Data controller

Aalto Films Oy (Business ID 3477879-3), operating as Aalto Visuals, Tasalankatu 14 A 2, 21200 Raisio, Finland. Contact: Miku Aalto, info@aaltovisuals.fi.

What data we collect and why

We process personal data to manage the client relationship and deliver orders (performance of a contract) and to respond to inquiries (legitimate interest). Data collected includes: contact details (name, email, phone, company) provided when ordering or contacting us, brief answers, shoot date details, contract signature details (name, timestamp and IP address for verifying the signature) and any participant photos as agreed in the contract.

For the client portal and gallery we store login data (email, password hash) and gallery events (e.g. favorites and comments) so the service can function.

Data retention

All data is stored within the EU. Client data is retained for the duration of the client relationship, and records required by the Finnish Accounting Act (invoicing) for the statutory period. Client gallery material is available for 60 days from delivery by default, unless extended storage is agreed separately.

You can request deletion of your data at any time by emailing info@aaltovisuals.fi. We delete all data that we are not legally required to retain.

Your rights

You have the right to access your data, request correction of inaccurate data, request deletion, object to processing, request restriction of processing, and receive the data you have provided in a portable format. Requests: info@aaltovisuals.fi. You also have the right to lodge a complaint with the supervisory authority (Office of the Data Protection Ombudsman, tietosuoja.fi).

Cookies and analytics

We only use strictly necessary cookies that maintain login sessions (e.g. the client portal and admin). We do not use advertising or tracking cookies, and we do not share data with third-party ad networks.

To improve the site we collect cookieless, anonymous visitor statistics (page views, most popular pages, device type and referrer). The measurement sets no cookie and does not store your IP address: visitors are identified with a daily rotating hash that cannot be linked to you or tracked across days. Bots are filtered out. You can opt out via the “Decline” option in the cookie prompt.

Processors and third parties

We use the following processors to provide the service: Supabase (database and authentication, EU region), Vercel (site hosting), Stripe (card payments, when payment features are enabled) and Resend (transactional email). We do not sell data to third parties.