GDPR

How we process your personal data under the General Data Protection Regulation (EU 2016/679).

Data controller

Luvendo Media
Teikankaantie 330, 39530 Kilvakkala, Finland
Tel. 03 4587656 · [email protected]

What data we collect

Account data: name, email address, password hash.
Subscription and payment data: Premium plan type and status, payment provider transaction ID, the last four digits of the card for receipts. We never process full card numbers or CVC codes.
Billing data: receipt number, billing address and VAT ID if provided.
Technical data: cookies to remember your language and keep your session.

We do not store location data, IP addresses for tracking purposes or biometric data.

Legal basis for processing

Contract (GDPR Art. 6(1)(b)) — user account, delivering the Premium subscription and billing.
Legal obligation (Art. 6(1)(c)) — retention of accounting records under the Accounting Act.
Consent (Art. 6(1)(a)) — newsletters and non-essential cookies.
Legitimate interest (Art. 6(1)(f)) — service security, prevention of abuse and payment fraud.

Retention period

Your account is kept until you ask us to delete it. Accounting records (receipts, transaction IDs) are kept for 6 years from the end of the financial year as required by the Accounting Act. Login logs are kept for 90 days.

Your rights

Request access to your data.
Request rectification or erasure.
Object to processing or request its restriction.
Lodge a complaint with the Office of the Data Protection Ombudsman.

To exercise your rights: [email protected]. We respond within 30 days.

Data transfers

Our servers are located in the EU/EEA. Payments are processed by a PCI DSS certified payment provider, which may transfer data outside the EU/EEA only on the basis of the EU Standard Contractual Clauses (SCC) or another GDPR-compliant transfer mechanism. Transactional emails are sent through EU-based email services.