Privacy notice

This Privacy Notice describes how Kipinäjänis processes personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). It also contains the information required under Section 10 of the Finnish Personal Data Act (523/1999).

Date of preparation: 24 January 2024
Last updated: 13 Aug 2026

Kipinäjänis is committed to protecting the privacy of its customers and follows good data protection practices in all its activities. This Privacy Notice explains what personal data we may collect when you purchase our products or services or contact us through our website, and for what purposes we may use that data.

By purchasing services through our website or subscribing to our newsletter, you are asked to acknowledge this Privacy Notice.

1. Data Controller

Kipinäjänis
Business ID: 3432376-4
Susisalontie 5
80710 Lehmo
Finland

2. Contact person responsible for the register

Hanna Hotulainen
hanna(at)kipinajanis.fi

3. Name of the register

Kipinäjänis Customer Register

4. Purposes and legal bases for processing personal data

Personal data is processed for the following purposes:

Managing customer relationships, including providing services and handling invoicing
Customer communications, marketing and targeted marketing
Developing and administering our services and improving the customer experience

The legal basis for processing personal data is determined according to the purpose of the processing. Depending on the circumstances, processing may be based on the customer’s consent, the performance of a contract, a legal obligation, or the legitimate interests of Kipinäjänis.

Where processing is based on consent, the consent must be freely given, specific, informed and unambiguous.

Personal data is processed only to the extent necessary for the customer relationship between the customer and Kipinäjänis, the performance of a contract, the use of the website, the customer’s consent, or compliance with legal obligations.

We do not use personal data for automated decision-making or profiling.

5. Personal data Collected

The Kipinäjänis Customer Register may contain the following information provided directly by the customer:

First and last name
Email address
Telephone number
Postal address
Payment and billing information (the postal address may be required for this purpose)
Information about marketing consents and restrictions
Customer feedback

The register may also contain information observed through the use of our services or derived through analytics, including:

Information collected through cookies, such as how the customer arrived at the kipinajanis.fi website
Purchase history, including products and services purchased and their prices
Device identifiers, such as IP addresses

6. Regular sources of personal data

The personal data stored in the register is primarily obtained directly from customers, for example through forms on the kipinajanis.fi website, Google Forms, email or social media. Personal data may also be collected through separate forms at events and campaigns, as well as by telephone during customer service calls.

7. Disclosure of personal data to third parties

Kipinäjänis may disclose personal data to third-party service providers where necessary to provide services and carry out marketing activities. These third parties may include, for example:

Payment service providers such as MobilePay and OP-Kevytyrittäjä (invoicing)
Email marketing provider EmailOctopus
Google Meet, which is used for coaching and consultation sessions

These third parties may only process personal data to the extent necessary to provide the relevant service and may not use the data for their own purposes.

We do not sell, rent or otherwise disclose your personal data to third parties for their own purposes.

Kipinäjänis may also disclose personal data to public authorities where required or permitted by law, including in response to lawful requests for information.

8. Data Security

The databases containing personal data are protected against external security breaches using firewalls, passwords and other appropriate technical measures. The databases and their backups are stored in locked premises.

Access to personal data is restricted to specifically authorised individuals working for the Data Controller, as well as employees of companies acting on behalf of and under the instructions of the Data Controller. Access is granted on an individual, personal basis.

9. Rights of data subjects

Under the GDPR, you have the following rights in relation to your personal data:

Right of access – the right to obtain confirmation as to whether your personal data is being processed and to access the personal data held about you
Right to rectification – the right to have inaccurate or incomplete personal data corrected
Right to restriction of processing in certain circumstances
Right to object to the processing of your personal data in certain circumstances, including direct marketing
Right to withdraw consent at any time where processing is based on consent
Right to lodge a complaint with a supervisory authority

You also have the right to erasure of your personal data in certain circumstances. See Section 10 below.

If you wish to access your personal data or request that inaccurate or incomplete information be corrected, please submit your request in writing to the Data Controller.

We may ask you to provide additional information necessary to verify your identity. We will respond to your request without undue delay and, in principle, within one month of receiving the request.

Requests concerning the exercise of data protection rights are generally handled free of charge. However, if a request is manifestly unfounded or excessive, in particular because of its repetitive nature, we may charge a reasonable fee or refuse to act on the request, as permitted under the GDPR.

Please note that in certain circumstances, the exercise of data protection rights may be restricted by applicable legislation. For example, accounting legislation may require us to retain certain accounting records for a specified period.

10. Other rights relating to the processing of personal data

You have the right to request the erasure of your personal data from the register in certain circumstances. This is commonly referred to as the “right to be forgotten.”

The right to erasure is not absolute and does not apply where we are legally required to retain certain information or where another legal basis for retaining the data applies.

You may also have the right to restrict the processing of your personal data in certain circumstances, as provided by the GDPR.

Requests concerning the exercise of these rights should be submitted in writing to the Data Controller. We may ask you to provide additional information necessary to verify your identity.

We will respond to your request without undue delay and, in principle, within one month of receiving it.

11. Retention of personal data

Personal data in the Customer Register is retained for as long as necessary to maintain the customer relationship.

Your personal data will be deleted if you have not purchased any products or services from us or opened any marketing communications for one year, unless we have a legal obligation or other legitimate reason to retain the data for longer.

Finnish accounting legislation may require certain information to be retained for longer periods.

12. Use of cookies

A cookie is a small text file that a web browser stores on a user’s device. Cookies contain a unique identifier that may be used to recognise a browser or device.

Our website uses cookies to provide a user-friendly and high-quality service and to further develop our website and services. A user cannot be identified solely on the basis of cookies.

There are two main types of cookies: persistent cookies and session cookies. Persistent cookies are stored as files on your computer or mobile device and are not retained for longer than 12 months. Session cookies are stored temporarily and are deleted when you end your browsing session.

You can delete cookies from your computer or mobile device using your browser settings. Instructions for managing and deleting cookies can usually be found in your browser’s “Help” section. You can also configure your browser to block cookies or to notify you whenever a new cookie is sent to your computer or mobile device.

Please note: If you disable cookies, some features of the website may not be available to you.

Embedded content from other websites

Articles on this website may include embedded content, such as videos, images or articles. Embedded content from other websites behaves in the same way as if the visitor had visited the third-party website directly.

These websites may collect information about you, use cookies, embed third-party tracking technologies and monitor your interaction with the embedded content, including tracking your interaction with the embedded content if you are logged in to the third-party website.

13. Changes to this Privacy Notice

We reserve the right to amend this Privacy Notice due to changes in our services or applicable legislation.

If we make material changes to this Privacy Notice, we will notify registered customers when the updated terms are introduced.