Privacy Policy
Last updated: 8 May 2026
Data controller
The controller of your personal data under the EU General Data Protection Regulation (GDPR, 2016/679) is:
Mariia Solodiankina (private entrepreneur, trading as Elven Crafts)
Y-tunnus (business ID): 3603623-2
Lehmihaka 2 A 3, 01360 Vantaa, Finland
Email: contact@elvencrafts.eu
What data we collect and why
We only collect personal data that you voluntarily provide. Each processing activity has a lawful basis under GDPR Article 6.
| Source | Data | Legal basis | Retention |
|---|---|---|---|
| Inquiry form (/team-event) | Name, email, phone, company, event details | Art. 6(1)(b) — pre-contract measures at your request | 12 months after the last contact; 6 years if a booking occurs (Finnish Accounting Act) |
| Creator application (/join) | Name, email, city, craft type, languages, portfolio link, experience, message, terms consent | Art. 6(1)(b) — pre-contract measures | 24 months, or until you request deletion |
| Direct emails | Whatever you include in your message | Art. 6(1)(f) — legitimate interest in responding | 24 months after the last reply |
| Server logs (Hostinger) | IP address, browser type, timestamp, requested URL | Art. 6(1)(f) — legitimate interest in security | 30 days (hosting provider default) |
| Cloudflare Web Analytics | Aggregated page views, referrer, truncated IP | Art. 6(1)(f) — legitimate interest in understanding site usage to improve service | Aggregated only; no individual records retained |
| Cookie consent choice | Boolean preference stored locally | Art. 6(1)(a) — consent | 12 months |
Cookies and tracking
This site uses only essential cookies required for the site to function (for example, remembering your cookie consent preference). We do not use advertising cookies or tracking cookies. We do use one privacy-focused analytics tool (Cloudflare Web Analytics) that measures aggregate site usage without setting cookies and without identifying individual visitors. See the processor list below.
Third-party service providers
The following providers process data on our behalf. We have entered into, or rely on, the relevant data processing terms with each of them.
- Brevo (Sendinblue SAS) (France, EU) — processes web form submissions from /team-event, /join, and the Danish /da/book-event page. Sends the submission as a transactional email to contact@elvencrafts.eu. Brevo is a French company with servers in the EU; no non-EU transfer is involved in this flow. Brevo's Data Processing Addendum is incorporated into their Terms of Service.
- Hostinger International Ltd. (Lithuania, EU) — website hosting. Keeps standard server logs for security.
- Cloudflare, Inc. (United States, EU data centres for ingestion) — provides cookieless web analytics and hosts the Elven Crafts form-handling Worker (a lightweight proxy that validates form submissions and forwards them to Brevo). Collects aggregated page views, referrer, and truncated IP for analytics. The Worker processes form fields only for the duration of one HTTP request and does not persist any personal data. Cloudflare also operates the
/beaconendpoint on our Cloudflare Worker, which captures the same aggregated visit data (truncated IP, user agent, country, page URL, referrer, timestamp) for sites where Cloudflare's hosted Web Analytics beacon is unavailable. No cookies are set; no individual user is identified. Cloudflare's standard Data Processing Addendum is incorporated into the Self-Serve Subscription Agreement we are bound by and includes the Standard Contractual Clauses for international transfers. The DPA text is public at cloudflare.com/cloudflare-customer-dpa. - Mailgun / Squarespace Domains (United States) — email routing for the contact@elvencrafts.eu address. Same third-country transfer notice as above applies.
International data transfers
Most processors listed above are in the EU. Two are located in the United States — specifically Cloudflare and Mailgun / Squarespace Domains. Where transfers outside the European Economic Area take place, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework (where the provider is certified) as the transfer mechanism, as described in GDPR Articles 45-46.
Automated decision-making
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you (GDPR Article 22).
Your rights under GDPR
You have the right to:
- access your personal data (Art. 15)
- have inaccurate data corrected (Art. 16)
- have your data erased (Art. 17)
- restrict processing (Art. 18)
- data portability (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw consent where processing is based on consent, at any time, without affecting the lawfulness of processing already performed
To exercise any of these rights, email contact@elvencrafts.eu. We respond within 30 days. We may ask you to confirm your identity from the email address originally used. If we cannot act on your request, we will explain why.
Personal data breaches
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Finnish Data Protection Ombudsman within 72 hours of becoming aware of it. Where the risk to you is high, we will also notify you directly, as required by GDPR Articles 33-34.
Complaints
If you believe we have not handled your data correctly, you can lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):
Tietosuojavaltuutetun toimisto
PL 800, 00531 Helsinki, Finland
tietosuoja.fi
Changes to this policy
We may update this policy to reflect changes in our practices or in applicable law. The "last updated" date at the top of this page shows when the policy was last changed. Material changes will also be communicated via the website.
Contact
For any privacy-related question or to exercise your rights, contact us at contact@elvencrafts.eu.