Privacy
A plain-language privacy notice under Article 13 of the GDPR.
1. Data controller
National Data Media Oy
Porilaistie 1, 27800 Säkylä, Finland
Business ID 3312457-8 · 029 9800 · [email protected]
Send privacy questions to [email protected] (subject: Privacy). We reply within 30 days.
2. Personal data we process
- Account data: name, email address and password hash.
- Subscription data: Premium plan type, status, and start and end dates.
- Payment data: the transaction ID received from the payment provider, the payment method and the last four card digits for receipts. Full card details are handled exclusively by the payment provider.
- Billing data: receipt number, billing address and VAT ID if you provide them.
- Technical data: cookie choice and the data needed to keep a session alive.
- Logs: sign-in time and IP address for security purposes (90 days).
We do not collect location data, profiling data or advertising-tracking data.
3. Purposes and legal bases
- Contract: account, sign-in, delivering Premium and billing.
- Legal obligation: keeping accounting and tax-related records.
- Consent: newsletter and optional storage — you can withdraw consent at any time.
- Legitimate interest: security and preventing misuse. We do not profile users.
4. Retention periods
- Account data: for the life of the account, at most 30 days after a deletion request.
- Accounting records: six years from the end of the financial year.
- Sign-in logs: 90 days.
- Newsletter subscription: until you unsubscribe.
- Browser storage: see the cookie policy.
5. Recipients and transfers
We never sell, rent or share personal data for marketing. We use carefully selected processors such as a payment provider, an EU/EEA hosting provider and an email delivery service. Agreements under Article 28 of the GDPR are in place with all of them.
6. Your rights
- Right of access and right to rectification.
- Right to erasure and to restriction of processing.
- Right to data portability.
- Right to object and to withdraw consent.
- Right to lodge a complaint with the Data Protection Ombudsman.
7. Automated decision-making
We make no automated decisions that would have legal or similarly significant effects on you.
8. Security
Passwords are stored only as hashes, traffic is encrypted and repeated failed sign-in attempts lock the account temporarily.
9. Changes
We update this notice when needed. Registered users are told about material changes at least 14 days in advance.