This policy describes how personal data is handled on the website mikakeskitalo.com. It is based on the site’s actual, measured behaviour.

1. Data controller

Qevinto Oy (Business ID 3583823-3) Sarkakatu 3, 96460 Rovaniemi, Finland Contact person: Mika Keskitalo Data protection enquiries: mika@mikakeskitalo.com, +358 40 579 4532

Qevinto Oy provides photography and videography services at mikakeskitalo.com and also maintains the website. “Ecomse” in the footer is Qevinto Oy’s own brand, not an external provider.

2. Personal data processed, and the basis for processing

Contact form

Data: first name, last name, email address and your message, plus the address of the page the form was sent from.
Purpose: responding to your enquiry.
Legal basis: pre-contractual steps taken at your request (GDPR Art. 6(1)(b)) and legitimate interest in responding to your enquiry (Art. 6(1)(f)).
Recipients: the message is emailed to Mika Keskitalo. The mailbox (mika@mikakeskitalo.com) is hosted on Google (Gmail), so contact messages are stored on Google Ireland Limited’s servers; Google may transfer data to the United States under the EU–US Data Privacy Framework. Google is therefore a processor for both email and analytics, but for distinct purposes. The form service itself stores no messages (no database); the message remains in the mailbox.
IP address: to prevent spam and abuse, the sender’s IP address is held in memory for at most one hour. It is not written to disk and not included in the email.
Retention: email messages for at most 2 years from the last contact; the anti-spam IP for at most ~1 hour.

Data: a randomly generated identifier (in the _ga cookies), the pages you visit, screen size, and browser language/version. No name, email, or other directly identifying data is sent to analytics.
Purpose: measuring and improving use of the site.
Legal basis: your consent (GDPR Art. 6(1)(a)). Analytics loads only if you accept it in the cookie banner. If you decline or make no choice, analytics is not loaded at all.
Recipient: Google Ireland Limited (GA4 measurement ID G-8Y7GPVH5GV). Google may transfer data to the United States under the EU–US Data Privacy Framework.
Retention: on Google’s side 14 months; the _ga cookies last about 13 months (400 days) in the browser.

Call button

The site has a floating call button that is simply a telephone link (tel:). It loads nothing from outside, sets no cookies, and transmits no data to third parties; tapping it opens your device’s phone app.

Embedded video

The home-page video loads from YouTube only when you click play. Before you click, nothing is sent to YouTube or Google.
When you click, the video loads from the privacy-preserving youtube-nocookie.com; at that point Google may receive your IP address and device information.
Legal basis: your consent (clicking play) / legitimate interest in showing the content.

Server logs

The server records for each request the IP address, timestamp, requested URL, status code, browser (User-Agent) and referring page.
Purpose: security and technical operation of the service.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
Retention: 30 days; server log rotation removes older entries automatically.
The server environment is provided by UpCloud (Finland).

3. Cookies and browser storage

Cookie / key	Set when	Party	Duration	Purpose
`mk_consent` (cookie + localStorage)	when you Accept or Decline	First party	12 months	Stores your cookie choice so the banner isn’t shown again. Essential.
`_ga`	Accept only	First party	~13 months	Google Analytics visitor identifier
`_ga_8Y7GPVH5GV`	Accept only	First party	~13 months	Google Analytics session state

If you decline or make no choice, the only cookie set is mk_consent, which stores that choice. No analytics cookies are set without consent, and the site sets no advertising, tracking or other third-party cookies.

Fonts are served from our own server; no third-party font services (e.g. Google Fonts) are used. Language selection is based on the URL and sets no cookie.

4. What we do not do

We do not profile visitors and make no automated individual decisions.
We do not target advertising and use no advertising cookies. (Google Ads, previously used, has been removed.)
We do not sell or rent personal data.

5. Photography clients’ personal data

For photography and videography clients, we process contact details and billing information in order to carry out the assignment. The legal basis is a contract (GDPR Art. 6(1)(b)). Accounting records are retained for 6 years in accordance with the Finnish Accounting Act.

The portfolio contains client work (real-estate and property photography). No identifiable third party appears in any portfolio image. The only identifiable person on the site is the photographer himself (on the About page).

6. Your rights

You have the right to: access the data held about you, rectify inaccurate data, erase your data, restrict or object to processing, receive your data in a portable form, and withdraw consent at any time (withdrawal does not affect processing carried out before it).

Send requests to mika@mikakeskitalo.com. You can change your cookie choice at any time via the “Cookie Settings” link in the footer.

If you believe your personal data is processed unlawfully, you may lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman of Finland (tietosuoja.fi).

7. Security

The site is served over an encrypted HTTPS connection. The contact form is protected by spam and abuse controls. Access to email and the server environment is appropriately restricted.

8. Changes to this policy

We update this policy when necessary, for example when services or legislation change. Last updated: 12 July 2026.