Kansalaisuuskurssi1. Data controller
Znoff AB, corporate ID number 559422-8479, Nordgårdsgatan 6J, 412 85 Göteborg, Sweden, is the data controller for the processing of your personal data on Kansalaisuuskurssi. You can reach us at info@kansalaisuuskurssi.fi. Write "Personal data" in the subject line so that we find your email faster.
We only process data that is needed to reply to you, give you access to the course and comply with the law. We never sell your data and we make no automated decisions about you. We do not use advertising cookies or tracking pixels on this site.
2. What data we process
- When you email us or use the contact form: your name, your email address, the topic and the content of the message. Form messages are stored with our database provider Supabase (EU, Ireland) together with a hashed IP address and which browser you used (user agent). These are used only to stop mass submissions, and the messages are deleted no later than twelve months after the matter is closed.
- When you create an account: email address and password. The password is stored encrypted with our login provider, never in plain text with us.
- When you log in with Google: your email address and your name from the Google account. We never receive your Google password.
- When you buy the course without an account: we create an account for you with the email address and name you enter at checkout, so that the course can be opened. You log in with the link we email you, and can then choose a password.
- When you buy a subscription: the payment is handled by Stripe. We do not store your card details. From Stripe we receive what is needed to confirm the purchase and give you access: email address, payment status, amount, date and the subscription's validity period.
- Emails we send: an order confirmation when you buy and a reminder 14 days before a yearly subscription renews. The order confirmation is also sent as a blind copy to Trustpilot, which emails you seven days later to ask whether you want to leave a review. Trustpilot then receives your email address and the order confirmation, which includes your name.
- When you cancel a purchase: which purchase it concerns, when you cancelled it, what you paid and what you get back. The data is the basis for the refund and the accounts.
- Your progress in the course: which lessons you have read, which questions you have answered, your results on exercises and mock tests, and when you were last logged in. The data is used to show where you are in the course and what you need to revise.
- Technical data: our hosting provider logs IP address, time, requested page and response code in operational and security logs. We only use the logs for troubleshooting and security.
3. Why we process it
- To fulfil our agreement with you (Article 6(1)(b) of the GDPR): create and manage your account, give you access to the course, save your progress and manage your subscription.
- To reply to your email and keep the site secure (legitimate interest, Article 6(1)(f)): answer questions, correct errors, troubleshoot, prevent abuse and protect our systems. This also covers asking for reviews through Trustpilot.
- To comply with the law (legal obligation, Article 6(1)(c)): keep records for accounting and tax purposes.
4. How long we keep the data
- Account and progress: as long as the account exists. When you close the account, the data is deleted.
- Purchase data: as long as the account exists and thereafter under the accounting rules that apply to us, 7 years after the end of the financial year in which the purchase was made.
- Cancelled purchases: under the same accounting rules, 7 years after the end of the financial year in which the purchase was made.
- Emails: as long as the matter is ongoing, and thereafter for at most 12 months so that we can follow up if you contact us again. Emails about factual errors may be kept longer as a record of the correction, without your personal data.
- Technical logs: according to the hosting provider's standard period, normally at most 30 days.
5. Suppliers and sharing
We only share data with suppliers who process it on our behalf, under data processing agreements, and with authorities when the law requires it.
- Vercel (hosting of the website): technical logs.
- Supabase (database and login, servers in the EU, Ireland): account, password and progress in the course.
- Stripe (payment): payment data. Stripe is an independent data controller for its own processing of card details.
- Hostinger (email): emails to and from info@kansalaisuuskurssi.fi, including order confirmations and reminders.
- Google: handles the login when you choose to log in with Google.
- Trustpilot (reviews): the email address and the order confirmation, to ask you for a review. A review you leave on Trustpilot is processed by Trustpilot as an independent controller.
- Hostinger (the consent log): keeps your cookie choice for at most two years as proof of consent, with a random ID, the time and the address of the page where you chose. Your IP address is not stored.
Some of the suppliers may process data outside the EU/EEA, for example in the USA. In that case the transfer is based on the European Commission's adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses.
7. Security
All traffic to the site is encrypted (HTTPS). Access to the data is limited to the people who need it to run the service. Passwords are stored with one-way encryption by the login provider. In the event of a personal data breach that poses a risk to you, we notify you and the competent data protection authority in accordance with the GDPR.
8. Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access the data we hold about you (a copy of your data);
- have incorrect data corrected;
- have data deleted, except when we must keep it by law, for example accounting records;
- restrict processing in certain situations;
- receive your data in a machine-readable format (data portability);
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the processing before then.
To exercise your rights, email info@kansalaisuuskurssi.fi. We reply as soon as we can and at the latest within one month. If you are dissatisfied with how we process your data, you can complain to the data protection authority in the country where you live. In Finland that is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), P.O. Box 800, 00531 Helsinki, tietosuoja.fi.
9. Changes to the policy
We update the policy when the service changes, or when the law requires it. The current version is always on this page with the date at the top. For major changes that affect you as an account holder, we notify you by email.
10. Contact
Questions about this policy or about your personal data: info@kansalaisuuskurssi.fi, Znoff AB, corporate ID number 559422-8479, Nordgårdsgatan 6J, 412 85 Göteborg, Sweden. The terms for the subscription are on the page terms and conditions.