Privacy Policy

Last updated: 7 July 2026

This policy explains how Velvet Rocket Media LLC ("we", "us") handles personal data when you visit echoiran.com, contact us, subscribe to our newsletter or use our services. We're the data controller for everything described here.

1. Data controller

Velvet Rocket Media LLC
401-407 Headquarters Dr
Millersville, MD 21108-2503
United States
Email: hello@echoiran.com
Phone: +358 9 4242 8800

2. Legal basis and purposes

We only process personal data where we have a lawful basis under the EU GDPR and the Finnish Data Protection Act (1050/2018). Here's what we do and why:

• Website operation and security — technical logs, cookie IDs and session data needed to run the site and block abuse (legitimate interests, Art. 6(1)(f) GDPR).
• Enquiries and cooperation requests — name, email, message content and anything else you send via our forms (pre-contractual steps or contract, Art. 6(1)(b) GDPR; or consent where applicable).
• Newsletter and marketing — email address and preferences when you opt in to build notes (consent, Art. 6(1)(a) GDPR). You can withdraw anytime.
• Analytics — aggregated usage stats when you accept analytics cookies (consent, Art. 6(1)(a) GDPR). See our Cookie Policy.
• Legal compliance — records we must keep for accounting, tax or regulatory reasons (legal obligation, Art. 6(1)(c) GDPR).

3. Categories of personal data

Depending on how you interact with us, we may process:

• Identity and contact data (name, company, email, phone)
• Communication content (messages, project briefs, chat transcripts)
• Technical data (IP address, browser type, device IDs, referring URL, timestamps)
• Cookie and consent preferences
• Billing and contract data for clients (invoicing details, purchase history)

We don't intentionally collect special categories of personal data. Please don't send sensitive information unless we explicitly ask for it.

4. Cookies and similar technologies

We use essential cookies for site functionality and, with your consent, analytics cookies. Full details, retention periods and how to change your choices are in our Cookie Policy.

5. Recipients and international transfers

We may share personal data with:

• Hosting and infrastructure providers in the EU/EEA
• Email, CRM and analytics providers acting as processors under data processing agreements
• Professional advisers (legal, accounting) bound by confidentiality
• Public authorities when required by law

If data goes outside the EU/EEA, we use appropriate safeguards — Standard Contractual Clauses or an adequacy decision.

6. Retention

We keep personal data only as long as needed:

• Enquiry and lead data: up to 24 months after last contact, unless a client relationship continues
• Client contract and billing records: as required by Finnish accounting law (typically six years)
• Newsletter subscriptions: until you unsubscribe or withdraw consent
• Server logs: up to 90 days unless needed for security investigations
• Cookie consent records: up to 12 months

7. Your rights under GDPR

As a data subject in the EU/EEA, you can:

• Access your personal data and get a copy
• Rectify inaccurate or incomplete data
• Erase data in certain circumstances ("right to be forgotten")
• Restrict processing in certain circumstances
• Data portability for data you provided, where processing is based on consent or contract and automated
• Object to processing based on legitimate interests, including profiling
• Withdraw consent at any time without affecting prior lawful processing
• Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

To exercise your rights, email hello@echoiran.com. We respond within one month, extendable by two more if requests are complex.

8. Security

We use appropriate technical and organisational measures to protect personal data — access controls, HTTPS, vendor due diligence and staff confidentiality obligations.

9. Children

Our website and B2B services aren't aimed at anyone under 18. We don't knowingly collect data from minors. If you think we've received some, contact us and we'll delete it promptly.

10. Automated decision-making

We don't use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

11. Changes to this policy

We may update this policy when law, tech or our business changes. The "Last updated" date at the top will change accordingly. Material updates will be posted here or, where appropriate, emailed.

12. Contact

Privacy questions or requests:

Velvet Rocket Media LLC
401-407 Headquarters Dr, Millersville, MD 21108-2503, United States
hello@echoiran.com · +358 9 4242 8800