file is kept in non-public storage that only a logged-in administrator can access.

Legal basis. Contract data is processed in order to enter into and perform the contract (GDPR art. 6(1)(b)). The IP address, browser version string and event log are stored as evidence of who signed and when. For those, the basis is the legal obligation to retain accounting records (art. 6(1)(c)) and legitimate interest in establishing or defending against a legal claim (art. 6(1)(f)).

Retention. The contract, the signature and the event log are kept for as long as a claim based on the contract can be made or contested, and at most ten years from the end of the contract. A signed contract is not deleted before that, not even on request, because it is the evidence of what was agreed and deleting it would take the same evidence away from you as well. An unsigned draft is deleted at any time. Once the retention period ends, the data is deleted manually, because the system does not delete a signed contract automatically.

6. Retention period

Contact form data is kept for at most 2 years from the last contact. Contracts and electronic signatures are kept longer, as described in section 5. Analytics data is deleted according to Google’s and Meta’s own retention policies.

7. Recipients and transfers of data

Personal data is processed by the following sub-processors:

• Supabase Inc. (database service, USA/EU): protected by the EU–US Data Privacy Framework
• Anthropic PBC (AI service, USA): processes messages from the quote request form and the sales tool (via the Claude model). Data is not used to train models. Protected by SCCs and Anthropic’s DPA.
• Resend Inc. (email service, USA): protected by SCCs
• Vercel Inc. (hosting, USA/EU): protected by SCCs
• Google LLC (analytics, with the user’s consent)
• Meta Platforms Inc. (marketing, with the user’s consent)

Data is not disclosed to third parties for marketing purposes without your consent.

8. Your rights

You have the right to:

• Access the data stored about you (right of access)
• Request the correction of inaccurate data
• Request the deletion of your data (“right to be forgotten”)
• Restrict processing
• Have your data transferred to another controller (data portability)
• Withdraw your consent at any time
• Lodge a complaint with the competent data protection authority

The right to erasure does not cover a signed contract, the signature or its event log for as long as they are needed as evidence (section 5). Other data is deleted on request.

The controller’s lead supervisory authority is the Estonian data protection authority (Andmekaitse Inspektsioon, aki.ee). You can also contact the data protection authority of your own country of residence (Finland: tietosuoja.fi).

We respond to requests without undue delay, at the latest within 30 days. Contact: info@pohjastudio.fi

9. Cookies

We use cookies for site functionality and analytics. You can read more in our cookie policy.

10. Data security

Data is stored in an encrypted database (Supabase, AES-256 at rest, TLS 1.3 in transit). Access to the data is limited to those who need it.

11. Changes to this policy

We reserve the right to update this policy. Significant changes will be announced on the website. The current version is always available at pohjastudio.fi/en/privacy.