Privacy Policy
This policy explains what personal data we collect when you use thehandoffstudio.com, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
1. Who is responsible for your data
The data controller is:
Roman Likhachev, sole trader, operating as Handoff ("Handoff", "we", "us") — based in Finland.
Contact: [email protected]
2. What we collect
Information you give us through the contact form. When you fill in the enquiry form, we collect what you type: your name, company, email address, and the details of the problem you describe (including the free-text fields and the options you select — the tools you use, how data moves, rough budget, and timeline). Only name, email, and a short description are required; the rest are optional.
Technical information. To protect the form from abuse, our server briefly holds your IP address in memory to rate-limit submissions. It is not written to disk and is discarded automatically within minutes.
A record of your enquiry. Each submission is stored so we can respond to it — in our CRM (see sub-processors below) and in an internal audit log on our server.
What we do not do. This site sets no cookies, uses no analytics, advertising, or tracking of any kind, and loads no third-party scripts. Our fonts are self-hosted, so simply visiting the site sends your data to no one. That is why you will not see a cookie banner — there is nothing to consent to.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Respond to your enquiry and prepare a quote or plan | Steps taken at your request prior to a contract (Art. 6(1)(b)), and our legitimate interest in answering prospective clients (Art. 6(1)(f)) |
| Keep a record of enquiries and follow-ups | Legitimate interest in running our business (Art. 6(1)(f)) |
| Protect the form from spam and abuse (rate limiting) | Legitimate interest in the security of our service (Art. 6(1)(f)) |
4. Who we share it with
We do not sell your data. We use a small number of trusted service providers ("sub-processors") to run the enquiry pipeline. Each processes your data only on our instructions, under a data processing agreement:
| Provider | What it does | Location |
|---|---|---|
| Hetzner | Hosting (the server this site runs on) | EU (Germany / Finland) |
| Notion Labs, Inc. | Stores your enquiry as a CRM record | USA |
| Slack (Salesforce, Inc.) | Notifies our team of a new enquiry | USA |
| Resend | Sends notification email (only if email delivery is enabled) | USA |
| OpenAI, L.L.C. | AI summary of your enquiry (only if AI triage is enabled) | USA |
5. International transfers
Some of the providers above are in the United States. Where your data is transferred outside the EU/EEA, that transfer is protected by appropriate safeguards — the providers are either certified under the EU–US Data Privacy Framework or covered by the European Commission's Standard Contractual Clauses.
6. How long we keep it
We keep enquiry data for as long as needed to respond and, if we work together, for the duration of our business relationship and any period required by law (e.g. accounting rules). If nothing comes of an enquiry, we delete it during periodic clean-ups. You can ask us to delete it sooner at any time (see your rights below).
7. Your rights
Under the GDPR you have the right to: access the data we hold about you; correct it; have it erased; restrict or object to our processing; receive it in a portable format; and, where processing is based on consent, withdraw that consent. To exercise any of these, email [email protected] and we will respond within one month.
If you believe we have handled your data improperly, you have the right to complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), at tietosuoja.fi/en.
8. Security
The site is served over HTTPS. We limit access to enquiry data to the people who need it and rely on the security measures of the reputable providers listed above.
9. Children
This site and service are intended for businesses and are not directed at children under 16.
10. Changes
We may update this policy as the service changes. The "last updated" date at the top always reflects the current version.
11. Contact
Questions about this policy or your data? Email [email protected].