Privacy notice

Tämä tietosuojaseloste on saatavilla myös suomeksi.

Covers the whole website and related services · updated 27 October 2026

This notice explains how Lainattu Rauha Oy processes personal data in connection with the website, the online shop, the online courses, the members' area and training services. It has been prepared in accordance with Article 13 of the EU General Data Protection Regulation (2016/679).

Summary. Personal data is processed only for the purpose for which it was given: delivering orders, running courses, responding to enquiries and sending news to subscribers. Data is not sold or disclosed to third parties for marketing purposes. You have the right to access, rectify and erase your data.

1. Data controller and contact details

Controller: Lainattu Rauha Oy, Finnish business ID 3637497-9, trading also as Borrowed Peace Ltd
Address: Riisintie 23, 95200 Simo, Finland
Email: info@lainatturauha.fi
Contact person: Satu Väänänen

The controller has not appointed a data protection officer, as the conditions in Article 37 of the GDPR are not met.

2. Processing activities, purposes and legal bases

2.1 Online shop orders and delivery of digital products

Data: name, email address, billing details, order and payment data, order history
Purpose: delivering the order, customer service, accounting and statutory obligations
Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)), in particular accounting and VAT legislation
Retention: accounting records for the period required by the Finnish Accounting Act, vouchers for six years from the end of the calendar year in which the financial period ended

2.2 Online course participants

Data: name, email address, course access and progress data on the platform
Purpose: granting access, delivering the course and related communication
Legal basis: performance of a contract (Art. 6(1)(b))
Retention: for the duration of course access and thereafter as required for accounting

2.3 Training and consultancy clients

Data: contact person's name, role, organisation, email and telephone number, order and billing details
Purpose: planning and delivering training, invoicing and managing the client relationship
Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
Retention: for the duration of the client relationship and the period required by accounting legislation

2.4 Enquiries and requests for quotations

Data: name, email address, telephone number where given, and the content of the message
Purpose: responding to the enquiry and handling the matter
Legal basis: the controller's legitimate interest in responding to enquiries (Art. 6(1)(f)) or steps prior to entering into a contract (Art. 6(1)(b))
Retention: for the duration of handling the matter and no longer than two years from the enquiry

2.5 Cookies and website statistics

Data: data collected by cookies, such as IP address, browser type and statistical data on the use of the site
Purpose: ensuring the functioning of the site and developing it using visitor statistics
Legal basis: strictly necessary cookies: the controller's legitimate interest and section 205 of the Finnish Act on Electronic Communications Services. Statistical and marketing cookies: the user's consent, requested through the cookie notice
Retention: varies by cookie, session cookies expire when the browser is closed, persistent cookies last no longer than 12 months

Users can manage cookies through the site's cookie settings and their browser settings.

3. Sources of data

Personal data is obtained from the data subject through order, registration and contact forms, and through cookies during use of the site. Contact details of organisational clients may also be provided by the client organisation.

4. Recipients and processors

Personal data is processed by the controller and by the following service providers, which act as processors within the meaning of Article 28 of the GDPR and process data solely on behalf of the controller:

- website, online shop and course platform: Wix.com Ltd
- payment processing: Wix Payments, which may also act as an independent controller in respect of its own obligations
- accounting and payroll: Administer Oyj, Finland (financial management system eFina)

Personal data is not sold, rented or disclosed to third parties for marketing purposes. Data may be disclosed to authorities where required by law.

5. Transfers outside the EU or EEA

Some service providers may process personal data outside the EU or EEA. In such cases the transfer is based on the European Commission's standard contractual clauses or an adequacy decision. For the website and online shop platform (Wix), data may be transferred outside the EU, in which case the transfer is based on standard contractual clauses.

6. Security of processing

Personal data is stored in electronic, password-protected systems accessible only to the controller and, where necessary, the service providers' administration. No manual records are kept. Connections are encrypted.

7. Rights of the data subject

The data subject has the right to

- access their personal data (Article 15)
- have inaccurate data rectified (Article 16)
- request erasure of data (Article 17)
- request restriction of processing (Article 18)
- object to processing (Article 21)
- data portability (Article 20)
- withdraw consent at any time (Article 7(3))
- lodge a complaint with a supervisory authority, in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi)

Requests should be sent to the email address given in section 1. The controller responds within one month and may request further information to verify the identity of the person making the request. Some data may need to be retained after an erasure request on the basis of a legal obligation, such as accounting legislation.

8. Automated decision-making and profiling

Personal data is not used for automated decision-making or profiling within the meaning of Article 22 of the GDPR that would produce legal effects concerning the data subject.

9. Changes to this notice

The controller may update this notice. Changes take effect when the updated notice is published on the website, and the date of the update is shown at the beginning of the notice.

Members' area and membership

Members log in to the members’ area with Wix member features. The Membership and the Plus membership are purchased through Wix subscriptions (Pricing Plans)

Data processed: name, email address, login details, subscription details (membership purchased, start date, validity, cancellation), payment transaction details, use of the member discount and any messages the customer sends us.

Payments: Payments are processed by a payment service provider. Borrowed Peace Ltd (Lainattu Rauha Oy) does not see bank or card details.

Purpose and legal basis: The data is processed to provide the membership, to bill the subscription and for customer service. The legal basis is the contract. Data that forms part of the accounting records is retained under the Finnish Accounting Act.

Retention: Account data is kept for as long as the account exists. Users can request that their account be deleted. Payment and subscription data is kept for the period required by the Accounting Act.

Picture requests

Members can send a picture request using a form. The form stores the request, its description and the sender's email address. The data is used to handle the request and plan new pictures. A request is kept until it has been handled, and for no longer than 12 months.

Please do not include names, health information or any other details that could identify an individual in the form.

Picture tools

Picture tools is an online tool for members to make social narratives, first–then boards, visual schedules and choice boards.

Data stored on the user's own device: Stories, boards and the user's own pictures created or added in the tool are stored only in the user's own browser, in its local storage. They are not transferred to Borrowed Peace Ltd or to third parties, and Borrowed Peace Ltd cannot access them. The user can delete the data with the tool's "Delete everything from this device" function or by clearing the browser data. A backup and a work shared as a file are saved on the user's own device. The file contains the work's text and the photos the user has added, and it is not encrypted. The user decides whether to move the file to another device or send it to another person.

Local storage is used only to provide a function the user requests, which is saving. It is not used for tracking or marketing, so no separate cookie consent is needed.

Reading aloud: Reading aloud in the screen mode uses the device's own speech voice, in which case the text is processed on the user's device. If the device only has a voice for the language that works over the internet, the tool asks the user for permission before using it. After permission, the text being read may be sent to the speech service of the browser or device manufacturer. Borrowed Peace Ltd does not receive, store or process this information.

Own pictures: Users are responsible for having the right to use the photos they add to the tool, especially when the photos show identifiable people.

The way I am tool (Plus membership)

The way I am is a browser-based tool for Plus members, with which a family gathers information about their family member and makes printouts from it. The tool also includes tracking and the Starry sky.

Intended use: The way I am is a tool for families and close supporters for passing on everyday information. It is not designed for processing client or patient data in social or health care services or for a service provider's record keeping. Information written in the tool is not transferred to Borrowed Peace Ltd or to any service provider's register.

Use by professionals: When a professional in social care, health care or education uses the tool at work to help pass on information, for example for a summary for a doctor's appointment, they follow their workplace's data protection guidance. The employer is responsible for processing its own clients' information in line with its own instructions. Borrowed Peace Ltd does not process the information written in the tool in this case either.

Information entered in the tool: Information entered in the tool and photos added by the user are processed only in the browser on the user’s own device. They are not transferred to Borrowed Peace Ltd, to Netlify or to any other third party, and Borrowed Peace Ltd has no access to them. Borrowed Peace Ltd does not process this information.

Temporary storage: During use, the information is held in browser memory. When the browser allows it, unfinished work is also saved unencrypted in the tab’s temporary storage (sessionStorage) so that the work is restored if the page is reloaded. The browser may also restore this temporary storage when a closed tab is reopened. The Close and clear function removes the tool’s active information and the temporary storage. The tool does not use cookies or the browser’s persistent storage.

Saved file: The user saves the work as a file (.lrpro) in a location of their choice. By default the file is encrypted with a password set by the user (AES-GCM, 256-bit key). The user may choose to save without a password, in which case the file is unencrypted. Encryption does not cover the file name. The default name is formed from the time of saving, and if the user adds the person’s name to the file name, it is visible despite the encryption. PDF files, PNG images and paper printouts made with the tool are unencrypted. Files already saved, printouts and other copies held by the browser or operating system remain until the user deletes them. The user is responsible for storing, sharing and disposing of files, images and printouts.

Picture bank image requests: When the tool needs a picture bank image, the browser fetches it from the image server unless it uses an already loaded copy. Netlify then receives the address of the requested image and standard technical data such as the IP address, browser information and the time of the request. The image address shows which image was requested, and the addresses of search-result thumbnails may indicate the topic of a search, even though the search words are not sent. The requests do not contain the user’s name, notes, search words or any other content entered in the tool.

A more detailed description of the tool’s information security is in the terms and conditions, section Plus membership, under Information security and data protection.

Free picture bank

The picture bank is used without logging in. The picture bank does not collect personal data from users and does not use cookies or tracking. Any text added to pictures is processed only in the user's own browser. You can sign up for news of new pictures by email, see Picture bank email updates.

Picture bank email updates:

You can sign up on the website to receive news of new pictures in the picture bank by email. You also receive a downloadable guide.

Data processed:

email address, time of sign-up, record of consent and the language of the sign-up form. The email service also records standard technical data, such as whether a message was opened and which links were clicked.

Purpose:

sending news of new pictures in the picture bank and information about Lainattu Rauha’s materials and services.

Legal basis: your consent (Article 6(1)(a)).

Retention:

for as long as the subscription is active. You can unsubscribe at any time using the link at the end of every message or by emailing info@lainatturauha.fi. After you unsubscribe, no further messages are sent to your address. A record of the unsubscription may be kept so that the address is not added to the list again by mistake.

The sign-up form and the messages are run on Wix.

Service providers and data transfers

Wix.com Ltd hosts the website, the members' area, subscriptions and forms. Wix acts as a data processor under a data processing agreement. Wix is based in Israel, which has an adequacy decision from the European Commission. Wix has servers in the United States and Ireland. For transfers outside the EU, Wix uses the EU Standard Contractual Clauses.

Netlify, Inc. delivers the picture tools, the tool The way I am, the picture bank images and the introduction page. When these are used, standard technical data such as the IP address, browser information and the time of the request are sent to Netlify. Netlify processes this data to deliver the service and maintain security. Netlify's data processing agreement is part of its terms of service, and transfers outside the EU are covered by the safeguards set out in it.