This Privacy Policy describes how Suvianna.com collects, uses, stores, and protects personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish data protection legislation.
1. Data Controller
Devcraft Oy is the registered data controller for personal data processed through suvianna.com. Devcraft Oy is a Finnish limited liability company operating under the brand name Suvianna.com.
Business ID: 3428981-8
Website: suvianna.com
2. Contact Person for Privacy Matters
Suvianna Grecu
Email: suvianna@suvianna.com
For any questions regarding this Privacy Policy or the processing of personal data, please contact us using the email address above.
3. Legal Bases and Purposes of Processing Personal Data
We process personal data in accordance with the GDPR on the following legal bases: the performance of a contract or steps taken prior to entering into a contract; compliance with legal obligations; the legitimate interest of the data controller; and the data subject’s consent, where explicitly required.
The main purposes of processing personal data are: responding to contact requests and inquiries; providing consulting, advisory, speaking, training, content, and other professional services; managing client, partner, and collaboration relationships; sending newsletters and marketing communications where consent has been given; handling invoicing, accounting, and legal obligations; and managing recruitment, collaboration, media, or event-related communications.
We do not use personal data for automated decision-making or profiling that would produce legal or similarly significant effects for the data subject.
4. Personal Data Registers and Categories of Data Processed
Client, Inquiry and Service Register
This register consists of personal data collected when a person contacts us, requests information, books a consultation, purchases services, or collaborates with us. Data processed may include name, email address, phone number, company, job title, billing information, communication history, and information related to inquiries, proposals, projects, or services. The legal basis is contract performance, legitimate interest, and compliance with legal obligations.
Marketing and Newsletter Register
This register consists of personal data collected from newsletter subscriptions, event registrations, downloadable materials, and similar contexts. Data processed may include name, email address, company, job title, and marketing preferences. The legal basis for processing this data is the data subject’s consent. The data subject has the right to withdraw consent and unsubscribe at any time, without this affecting the lawfulness of processing carried out prior to withdrawal.
Website and Analytics Data
When you visit the website, certain technical data may be collected through cookies, analytics tools, and hosting services, including IP address, browser type, device type, pages visited, and visit duration. The legal basis is legitimate interest for technically necessary data and consent for non-essential cookies where required by law.
Recruitment, Media, Event, and Collaboration Register
This register may include personal data received from job applicants, collaborators, media contacts, event organizers, partners, or sponsors. The legal basis is consent, legitimate interest, pre-contractual measures, or contract performance, depending on the situation.
5. Regular Sources of Personal Data
Personal data is primarily collected directly from the data subject — for example when a person fills in a contact form, subscribes to a newsletter, books a consultation, purchases services, communicates by email or other channels, or participates in events.
Personal data may also be collected from publicly available sources such as LinkedIn or company websites, to the extent relevant to professional communications. Where data is collected from such sources, we inform the data subject within the timeframe required by applicable law.
6. Recipients and Processors of Personal Data
We do not sell or disclose personal data to third parties for their own independent purposes.
Personal data may be processed by trusted service providers acting as data processors on behalf of Devcraft Oy — such as website hosting providers, email and newsletter platforms, CRM systems, payment and invoicing services, accounting services, analytics tools, and IT service providers. These providers process personal data only as necessary and under data processing agreements complying with applicable data protection requirements.
Personal data may also be disclosed to authorities where required by applicable law, court order, or other legally valid obligation.
7. Transfer of Personal Data Outside the EU or EEA
Where possible, we use service providers located within the European Union or European Economic Area. In some cases, personal data may be transferred outside the EU/EEA if service providers are located or use servers there. Any such transfers are carried out with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or other legally approved transfer mechanisms.
8. Cookies
We use cookies and similar technologies on our website. Some cookies are necessary for the technical operation of the website and may be used without separate consent. For non-essential cookies — such as analytics or marketing cookies — we request your consent where required by law. You may accept, reject, or manage your cookie preferences through the cookie settings on the website at any time.
9. Rights of the Data Subject
As a data subject, you have the following rights under the GDPR: the right to access your personal data; the right to request correction of inaccurate data; the right to request deletion; the right to request restriction of processing; the right to object to processing based on legitimate interest; the right to object to direct marketing at any time; the right to withdraw consent at any time; the right to data portability; and the right to lodge a complaint with a supervisory authority.
To exercise any of these rights, please send a written request to the contact email listed in this Privacy Policy. We will respond within the timeframe required by the GDPR, ordinarily within one month.
You have the right to lodge a complaint with the supervisory authority in your EU country of residence, habitual place of work, or where an alleged infringement occurred. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu, www.tietosuoja.fi).
10. Retention and Protection of Personal Data
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by applicable law:
- Client, service, and billing-related data — retained for the duration of the client relationship and a minimum of six years thereafter, as required by Finnish accounting legislation (Kirjanpitolaki).
- Marketing and newsletter data — retained until the person withdraws consent or requests deletion.
- Inquiry and communication data — typically no longer than three years from the last contact.
- Recruitment or collaboration-related data — retained only as long as necessary for the relevant process.
Personal data that is no longer needed will be deleted or anonymized without undue delay. We protect personal data through appropriate technical and organizational measures including access control, secure systems, and limited user rights.
11. Updates to This Privacy Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website.
This Privacy Policy was last updated on 1 June 2026.