PRIVACY POLICY

Last updated 26.10.2026

This policy explains how Slope Graphics processes personal data in accordance with the EU General Data Protection Regulation (GDPR, 2016/679) and the Finnish Data Protection Act (1050/2018).

Slope Graphics is a graphic design business operated by Uproof Oy. This policy applies to our clients, prospective clients, partners and subcontractors, and to users of our website www.slopegraphics.fi and our social media channels.

This policy does not cover information you provide to other services, such as Instagram or LinkedIn. Those services' own privacy policies apply.

1. Data controller and contact details

Data controller: Uproof Oy (Slope Graphics)

Business ID: 3132756-7

Contact person for privacy matters: Rosa Vuorela

Email: rosa@slope.fi

Phone: +358 44 303 8351

You can send any privacy-related questions and requests to the email address above.

2. What data we process

We only collect data we need for the purposes described below.

Clients and prospective clients

name, company and position (e.g. the person responsible for marketing)
contact details: email, phone number, address
information related to assignments, such as quotes, orders and messages
billing information, such as billing address, invoice amounts and payment terms
marketing consent or opt-out
newsletter subscription details
information visible on public social media profiles when you contact us through them

Partners and subcontractors

name, company and contact details
information related to assignments and billing

Website users

information you submit through the contact form
technical data, such as IP address, browser, device and website usage data (see section 7)

We do not process credit information or retrieve data from the Finnish Population Information System. We do not store payment card details.

3. Purposes and legal bases

Each processing activity has its own legal basis under Article 6 of the GDPR.

Preparing quotes, carrying out assignments and managing client relationships

Legal basis: contract or pre-contractual measures

Invoicing and accounting

Legal basis: legal obligation (Finnish Accounting Act)

Cooperation with subcontractors and partners

Legal basis: contract or legitimate interest (managing the cooperation)

Contacting prospective business clients and marketing to existing clients

Legal basis: legitimate interest (marketing our own business)

Newsletter

Legal basis: consent

Responding to contact form messages

Legal basis: legitimate interest (responding to enquiries) or pre-contractual measures

Website security and strictly necessary cookies

Legal basis: legitimate interest (website functionality and security)

Visitor analytics and non-essential cookies

Legal basis: consent

Where processing is based on legitimate interest, we have assessed that it is necessary and does not override your rights. You may object to such processing (see section 9).

To carry out an assignment, we need your contact and billing details; without them we cannot enter into a contract with you. Providing any other information is voluntary.

We do not make automated decisions or profile individuals.

4. Sources of data

We mainly receive data directly from you: through the contact form, email, phone, social media messages, meetings and contracts.

We may also collect contact details of company and organisation representatives from public sources, such as company websites and business information services.

5. How long we keep data

We keep data only for as long as it is needed and delete it when the retention period ends.

Client, partner and marketing data

Retention period: 4 years from the end of the client relationship or the last contact

Invoices and other accounting records

Retention period: 6 years from the end of the financial year (Finnish Accounting Act)

Books of account

Retention period: 10 years from the end of the financial year (Finnish Accounting Act)

Newsletter subscriber data

Retention period: until you unsubscribe

Contact form messages that do not lead to a client relationship

Retention period: 4 years from receipt of the message

Marketing opt-outs

Retention period: for as long as the opt-out is in effect

6. Who receives data and transfers outside the EU

We do not sell or rent your data. We use trusted service providers that process data on our behalf and according to our instructions:

website hosting and publishing service
cloud storage and project management services
newsletter service
social media services, such as Instagram and LinkedIn

We will provide more details about the services we use on request.

In addition, data may be disclosed to:

our accountant and other professional advisers
authorities, where required by law

Transfers outside the EU. Some service providers may process data outside the EU and EEA, for example in the United States. In such cases, the transfer is based on the EU–US Data Privacy Framework, the European Commission's standard contractual clauses or a Commission adequacy decision.

7. Cookies and analytics

Cookies are small text files stored on your device when you visit a website.

Strictly necessary cookies are required for the website to function and stay secure. They are used without separate consent.
Analytics cookies are used only with your consent. We use only Wix's built-in visitor analytics, not analytics or advertising tools from other providers. Analytics shows us, for example, which pages are visited and which countries visitors come from.

You can give or withdraw your consent at any time in the website's cookie settings. You can also block or delete cookies in your browser settings.

8. How we protect your data

We protect data with appropriate technical and organisational measures:

accounts are protected with strong passwords and two-factor authentication wherever the service allows it
data is stored in reliable cloud services with appropriate security
access to data is limited to those who need it for their work
data is backed up
the website connection is encrypted (HTTPS)
we do not process payment card details

If a data breach affecting your data is likely to pose a risk to you, we will notify you and the Data Protection Ombudsman as required by law.

9. Your rights

Under the GDPR, you have the right to:

access the data we hold about you and receive a copy of it
rectify inaccurate or incomplete data
erase your data when there is no longer a basis for processing it
restrict the processing of your data, for example while the accuracy of the data is contested
data portability, meaning to receive the data you have provided in a machine-readable format or have it transferred to another controller, where processing is based on consent or contract
object to processing based on legitimate interest. You can always object to the use of your data for direct marketing.
withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

How to exercise your rights. Send your request by email to rosa@slope.fi. We may ask for additional information to verify your identity. We will respond within one month at the latest. You can also unsubscribe from the newsletter using the link at the end of each message.

Right to lodge a complaint. If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en).

10. Client projects and changes to this policy

Data processed on behalf of our clients. When we create or maintain websites or marketing materials for our clients, we may process personal data of our clients' customers or employees. In these cases, we act as a data processor and our client is the data controller. Such processing is agreed separately with the client, and this policy does not apply to that data.

Changes. We update this policy when our operations or the law change. The current version and its update date are always available on our website.