Skip to content

Last updated 2026-06-05

Privacy policy

This privacy policy explains how Space and Time Oy ("SpaceTime", "we", "us") collects, uses, and protects personal data when you visit spacetime.eu or interact with us by email or through our newsletter. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

Controller

Space and Time Oy
Business ID (Y-tunnus): 1781499-1
PL 740, 00101 Helsinki, Finland
Email: hello@spacetime.eu

What data we collect and why

1. Newsletter subscription

When you subscribe to our newsletter via the form on the blog, we collect:

  • Email address — so we can deliver newsletter emails to you.
  • IP address and browser metadata — passed to Cloudflare Turnstile to verify you are not a bot.
  • Page URL and title from which you signed up — so we can understand which content drives subscriptions.
  • Marketing consent — recorded when you tick the consent checkbox.

Legal basis: consent (GDPR Art. 6(1)(a)). You can withdraw your consent at any time by unsubscribing from any newsletter email or by emailing hello@spacetime.eu.

2. Inquiry and contact forms

When you submit any of the inquiry forms on our product, audience, or contact pages (such as "Talk to a storage expert", "Discuss your requirements", or "Get in touch"), we collect:

  • Name, company or organisation, job title, email, and phone — as provided by you, so we can respond to your enquiry.
  • Form responses — your role in your organisation (where asked) and your answers to product-specific questions (for example camera count, use case, current setup, comments) that you chose to share.
  • Marketing consent — recorded only when you tick the consent checkbox. Leaving it blank means we will not send you marketing communication.
  • IP address and browser metadata — passed to Cloudflare Turnstile to verify you are not a bot, and forwarded to HubSpot as part of the form submission record for fraud and duplicate detection.
  • Page URL and title from which you submitted — to understand which content drives enquiries.

Legal basis: pre-contractual measures (GDPR Art. 6(1)(b)) for enquiries about a possible commercial relationship, and legitimate interest (Art. 6(1)(f)) in responding to general questions. Marketing communication, where you opt in, is processed on the basis of consent (Art. 6(1)(a)) and can be withdrawn at any time by emailing hello@spacetime.eu.

3. Email correspondence

When you email us at hello@spacetime.eu, sales@spacetime.eu, or any other team address listed on the contact page, we receive your email address, name (if provided), and the contents of your message.

Legal basis: legitimate interest in responding to enquiries (GDPR Art. 6(1)(f)) and pre-contractual measures where your message relates to a possible commercial relationship (Art. 6(1)(b)).

4. Server logs and bot protection

Our hosting and security provider Cloudflare records routine server logs when you visit any page on this site. These include your IP address, user-agent string, requested URL, and timestamp. Cloudflare also sets a strictly necessary __cf_bm cookie to distinguish humans from bots.

Legal basis: legitimate interest in maintaining site security, preventing abuse, and ensuring availability (GDPR Art. 6(1)(f)).

5. Analytics

We use Plausible Analytics to understand how visitors find and use this site in aggregate. Plausible is a privacy-friendly, cookieless analytics service hosted in the European Union (Germany). It collects only anonymous, aggregated information — pages viewed, referrer, country (derived from IP and immediately discarded), browser, operating system, and device type — and never assembles a profile of any individual visitor.

  • No cookies are set on your device.
  • No personal data is stored. Plausible derives a daily-rotated, salted hash from your IP and user-agent purely to count unique visits within a 24-hour window; the hash cannot be reversed to identify you and is discarded at the end of each day.
  • No cross-site tracking, fingerprinting, or advertising profiles.
  • All data is processed and stored in the EU.

Legal basis: legitimate interest in measuring traffic to improve the site (GDPR Art. 6(1)(f)). Because Plausible stores nothing on your device and processes no personal data, it falls outside the consent requirements of the ePrivacy Directive (Finland: Section 205 of the Act on Electronic Communications Services) — this is the same exemption recognised by the French CNIL and the UK ICO for Plausible. No cookie banner is required, and none is shown.

6. Data resilience quiz

When you take one of our data resilience quizzes (for example via a QR code at an event or a shared link) and enter your details to unlock your score, we collect:

  • Name and email — as provided by you, so we can follow up about your results and how SpaceTime can help.
  • Quiz responses — the answers you selected, stored alongside your contact details in our CRM.
  • Marketing consent — recorded only when you tick the consent checkbox. Leaving it blank means we will not send you marketing communication.
  • IP address and browser metadata — passed to Cloudflare Turnstile to verify you are not a bot, and forwarded to HubSpot as part of the submission record for fraud and duplicate detection.
  • Page URL and title from which you submitted — to understand engagement with the quiz.

Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in following up on the interest you showed and in operating the quiz, and pre-contractual measures (Art. 6(1)(b)) where your enquiry relates to a possible commercial relationship. Marketing communication, where you opt in, is processed on the basis of consent (Art. 6(1)(a)) and can be withdrawn at any time by emailing hello@spacetime.eu.

Cookies

This site uses only strictly necessary cookies. We do not set analytics, advertising, or cross-site tracking cookies on your device.

  • __cf_bm — set by Cloudflare for bot management. Expires after about 30 minutes of inactivity.
  • Cloudflare Turnstile — may set short-lived cookies during the captcha challenge on the newsletter, inquiry, and quiz forms. Used only to complete the challenge.

These cookies are exempt from the consent requirement under Art. 5(3) of the ePrivacy Directive (strictly necessary for the security and operation of the service). For that reason, we do not show a cookie banner.

Who we share your data with

We do not sell or rent personal data. We share data only with the processors needed to operate this site:

  • Cloudflare, Inc. — hosting (Cloudflare Pages), bot management, and Turnstile captcha. Cloudflare may transfer data to the United States under the EU–US Data Privacy Framework and the Standard Contractual Clauses.
  • HubSpot, Inc. — newsletter subscription management, email delivery, and storage of inquiry-form and quiz submissions in our CRM. Form submissions are sent server-to-server from our infrastructure to HubSpot's EU endpoints; no HubSpot script runs in your browser and HubSpot sets no cookies on this domain. HubSpot is certified under the EU–US Data Privacy Framework.
  • Plausible Insights OÜ — privacy-friendly, cookieless website analytics, processed and stored in the European Union. See the Plausible data policy for details.

How long we keep your data

  • Newsletter subscribers: until you unsubscribe or request deletion.
  • Email correspondence: for as long as needed to handle your enquiry and any related business relationship, typically up to three years from last contact.
  • Inquiry-form and quiz contacts: kept in our CRM until you request deletion, and otherwise reviewed and removed after up to three years from last contact.
  • Server logs: retained by Cloudflare for short periods (typically up to 30 days) for security purposes.
  • Analytics data: Plausible stores only aggregate, anonymous statistics with no personal identifiers; the daily hash used to estimate unique visits is discarded at the end of each day.

Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Have inaccurate data corrected (Art. 16).
  • Request erasure of your data (Art. 17).
  • Restrict or object to processing (Arts. 18, 21).
  • Receive your data in a portable format (Art. 20).
  • Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email hello@spacetime.eu. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

Security

We use industry-standard technical and organisational measures to protect personal data, including TLS encryption in transit, access controls, and regular review of our processors. The site itself is hosted on Cloudflare Pages with security headers and a strict Content Security Policy.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by updating this page and, where appropriate, by email to newsletter subscribers.