GDPR

Data controller

Verrixa Point · Korvatunturintie 2 00970 Helsinki, Finland
Email: [email protected]

What data we collect

• Account data: name, email, password hash.
• Subscription and payment data: Premium plan type and status, the payment provider's transaction ID and the last four digits of the card for the receipt. We never process full card numbers or CVC codes.
• Billing data: receipt number, billing address and VAT ID if provided.
• Technical data: your language choice and cookie-notice choice stored in your browser.

We do not store location data, IP addresses for tracking or biometric data.

Legal basis for processing

• Contract (GDPR Art. 6(1)(b)) — user account, delivering Premium and billing.
• Legal obligation (Art. 6(1)(c)) — retaining accounting records under Finnish accounting law.
• Consent (Art. 6(1)(a)) — newsletters and non-essential cookies.
• Legitimate interest (Art. 6(1)(f)) — service security and preventing abuse and payment fraud.

Retention

Your account is kept until you ask us to delete it. Accounting records are kept for 6 years from the end of the financial year as required by law. Login logs are kept for 90 days.

Your rights

• Request access to your data.
• Request correction or deletion.
• Object to processing or request its restriction.
• Lodge a complaint with the Office of the Data Protection Ombudsman.

To exercise your rights: [email protected]. We reply within 30 days.

Data transfers

Servers are located in the EU/EEA. Payments are handled by a PCI DSS certified payment provider that may transfer data outside the EU only on the basis of the EU Standard Contractual Clauses or equivalent adequate safeguards. Transactional emails are sent via EU-based email services.