Privacy notice EN | Lainattu Rauha

Privacy notice

Tämä tietosuojaseloste on saatavilla myös suomeksi.

Covers the whole website and related services · updated 1 September 2026

This notice explains how Lainattu Rauha Oy processes personal data in connection with the website, the online shop, the online courses and training services. It has been prepared in accordance with Article 13 of the EU General Data Protection Regulation (2016/679).

Summary. Personal data is processed only for the purpose for which it was given: delivering orders, running courses and responding to enquiries. Data is not sold or disclosed to third parties for marketing purposes. You have the right to access, rectify and erase your data.

1. Data controller and contact details

Controller: Lainattu Rauha Oy, Finnish business ID 3637497-9, trading also as Borrowed Peace Ltd
Address: Riisintie 23, 95200 Simo, Finland
Email: info@lainatturauha.fi
Contact person: Satu Väänänen

The controller has not appointed a data protection officer, as the conditions in Article 37 of the GDPR are not met.

2. Processing activities, purposes and legal bases

2.1 Online shop orders and delivery of digital products

Data: name, email address, billing details, order and payment data, order history
Purpose: delivering the order, customer service, accounting and statutory obligations
Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)), in particular accounting and VAT legislation
Retention: accounting records for the period required by the Finnish Accounting Act, vouchers for six years from the end of the calendar year in which the financial period ended

2.2 Online course participants

Data: name, email address, course access and progress data on the platform
Purpose: granting access, delivering the course and related communication
Legal basis: performance of a contract (Art. 6(1)(b))
Retention: for the duration of course access and thereafter as required for accounting

2.3 Training and consultancy clients

Data: contact person's name, role, organisation, email and telephone number, order and billing details
Purpose: planning and delivering training, invoicing and managing the client relationship
Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
Retention: for the duration of the client relationship and the period required by accounting legislation

2.4 Enquiries and requests for quotations

Data: name, email address, telephone number where given, and the content of the message
Purpose: responding to the enquiry and handling the matter
Legal basis: the controller's legitimate interest in responding to enquiries (Art. 6(1)(f)) or steps prior to entering into a contract (Art. 6(1)(b))
Retention: for the duration of handling the matter and no longer than two years from the enquiry

2.5 Cookies and website statistics

Data: data collected by cookies, such as IP address, browser type and statistical data on the use of the site
Purpose: ensuring the functioning of the site and developing it using visitor statistics
Legal basis: strictly necessary cookies: the controller's legitimate interest and section 205 of the Finnish Act on Electronic Communications Services. Statistical and marketing cookies: the user's consent, requested through the cookie notice
Retention: varies by cookie, session cookies expire when the browser is closed, persistent cookies last no longer than 12 months

Users can manage cookies through the site's cookie settings and their browser settings.

3. Sources of data

Personal data is obtained from the data subject through order, registration and contact forms, and through cookies during use of the site. Contact details of organisational clients may also be provided by the client organisation.

4. Recipients and processors

Personal data is processed by the controller and by the following service providers, which act as processors within the meaning of Article 28 of the GDPR and process data solely on behalf of the controller:

- website, online shop and course platform: Wix.com Ltd
- payment processing: Wix Payments, which may also act as an independent controller in respect of its own obligations
- accounting and payroll: Administer Oyj, Finland (financial management system eFina)

Personal data is not sold, rented or disclosed to third parties for marketing purposes. Data may be disclosed to authorities where required by law.

5. Transfers outside the EU or EEA

Some service providers may process personal data outside the EU or EEA. In such cases the transfer is based on the European Commission's standard contractual clauses or an adequacy decision. For the website and online shop platform (Wix), data may be transferred outside the EU, in which case the transfer is based on standard contractual clauses.

6. Security of processing

Personal data is stored in electronic, password-protected systems accessible only to the controller and, where necessary, the service providers' administration. No manual records are kept. Connections are encrypted.

7. Rights of the data subject

The data subject has the right to

- access their personal data (Article 15)
- have inaccurate data rectified (Article 16)
- request erasure of data (Article 17)
- request restriction of processing (Article 18)
- object to processing (Article 21)
- data portability (Article 20)
- withdraw consent at any time (Article 7(3))
- lodge a complaint with a supervisory authority, in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi)

Requests should be sent to the email address given in section 1. The controller responds within one month and may request further information to verify the identity of the person making the request. Some data may need to be retained after an erasure request on the basis of a legal obligation, such as accounting legislation.

8. Automated decision-making and profiling

Personal data is not used for automated decision-making or profiling within the meaning of Article 22 of the GDPR that would produce legal effects concerning the data subject.

9. Changes to this notice

The controller may update this notice. Changes take effect when the updated notice is published on the website, and the date of the update is shown at the beginning of the notice.