PRIVACY POLICY
Last updated 20 October 2026
1. Data controller
EIJ Creative, auxiliary business name Sykli
Business ID 3411523-6
Email hello(a)sykli.io
No data protection officer has been appointed. Article 37 of the General Data Protection Regulation does not require one for this activity.
2. What information we collect and where it comes from
We receive all information directly from you.
Contact form. First name, last name, email address, preferred starting time and the content you enter in the message field. Providing a phone number is optional.
The message field is free text. If you voluntarily share information about your health, such as your cycle, symptoms, contraception or plans for pregnancy, we process it as described in section 3. You do not have to share such information at this stage. A brief description of what you hope to gain from guidance is sufficient.
Email. Message content and contact details if you contact us directly by email.
Free 15-minute introductory call. The conversation is not recorded and no notes are taken. We do not document any information shared during the introductory call.
Website use. Described in a separate cookie policy.
3. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and preparing a potential client relationship | Steps taken at your request prior to entering into a contract, Article 6(1)(b) |
| Health-related information you voluntarily provide in the message field | Your explicit consent, Article 9(2)(a). You give this through the checkbox on the form. |
| Website analytics | Your consent, Article 6(1)(a), and section 205 of the Finnish Act on Electronic Communications Services (917/2014) |
| Handling a legal claim, should one arise | Our legitimate interest in defending against a claim, Article 6(1)(f), and for special categories of data, Article 9(2)(f) |
We do not make automated decisions or profile you.
4. Providing information
Your name and email address are necessary for us to respond to you. Without them, we cannot process your enquiry. Providing other information is optional, and not providing it does not affect how we respond to your enquiry.
Sharing health-related information is voluntary. You may withdraw your consent at any time, after which we will delete that information.
5. Recipients
We do not sell data or disclose it for marketing purposes. The following service providers process data on our behalf under data processing agreements in accordance with Article 28 of the GDPR.
| Recipient | Purpose |
|---|---|
| Email, calendar and file service provider | Receiving and storing enquiries |
| Cloudflare | Website delivery and security |
| Google Ireland Limited | Google Analytics 4, only with your consent |
We may also disclose information to authorities where required by law.
6. Transfers outside the EU and EEA
Some of our service providers process data in the United States or may provide access to data from there. Transfers are based on a European Commission adequacy decision recognising that the EU–US Data Privacy Framework provides an adequate level of data protection, or on standard contractual clauses approved by the Commission and supplementary safeguards. Further information about transfer safeguards is available on request.
7. Retention period
Contact form and email information is deleted within 12 months of the enquiry if no client relationship is established. We delete information sooner if there is no longer a basis for retaining it. We also delete information from email and backups.
If your enquiry leads to a client relationship, you will receive a separate client privacy notice with your agreement, describing the processing and retention periods.
8. Data security
The form is transmitted over a secure connection. Only the data controller has access to the information. Devices are protected by passwords and disk encryption, and services are accessed using multi-factor authentication. Paper notes are stored in a locked space.
9. Your rights
You have the right to:
- find out what personal data we process about you and obtain a copy (Article 15)
- request correction of inaccurate data (Article 16)
- request erasure of data (Article 17)
- request restriction of processing (Article 18)
- receive the data you provided, where processed electronically, in a structured, commonly used and machine-readable format when processing is based on consent or a contract (Article 20)
- object to processing based on legitimate interests (Article 21)
- withdraw your consent at any time where processing is based on consent (Article 7(3)). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Send requests to hello(a)sykli.io. We will respond within one month. We may ask you to clarify your request or verify your identity if we have reasonable grounds to doubt it.
The service is intended for people aged 18 and over. We do not collect data from minors.
10. Right to lodge a complaint
You may lodge a complaint with a supervisory authority if you believe your personal data is being processed unlawfully.
Office of the Data Protection Ombudsman, tietosuoja.fi, tietosuoja(a)om.fi