Privacy policy
This policy explains how Brevixoo processes personal data in connection with the use of the brevixoo.com website and enquiries sent to us. It has been prepared in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (EU) 2016/679, hereinafter the GDPR.
Last updated 8 November 2026
1.Controller
The controller is Brevixoo, Fredrikinkatu 48, 00100 Helsinki, Finland. Email: legal@brevixoo.com. Brevixoo is an independent startup and the controller of this website. The University of Helsinki is not responsible for its content.
Please send any enquiries concerning data protection to privacy@brevixoo.com.
2.Scope and applicable law
This policy applies to the brevixoo.com website, its contact form and messages received by email. Personal data is processed in accordance with the GDPR, the Finnish Data Protection Act (tietosuojalaki 1050/2018) and other applicable Finnish legislation.
The website is a knowledge portal. We do not provide payment services and we do not process payment data, online banking credentials or account information.
3.Personal data processed
We process the following categories of data:
- Contact details: the name and email address you provide via the contact form or by email.
- Message content: the topic you select and the text of your message, as well as any attachments to email messages.
- Technical data: IP address, browser and operating system type, requested page, referring page and timestamp in the server log files.
- Cookie data: session identifier and your cookie choice; see the cookie policy.
We do not request, and do not knowingly process, special categories of personal data within the meaning of Article 9 GDPR. Please do not include such data in your messages.
4.Sources of data
We obtain data primarily directly from you when you contact us. Technical data is generated automatically when your browser connects to our server. We do not obtain personal data from third parties.
5.Purposes and legal bases of processing
We process personal data only for the purposes listed below and on the legal bases specified for them:
| Processing activity | Purpose | Legal basis |
|---|---|---|
| Contact form and email | Responding to questions, correction suggestions and enquiries | Legitimate interests, Art. 6(1)(f) GDPR |
| Server log files | Technical operation of the website, information security and investigation of misuse | Legitimate interests, Art. 6(1)(f) GDPR |
| Strictly necessary cookies | Protecting the form and remembering your cookie choice | Legitimate interests; strict necessity under the Act on Electronic Communications Services |
| Optional cookies | Visitor statistics for content development, if introduced | Consent, Art. 6(1)(a) GDPR |
| Handling legal claims | Establishment, exercise or defence of legal claims | Legitimate interests, Art. 6(1)(f) GDPR |
| Statutory obligations | Responding to requests for information from authorities and bookkeeping | Legal obligation, Art. 6(1)(c) GDPR |
For processing based on legitimate interests, we have assessed that our interest in responding to enquiries and maintaining a secure website does not override your rights, provided that processing is limited to what is necessary.
6.Recipients and processors
We do not sell or rent personal data. Data may be processed on our behalf by service providers we need to operate the website and our communications, such as hosting and email service providers. They act as processors within the meaning of Article 28 GDPR and process data only in accordance with our instructions.
We may disclose data to authorities where required by law.
7.Transfers of data outside the EU and EEA
We aim to process data within the EU or EEA. If a service provider we use transfers data outside this area, we ensure that the transfer is based on a mechanism under Chapter V GDPR, such as an adequacy decision of the European Commission or the standard contractual clauses adopted by the Commission (Decision (EU) 2021/914), supplemented by any necessary additional safeguards.
8.Retention periods
We retain data only for as long as necessary for the purpose of processing:
| Data category | Retention period |
|---|---|
| Enquiries and messages | Up to 24 months from the last contact, unless handling the matter requires longer retention |
| Server log files | Up to 90 days, unless the investigation of a security incident requires longer retention |
| Cookie choice | Up to 12 months or until you delete it |
| Accounting records | In accordance with the Finnish Accounting Act (kirjanpitolaki), if data is included in the accounts |
9.Your rights as a data subject
Under Articles 15–22 GDPR you have the following rights:
- Right of access (Article 15): you may request confirmation as to whether we process your data and obtain a copy of it.
- Right to rectification (Article 16): you may request that inaccurate or incomplete data be corrected.
- Right to erasure (Article 17): you may request the erasure of your data when there is no longer a basis for processing it.
- Right to restriction of processing (Article 18): you may request that processing be restricted, for example while the accuracy of the data is being verified.
- Right to data portability (Article 20): where processing is based on consent or a contract and is carried out by automated means.
- Right to object (Article 21): you may object to processing based on legitimate interests on grounds relating to your particular situation.
- Right to withdraw consent (Article 7(3)): you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
10.Exercising your rights
You can exercise your rights by sending a request to privacy@brevixoo.com. We may ask for additional information to verify your identity. We will respond to your request without undue delay and at the latest within one month; in accordance with Article 12 GDPR this period may be extended by two further months where necessary. Requests are handled free of charge unless a request is manifestly unfounded or excessive.
11.Information security
In accordance with Article 32 GDPR, we protect personal data with technical and organisational measures appropriate to the risk, such as:
- An encrypted HTTPS connection (TLS 1.2 or later) for all website traffic.
- Protection of the form with a CSRF token and spam protection.
- Restricting access rights to those who need the data in their duties.
- Regular software updates and security headers.
12.Personal data breaches
If a personal data breach occurs, we will notify the Data Protection Ombudsman within 72 hours in accordance with Article 33 GDPR, unless the breach is unlikely to result in a risk. If the breach is likely to result in a high risk to your rights, we will also notify you in accordance with Article 34.
13.Automated decision-making and profiling
We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you, and we do not profile users of the website.
14.Children
The website is intended for adult professionals, students and others interested in the subject. We do not knowingly collect personal data from children under the age of 13. If you notice that a child has sent us personal data, please contact us and we will delete it.
15.Voluntary provision of data
Providing personal data is voluntary. However, the mandatory fields of the contact form are necessary for us to be able to reply to your message. Browsing the website does not require you to provide personal data, apart from technically necessary log data.
16.Changes to this policy
We may update this policy if our processing activities or the legislation change. The date of the update is shown at the top of the page. We will announce significant changes on the website.
17.Supervisory authority
If you consider that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto, tietosuoja.fi). You may also lodge a complaint with the supervisory authority of the Member State of your habitual residence or place of work.
18.Contact details
Questions and requests concerning data protection: privacy@brevixoo.com. Postal address: Brevixoo, NEXUS, Fredrikinkatu 48, 00100 Helsinki.