Legal
Privacy Policy
This Privacy Policy explains how RhinoGraph Oy collects, uses, shares and protects personal data when you visit rhinograph.com (the "Website"), contact us, request a proposal, or work with us as a client, prospect, supplier or job applicant.
We process personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Finnish Data Protection Act (1050/2018), and the Finnish Act on Electronic Communications Services (917/2014).
Who we are (data controller)
The data controller responsible for your personal data is:
| Item | Details |
|---|---|
| Legal name | RhinoGraph Oy |
| Business ID (Y-tunnus) | 3620460-3 |
| Country of registration | Finland (registered in the Finnish Trade Register) |
| Registered address | Saariselänkuja 2 D 51, 00970 Helsinki, Finland |
| Privacy contact | privacy@rhinograph.com |
| Website | https://rhinograph.com |
| VAT number | FI36204603 |
RhinoGraph Oy is a creative and growth agency providing brand design, web design and development, motion and video production, SEO and AI search visibility services to business clients in Europe.
We have not appointed a statutory Data Protection Officer, as we are not required to under Article 37 GDPR. All privacy requests can be sent to the contact above.
Scope
This Policy applies to:
- Visitors of the Website, including campaign landing pages under rhinograph.com
- People who contact us by form, email, phone, LinkedIn or other channels
- Prospects and representatives of client companies
- Suppliers, freelancers and partners we work with
- Job applicants
- Recipients of our newsletters or marketing emails
This Policy does not cover websites we design or build for our clients. Each client is the controller of data collected on their own website and publishes its own privacy policy.
What personal data we collect
We collect only the data we need for the purposes described in this Policy. Depending on how you interact with us, this may include:
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, job title, company name, business email, phone number, LinkedIn profile URL | You (forms, email, meetings), your company, public professional sources |
| Enquiry and project data | Project brief, budget range, timeline, services of interest, messages you send us | You (Start a Project form, contact form, email) |
| Business relationship data | Contracts, proposals, invoices, payment status, meeting notes, feedback, approvals | You, your company, our project tools |
| Marketing data | Newsletter subscription status, email opens and clicks, consent records, preferences | You, our email and CRM tools |
| Website usage data | IP address, browser and device type, operating system, language, referring URL, pages visited, time on page, clicks, approximate location (city or country level) | Automatically, via cookies and analytics tools (Section 7) |
| Campaign attribution data | UTM parameters, ad click identifiers, landing page visited, form submission source, campaign name | Automatically, via hidden form fields and advertising cookies |
| Recruitment data | CV, portfolio, cover letter, work history, education, references, interview notes | You, recruitment platforms, references you name |
| Supplier data | Contact details, contract terms, bank details for payment, tax identifiers | You, your company |
We do not knowingly collect special categories of personal data (such as health, religion or political opinions) and ask you not to send them to us. The Website is intended for business use and not directed at children under 16. We do not knowingly collect data from children.
How we collect data
- Directly from you when you fill in a form on the Website, email us, book a call, sign a contract, subscribe to our newsletter, or apply for a job.
- Automatically when you browse the Website, through cookies, pixels and similar technologies described in Section 7.
- From third parties such as LinkedIn, public company registers, your employer or colleagues who introduce you, referral partners, or recruitment platforms.
- From our own systems when we generate data in the course of working together, such as project notes, invoices or performance reports.
Providing your data is voluntary. However, without your contact details we cannot answer an enquiry, send a proposal or perform a contract with you.
Why we process your data and on what legal basis
Under the GDPR we must have a legal basis for each processing activity. We rely on the bases below.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Responding to enquiries and preparing proposals | Identity, contact, enquiry data | Pre-contractual steps at your request (Art. 6(1)(b)); legitimate interest in running our business (Art. 6(1)(f)) when you act for a company |
| Delivering our services and managing client projects | Identity, contact, business relationship data | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and bookkeeping | Identity, contact, invoice and payment data | Legal obligation under the Finnish Accounting Act (1336/1997) and tax law (Art. 6(1)(c)) |
| Running and securing the Website | Website usage data, IP address, server logs | Legitimate interest in keeping the Website available and secure (Art. 6(1)(f)) |
| Website analytics and improvement | Usage data collected via analytics cookies | Legitimate interest in understanding how the Website is used and improving it (Art. 6(1)(f)), with the right to opt out at any time via the cookie settings |
| Advertising, remarketing and campaign attribution | Campaign attribution data, advertising cookie identifiers | Legitimate interest in measuring and improving our marketing (Art. 6(1)(f)), with the right to opt out at any time via the cookie settings |
| Email marketing to existing clients and B2B contacts | Identity, contact, marketing data | Legitimate interest in B2B marketing to relevant professionals (Art. 6(1)(f)), with the right to opt out at any time |
| Newsletter to subscribers | Identity, contact, marketing data | Your consent (Art. 6(1)(a)) |
| Prospecting and business development | Identity, contact, public professional data | Legitimate interest in growing our business through relevant B2B outreach (Art. 6(1)(f)) |
| CRM management and relationship history | Identity, contact, business relationship, marketing data | Legitimate interest in maintaining accurate records of our business relationships (Art. 6(1)(f)) |
| Recruitment | Recruitment data | Pre-contractual steps at your request (Art. 6(1)(b)); consent for keeping your application on file (Art. 6(1)(a)) |
| Case studies and portfolio | Client company name, project description, results, quotes from named individuals | Contract or your prior written consent for named quotes and images |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms. You can ask for a summary of that assessment and object to such processing at any time (Section 12).
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
Job applicants
We process recruitment data in line with the Finnish Act on the Protection of Privacy in Working Life (759/2004). We collect data primarily from you. If we contact a reference or run a background check, we will inform you in advance. Applications are kept for the duration of the recruitment process and, with your consent, for up to 12 months afterward for future openings.
Cookies and similar technologies
The Website uses cookies, pixels, local storage and similar technologies. Strictly necessary cookies are always active. Analytics and marketing tools load automatically when you visit the Website. You can opt out of them at any time via the Cookies link in the Website footer, oropen your cookie settings here.
| Category | Purpose | Examples of tools | Can be turned off | Typical lifetime |
|---|---|---|---|---|
| Strictly necessary | Page loading, security, load balancing, remembering your cookie choice | Hosting platform cookies, cookie consent tool | No | Session to 12 months |
| Analytics | Understanding how visitors use the Website, which pages perform, where traffic comes from | Google Analytics 4, Microsoft Clarity, HubSpot analytics | Yes | Up to 24 months |
| Marketing and advertising | Measuring campaign performance, showing relevant ads on other platforms, remarketing | Google Ads, LinkedIn Insight Tag, Meta Pixel, OpenAI Ads Pixel | Yes | Up to 24 months |
| Functional | Embedded videos, scheduling widgets, chat | YouTube or Vimeo embeds, meeting scheduler | Yes | Varies by provider |
The non-essential tools currently active on the Website are Google Analytics 4 (cookies _ga and _ga_*, lifetime up to 24 months), Microsoft Clarity, HubSpot analytics, the LinkedIn Insight Tag and the OpenAI Ads Pixel. They load automatically unless you have opted out. If you opt out, your choice is saved in your browser (rg_consent) for 6 months and these tools are not loaded.
7.1 Analytics
We use Google Analytics 4 (Google Ireland Limited) to collect aggregated statistics about Website use, and Microsoft Clarity (Microsoft Ireland Operations Limited) to understand how visitors interact with our pages through heatmaps and anonymised session replays. IP addresses are not stored by Google Analytics 4. We have configured data retention to the shortest available setting and do not share analytics data with Google for its own advertising purposes. You can also opt out using the Google Analytics opt-out browser add-on.
7.2 Forms and CRM tracking
Our forms are powered by HubSpot (HubSpot Ireland Limited). When you submit a form, HubSpot records the data you enter together with hidden fields such as the page URL, campaign parameters (UTM) and, unless you have opted out of non-essential cookies, your browsing history on the Website linked to your contact record. This helps us understand which services and campaigns you are interested in. If you opt out, we still record your form submission, but we do not link it to your browsing history.
7.3 Advertising and remarketing
Unless you have opted out, we may use advertising pixels from Google Ads, LinkedIn, Meta and OpenAI (OpenAI Ads) to measure conversions from our campaigns and to show you relevant ads on those platforms. These providers may also use the data for their own purposes as independent controllers. Their privacy policies apply: Google, LinkedIn, Meta, OpenAI.
7.4 Email tracking
Marketing emails we send may contain a tracking pixel that tells us whether you opened the email and which links you clicked. You can prevent this by disabling images in your email client, or by unsubscribing.
7.5 How to control cookies
- Use the Cookies link in the Website footer to opt out of non-essential cookies, or to turn them back on.
- Change your browser settings to block or delete cookies. Blocking strictly necessary cookies may affect how the Website works.
- Use platform-level opt-outs such as Your Online Choices for advertising cookies.
Who we share your data with
We never sell personal data. We share it only with the parties below, and only to the extent needed.
8.1 Service providers (processors)
We use trusted third-party providers who process data on our behalf under written data processing agreements (Art. 28 GDPR). Our main categories of processors are:
| Category | Provider (examples) | Location of provider | Purpose |
|---|---|---|---|
| CRM, forms and email marketing | HubSpot | Ireland / USA | Contact management, forms, marketing emails, analytics |
| Website hosting and CMS | WordPress, hosted by Namecheap | USA / EU | Serving the Website |
| Analytics | Google Analytics 4, Microsoft Clarity | Ireland / USA | Website statistics |
| Advertising platforms | Google Ads, LinkedIn, Meta | Ireland / USA | Campaign measurement and ads |
| Email and productivity | Google Workspace | Ireland / USA | Email, calendar, document storage |
| Project management | ClickUp | USA | Task and project tracking |
| Design and collaboration | Figma | USA | Design files and client review |
| Scheduling | HubSpot Meetings | Ireland / USA | Booking calls |
| Accounting and invoicing | Our Finnish accounting provider and e-invoicing operator | Finland | Bookkeeping, invoicing, payment processing |
| Payment processing | Our bank and payment providers | Finland / EU | Receiving payments |
| Recruitment | LinkedIn and recruitment platforms | Ireland / USA | Receiving applications |
8.2 Other recipients
- Freelancers and subcontractors who work on client projects with us, bound by confidentiality and data protection obligations
- Partner companies with whom we jointly deliver services, where we have told you about them
- Professional advisers such as accountants, auditors, lawyers and insurers
- Authorities such as the Finnish Tax Administration, courts, or the Data Protection Ombudsman where required by law
- A buyer or successor in the event of a merger, acquisition or sale of assets, subject to this Policy
8.3 Independent controllers
Some recipients act as independent controllers and process your data under their own privacy policies. These include advertising platforms (Google, LinkedIn, Meta) when they use conversion data for their own purposes, and banks that process payments.
International transfers
We are based in Finland and store data primarily within the European Economic Area (EEA). Some of our providers are located in, or have access from, the United States or other countries outside the EEA.
When personal data is transferred outside the EEA we make sure one of the following safeguards applies:
- Adequacy decision by the European Commission, including the EU-US Data Privacy Framework for US providers certified under it (such as Google, HubSpot, Meta and LinkedIn)
- Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where needed by additional technical measures such as encryption
- Your explicit consent for a specific transfer, in exceptional cases
You can request a copy of the safeguards in place by contacting us.
How long we keep your data
We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires.
| Data | Retention period |
|---|---|
| Inquiries that do not lead to a contract | 24 months from last contact |
| Client contracts, proposals and project files | Duration of the relationship plus 6 years, or longer if needed for legal claims |
| Invoices, receipts and accounting records | 6 years from the end of the financial year (Finnish Accounting Act); vouchers 6 years, ledgers 10 years |
| CRM contact records (prospects and B2B contacts) | 36 months from last meaningful interaction, then reviewed and deleted |
| Newsletter subscription | Until you unsubscribe; the unsubscribe record is kept to honour your choice |
| Analytics data | Up to 14 months in Google Analytics 4 |
| Advertising cookie data | Up to 24 months, as set by each advertising provider |
| Server and security logs | 12 months |
| Job applications | Duration of the recruitment process; up to 12 months with your consent |
| Case study material | For as long as the case study is published, subject to client agreement |
When the retention period ends, data is securely deleted or anonymised.
How we protect your data
We apply technical and organizational measures appropriate to the risk, including:
- Encryption of data in transit (TLS) on the Website and in the tools we use
- Access to systems restricted to team members who need it, with individual accounts and multi-factor authentication
- Confidentiality obligations for all employees, freelancers and subcontractors
- Data processing agreements with every processor
- Regular review of access rights, tools and this Policy
- A documented process for handling personal data breaches
If a data breach is likely to result in a high risk to your rights, we will notify you and the Finnish Data Protection Ombudsman as required by Articles 33 and 34 GDPR.
Your rights
Under the GDPR, you have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Access (Art. 15) | Ask whether we process your data and receive a copy of it |
| Rectification (Art. 16) | Ask us to correct inaccurate or incomplete data |
| Erasure (Art. 17) | Ask us to delete your data, where no legal obligation or overriding interest requires us to keep it |
| Restriction (Art. 18) | Ask us to limit processing in certain situations, for example while a dispute is resolved |
| Data portability (Art. 20) | Receive data you provided to us in a machine-readable format, where processing is based on consent or contract |
| Objection (Art. 21) | Object to processing based on legitimate interest. You may object to direct marketing at any time, and we will stop |
| Withdraw consent (Art. 7) | Withdraw consent at any time, including via the cookie settings or the unsubscribe link in emails |
| Lodge a complaint (Art. 77) | Complain to a supervisory authority (see Section 13) |
To exercise your rights, email us at privacy@rhinograph.com. We may ask you to verify your identity before responding. We will reply within one month. This period may be extended by two further months for complex requests, in which case we will tell you why. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.
Supervisory authority
If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Finnish supervisory authority:
Office of the Data Protection OmbudsmanTietosuojavaltuutetun toimisto
- Postal address
- P.O. Box 800, 00531 Helsinki, Finland
- Visiting address
- Lintulahdenkuja 4, 00530 Helsinki
- Telephone
- +358 29 566 6700
- tietosuoja@om.fi
- Website
- tietosuoja.fi/en
If you live in another EU or EEA country, you may also contact the supervisory authority in your own country.
Links to other websites
The Website may contain links to third-party websites, social media platforms and embedded content. We are not responsible for the privacy practices of those sites. Please read their privacy policies before providing any personal data.
Changes to this Policy
We may update this Policy from time to time to reflect changes in our services, tools or the law. We always publish the current version on the Website with its effective date. For material changes we will inform existing clients and subscribers by email or by a notice on the Website.
Contact us
For any questions about this Policy or how we handle your personal data:
RhinoGraph Oy
Business ID 3620460-3
Saariselänkuja 2 D 51
00970 Helsinki, Finland