How we handle your data.

1. Who is responsible

Rebel Advisory Oy is the controller for the personal data described in this notice. For any question about your data, or to exercise any of the rights set out in section 6, write to privacy@rebeladvisory.com.

2. What this website collects

Nothing you type, because there is nothing to type into — this site has no forms, no sign-up and no chat. What is processed is what any web server necessarily sees when it sends you a page:

• Your IP address
• Your browser type and version, and your operating system
• The page you requested, and the date and time you requested it
• The page that referred you, where your browser sends one

This is processed to deliver the site, keep it available and protect it against abuse. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR). We do not use it to build a profile of you, and we do not attempt to identify you from it.

3. What this website does not do

Stated plainly, because most sites claiming to respect privacy do the opposite:

• No cookies. The site sets none, so there is no consent banner to click.
• No analytics or tracking. No Google Analytics, no tag manager, no pixels, no session recording.
• No third-party requests. Our typefaces are served from our own domain rather than from a font CDN, so your visit is not disclosed to anyone else.
• No advertising, and no data sold or shared with anyone for their own purposes.

4. If you email us

If you write to us, we process your address, your message and anything you choose to include, in order to respond and to take steps at your request before entering into a contract (Article 6(1)(b) GDPR), or on the basis of our legitimate interest in handling correspondence (Article 6(1)(f) GDPR). Please don't send confidential or sensitive information by ordinary email before we have agreed how to exchange it.

5. Who processes data for us

We use a small number of service providers, which act as processors on our behalf under written terms:

• Vercel — hosting and delivery of this website, including the server logs described in section 2.
• Google (Workspace) — our email.

Both are established in the United States and may process data outside the EU/EEA. Where they do, transfers are made under the safeguards permitted by Chapter V GDPR — the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

6. How long we keep it

Server logs are retained by our host for a short period for security and diagnostics, and are then deleted or aggregated. Correspondence is kept for as long as needed to deal with the matter and, where a business relationship follows, for as long as required by applicable accounting and limitation rules.

7. Your rights

Under the GDPR you may request access to your personal data, ask us to correct or erase it, ask us to restrict how we use it, object to processing based on legitimate interests, and — where it applies — receive it in a portable form. To exercise any of these, write to privacy@rebeladvisory.com.

If you believe we have handled your data incorrectly, you may lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or with the supervisory authority where you live or work.

8. Changes

If we change how this site works — if we ever add a form, a booking tool or analytics — we will update this page before doing so, and change the date at the top.