Payment & Security Compliance

1. How Your Payment Is Taken

All customer payments are processed by Stripe. Stripe is our only payment processor. When you pay, you are redirected from our site to a payment page hosted and operated by Stripe, you enter your details there, and you are returned to us afterwards with the result.

1.1. 1.1. What this means for your card details:

• We never see your card number. Card details are entered on Stripe's own page, not on ours. Sujan Studio operates no card entry form anywhere in its websites or applications.
• We do not store card data. Our payment records hold the amount, the currency, the transaction status, the date and Stripe's reference for the payment. They contain no card number, no expiry date, no security code and no cardholder name.
• Card security is Stripe's responsibility. Stripe is certified to PCI DSS Level 1 as a service provider. That certification is Stripe's, not ours. Our own PCI DSS position is set out in section 7.
• Encryption in transit. Traffic between your browser, our site and Stripe is carried over TLS.

1.2. 1.2. Strong Customer Authentication (PSD2)

Payments from EEA customers fall under the revised Payment Services Directive (PSD2), which requires Strong Customer Authentication for most electronic payments. Because your payment is completed on Stripe's hosted page, Strong Customer Authentication is applied there by Stripe together with your bank or card issuer.

• You may be asked by your bank to confirm the payment, typically through your banking app, a one-time code, or biometric confirmation on your device.
• That authentication step happens between you, Stripe and your bank. Sujan Studio does not receive or store the credentials you use to complete it.
• If your bank declines or an authentication step is not completed, the payment fails and no booking fee is taken. You can try again from the same link.

1.3. 1.3. Payment methods and SEPA

The payment methods offered to you at checkout are those enabled on our Stripe account for your country, and typically include the major card schemes. Where a payment is made by SEPA credit transfer or direct debit, the rights attached to that scheme apply in addition to the terms on this page.

Nothing on this page limits your rights under PSD2 or under Finnish law relating to unauthorised or incorrectly executed payment transactions. Those rights sit with your bank or payment service provider and are unaffected by anything we say here.

2. Network & Infrastructure Security

Our public website is served through Cloudflare, which provides the network and application security layer in front of it.

2.1. 2.1. Measures in place:

• DDoS mitigation:
• Web application firewall:
• TLS encryption:
• Rate limiting:

Cloudflare publishes its own certifications and compliance position on its trust site, linked at the foot of this page. Those are Cloudflare's certifications and we do not claim them as our own.

3. Booking Fees, Balances and Invoices

Prices quoted to customers in Finland are shown in euro (EUR). The currency you will actually be charged in is shown on the checkout page before you pay, so you can see it before you commit.

3.1. 3.1. How the payment is split:

• A booking fee is paid at the time you confirm your booking. It is applied to the total price of your shoot and is not an additional charge.
• The percentage of the total taken as the booking fee depends on how far in advance of your event you book. The exact percentage and amount are shown to you in euro on your estimate before you pay anything.
• The remaining balance is invoiced separately. The amount, the due date and the payment link are set out on that invoice.

3.2. 3.2. What we do not do with your money

We want to be precise about this, because it is often described loosely. Payments you make are received into our own account with our payment processor. They are not held in an escrow account, in a trust account or in any separate client account, and they are not ring-fenced from our other funds. Your protection if something goes wrong comes from your statutory consumer rights, from our cancellation and refund terms, and from the chargeback and dispute mechanisms of your card scheme or bank, not from a holding arrangement.

3.3. 3.3. Your invoice

• Every payment produces an invoice or receipt showing the amount, the currency, the date and what it relates to.
• Prices shown to consumers include all taxes and unavoidable charges. Your invoice sets out any tax charged.

3.4. 3.4. Taxes on your invoice

The price shown on your estimate is the total price for the work described, including all taxes and unavoidable charges. Your invoice sets out the amount you paid and any tax charged on it. If you need a document for your own accounting, ask us and we will provide it.

4. Data Protection

Personal data relating to customers in Finland and the EEA is handled under the General Data Protection Regulation (EU) 2016/679 and Finnish data protection law. Our Privacy Policy is the governing document; this section covers only the payment side.

4.1. 4.1. In relation to payments:

• We hold the transaction record, not the instrument. Amount, currency, status, date, invoice reference and the processor's transaction reference. No card details.
• Encryption:
• Access control:
• Providers and international transfers:

5. Fraud Prevention & Account Protection

Fraud screening on payments is performed by Stripe as part of processing the transaction, using its own risk tooling. Alongside that:

• Cloudflare filters automated and abusive traffic before it reaches our application.
• Payment confirmations are received from Stripe over signed, verified webhooks, so a booking cannot be marked as paid by anyone spoofing a confirmation.
• Payment requests are idempotent, so a duplicated or retried request cannot charge you twice for the same booking.
• Signing in to a customer account requires a one-time code sent to you, in addition to your credentials.

If a fraud check declines your payment, we will not be told the underlying reason by your bank. You should contact your bank or card issuer directly in that case.

6. Refunds, Withdrawal, Disputes & Chargebacks

Your statutory rights come first. Nothing in this section limits the right of withdrawal for distance contracts, the statutory remedies for a service that is not as agreed, or your rights against your bank in relation to a payment transaction.

6.1. 6.1. Refunds:

• Refunds are made through Stripe to the original payment method, in the currency in which you paid.
• Where you exercise your 14-day right of withdrawal, we refund using the same means of payment you used, unless you expressly agree otherwise, and you are not charged a fee for the refund. We refund within 14 days of receiving your notice. If you had expressly asked us to begin work before the period expired, you pay only a proportionate amount for the work already done and we refund the rest. Section 4 of our Terms & Conditions sets this out in full.
• How long the refund takes to appear on your statement is determined by your bank or card issuer, not by us.

6.2. 6.2. Complaints and disputes:

• Raise a payment problem with us first, using the contact details in section 11.
• If we cannot resolve it, you may take the matter to Finnish Consumer Advisory Services (kuluttajaneuvonta) and, if it remains unresolved, to the Consumer Disputes Board (kuluttajariitalautakunta). Contacting us first is a condition of the Board considering a complaint.
• For an unauthorised or incorrectly executed payment transaction, contact your own bank or payment service provider as well, since your rights there run against them.

6.3. 6.3. Chargebacks:

• If you raise a chargeback with your card issuer, the outcome is decided by your issuer and the card scheme under their rules. We respond through Stripe with the booking record and correspondence for the transaction.

7. Our Compliance Position — Stated Plainly

We think it is more useful to tell you exactly which certifications are held by whom than to display a row of logos. The table below sets out our position and our providers' positions separately.

Sujan Studio does not operate a card entry form and does not receive, transmit or store cardholder data. Card data is captured entirely on Stripe's hosted payment page. We have not completed a PCI DSS self-assessment questionnaire of our own and we hold no attestation of compliance, so we make no claim to a PCI DSS certification.

Where you see a PCI DSS Level 1 reference in connection with our payments, it refers to Stripe's certification as a service provider. It is not a certification held by Sujan Studio.

8. Payments to Photographers

Photographers working with Sujan Studio are paid by us after the work is delivered and accepted, against the rate agreed for the booking.

• Payment runs are reviewed and released by us on a regular cycle. They are not released automatically by the payment processor at the moment a booking is marked complete.
• Payouts are released on our standard payout cycle once a booking is delivered and accepted, and the timing for your engagement is set out in your agreement with us rather than on this page.
• Photographers are never charged for enquiries or leads.
• Bank details supplied for payment are held under the same access controls as other payment data and are used only to pay you.

9. Security Review & Monitoring

We review our systems and improve them on an ongoing basis. So that this section says something you can rely on, here is what that currently consists of:

• Internal security reviews of the application, its interfaces and its deployment configuration. Findings from those reviews are recorded and prioritised for remediation. They are internal reviews, not audits by an external firm, and we do not describe them as such.
• Monitoring of payment confirmations from Stripe, with a reconciliation check so a missed confirmation cannot leave a paid booking unrecorded.
• Network and threat monitoring through Cloudflare.
• Review of this page and our other policy pages when the way the product works changes.

We do not currently hold an independent third-party security certification, and we do not claim one.

10. Your Responsibilities

To keep your account and your payments secure, please:

• Keep your login credentials private and use a password you do not use elsewhere.
• Provide accurate billing and bank details, and tell us promptly if they change.
• Pay only through the payment links we send you. We will never ask you for card details by email, message or telephone.
• Report anything suspicious to us immediately, and to your bank if it concerns a payment.

11. Contact & Incident Reporting

If you suspect a security issue, fraudulent activity or a payment irregularity, please report it to us straight away.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will handle it in accordance with the GDPR, including notifying the competent supervisory authority within the required timeframe and informing affected individuals where the regulation requires it. Our Privacy Policy sets out that process.

12. Our Ongoing Commitment

We would rather describe our security accurately than impressively. Everything on this page describes how our systems actually work today. Where a control belongs to Stripe or to Cloudflare rather than to us, we have said so, and where we do not hold a certification, we have said that too.

If you find anything on this page that does not match your experience of using Sujan Studio, please tell us. We will correct it.

Legal Disclaimer

This Payment & Security Compliance statement describes how Sujan Studio takes payment and protects payment data for customers in Finland and the EEA. It is provided for information and does not override your mandatory rights under Finnish or EU consumer, payment services or data protection law. Where this page and those laws differ, those laws prevail.

For more on Stripe’s and Cloudflare’s certifications, visit:

• Stripe Security Overview
• Cloudflare Security & Compliance
• Finnish Competition and Consumer Authority (KKV) — Consumer Advisory Services