Privacy Policy

Finlern provides Finnish language courses and relocation/integration information. This policy explains how we handle personal data when you use our website at finlern.fi / finlern.vercel.app.

Data controller:

Finlern
Tietotie 1, Häme University of Applied Sciences
Valkeakoski 37630, Pirkanmaa, Finland
Email: info@finlern.fi

The only personal data we actively collect is what you choose to submit through our course-enquiry form:

• Full name
• Email address
• Phone number
• Current job status
• Desired occupation
• The course you selected

We do not require an account, do not process payments on this website, and do not use advertising or analytics trackers.

To keep the site and the enquiry form working safely, we also process limited technical security data: your IP address (used to rate-limit and to protect against abuse), and the information that our bot-protection provider, Cloudflare Turnstile, needs to check whether a submission comes from a human rather than an automated script (for example basic device and browser information and interaction with the challenge). Our hosting provider (Vercel) may likewise record standard request data such as IP address and browser type in server logs. These are used only for security and operation, never for profiling or advertising.

We use the details you submit only to respond to your enquiry and, if you proceed, to arrange the course or service you asked about.

• Consent (GDPR Art. 6(1)(a)) — you provide your details and tick the consent box to receive a reply.
• Legitimate interests (Art. 6(1)(f)) — replying to enquiries, and securing the site: bot detection (Cloudflare Turnstile), rate limiting, the Vercel firewall, and server logs, all to prevent abuse, spam, and attacks.
• Contract (Art. 6(1)(b)) — steps you ask us to take before entering a course agreement.

We do not sell or rent your data. We share it only with the service providers needed to operate, and where legally required:

• Vercel — website hosting, edge firewall, and server logs.
• Cloudflare — Turnstile bot verification (to tell humans from scripts).
• Google (Gmail / Google Workspace) — delivering and storing the enquiry email we send ourselves.
• Authorities — only when required by law.

Enquiry details are delivered to our mailbox (info@finlern.fi) and kept there only as long as needed to respond to you and to any reasonable follow-up. We do not run a separate customer database. When you ask us to delete your data, or when we no longer need it, we delete the relevant email(s) and any copies. To request access, correction, or deletion, email info@finlern.fi.

Under the GDPR you may request access to, correction of, deletion of, or a copy of your data, restrict or object to processing, and withdraw consent at any time. Contact us at the address above; we will respond within one month. You may also complain to the Finnish Data Protection Ombudsman ( tietosuoja.fi).

We use reasonable technical and organisational measures, including:

• Encryption in transit (HTTPS/TLS with HSTS).
• Server-side validation and sanitisation of form input, CSRF protection, and a Content-Security-Policy.
• Bot protection (Cloudflare Turnstile) and abuse throttling (application rate limiting plus the Vercel edge firewall / DDoS mitigation).
• Protection against injection in stored data (e.g. CSV formula-injection neutralisation) and log sanitisation.
• Least-privilege access to the mailbox that receives enquiries.

No method of transmission or storage is completely secure; we work to protect your data proportionate to the risk.

Some of our providers (Vercel, Cloudflare, Google) may process data outside the European Economic Area, for example in the United States. Where we do, we rely on appropriate safeguards — such as the EU–US Data Privacy Framework (which Vercel, Cloudflare, and Google participate in) and/or the EU Standard Contractual Clauses — to ensure an adequate level of protection. (Counsel to confirm the current transfer mechanisms for each vendor.)

This website is not directed at children and we do not knowingly collect children’s personal data through it. If you believe a child has submitted data to us, contact us and we will delete it.

We may update this policy to reflect changes in our practices or the law. The “Last updated” date above shows the current version.