Your privacy
matters.

Kiilu is a creative studio offering web development, design and brand content, operated by Malin and Jimmy, based in Algarve, Portugal. The legal entity behind Kiilu is Jimmy Pennanen, sole trader (empresário em nome individual), NIF 333598342. We are the data controller for personal information collected through this website — including our media kit for The Fluffy Outlaws at kiilu.io/thefluffyoutlaws. You can reach us at hello@kiilu.io or via our contact page.

When you send us a message — through our contact form, a project enquiry, or the collaboration form on The Fluffy Outlaws media kit — we collect:

• Your name
• Your email address
• Your brand or company name (optional)
• The service or package you're interested in
• The content of your message

When you fill in an onboarding form for a project we've agreed on, we also collect what you tell us about it — for example your website or Instagram username, your product and audience, the pages or content you need, and your preferred dates. When you book a free call, we collect your name, email address, the time you chose, whether you have a website today, what you would like it to do (optional), and — only if you choose WhatsApp — your phone number. If you write to us directly — by email, or in a message on Instagram, TikTok or WhatsApp — we receive your name or username there and what you write. We also collect anonymous usage statistics through Vercel Analytics and — with your consent — Google Analytics 4. See the Analytics section below for details.

We collect this information solely to respond to your inquiry and, where relevant, to follow up about a potential project. We do not use your information for marketing purposes unless you have explicitly asked us to stay in touch. The legal basis for processing your data is our legitimate interest in responding to business inquiries (Article 6(1)(f) GDPR). Once we've agreed a project, the details you give us in an onboarding form are processed to carry out that agreement (Article 6(1)(b) GDPR). Invoices and bookkeeping records are kept because the law requires it (Article 6(1)(c) GDPR).

We keep enquiries and messages — from our forms, by email, and on Instagram, TikTok or WhatsApp — for as long as we are in recurring contact, and delete them once 24 months have passed since our last contact. The 24 months start again each time you write to us. If we work together, we keep the contract, project details and your contact details for as long as the work and any care plan last, and for 24 months after that. Invoices and the records our bookkeeping relies on are kept for as long as Portuguese accounting law requires. You can ask us to delete your data earlier at any time, unless the law requires us to keep it.

Your inquiry data is handled by a small number of processors. Resend (email delivery, United States) receives your form submission and sends our reply, over an encrypted connection and under a data processing agreement that incorporates the EU Standard Contractual Clauses. Your enquiry then arrives in our own inbox, which is hosted by Google (Google Workspace, under Google's Cloud data processing terms). Vercel, Inc. provides our hosting and privacy-friendly analytics. Only if you accept cookies, Google LLC (Google Analytics 4) processes anonymous analytics data as our processor; transfers to the United States are covered by the EU–US Data Privacy Framework (Google LLC is certified) and, where applicable, Standard Contractual Clauses. When you book a free call, Google (Google Workspace: Calendar and Meet, under Google's Cloud data processing terms) stores the booking in our calendar and sends you the invite. If you choose WhatsApp, the call itself runs on WhatsApp, which you use under its own terms. If you write to us on Instagram, TikTok or WhatsApp, Meta (Instagram, WhatsApp) and TikTok handle those messages as independent controllers under their own terms — they are not our processors. We do not sell, rent or share your personal data with any other third parties.

We use Vercel Analytics to collect anonymous page view statistics. This includes: pages visited, referrer, device type, and approximate country (derived from a hashed and discarded IP address). No cookies are set and no personally identifiable information is stored. We also use Vercel Speed Insights to measure page performance (Core Web Vitals). This collects no personal data whatsoever. We use Google Analytics 4 (GA4) to understand how visitors interact with our site — pages visited, time on site, traffic sources, and general device/browser information. GA4 only activates if you accept cookies. We use Google's Consent Mode v2, meaning analytics is blocked by default until you give consent. Google may process this data on servers in the United States under appropriate transfer safeguards (Standard Contractual Clauses). The legal basis for Vercel Analytics is our legitimate interest (Article 6(1)(f) GDPR). The legal basis for Google Analytics is your consent (Article 6(1)(a) GDPR). The Fluffy Outlaws media kit uses Vercel Analytics only — no Google Analytics and no cookies, so it shows no cookie banner.

Without your consent, this website sets no cookies at all. Your answer to the cookie banner is saved in your browser's local storage (not a cookie, never sent to us), so the banner doesn't ask again. The only cookies are analytics cookies, and only if you accept:

• Analytics cookies (Google Analytics 4) — only set if you click "Accept" on the cookie banner. GA4 sets two cookies: _ga (identifies unique visitors, 2-year expiry) and _ga_5659WDDWSF (session state, 2-year expiry). You can withdraw consent at any time by clearing this site's cookies and site data in your browser; the banner then asks again.

Vercel Analytics and Speed Insights set no cookies. We do not use advertising or behavioural tracking cookies.

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate information
• Request deletion of your data
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured format

To exercise any of these rights, contact us via the contact page. We will respond within 30 days.

If you believe your data has been handled incorrectly, you have the right to lodge a complaint with Portugal's data protection authority, the CNPD (Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

We may update this policy from time to time. When we make material changes, we update the date at the top of this page.