Home›Privacy Policy
Privacy Policy
This page describes what happens to your information when you use this website or send us an enquiry. It is written to be read, not to be survived.
Last updated 12 October 2026
- Who is responsible for your data
- What we collect, and when
- The legal basis for each use
- Where your data actually goes
- Transfers outside the EEA
- How long we keep it
- Your rights
- Cookies
- Children
- Security, honestly stated
- Changes to this policy
Who is responsible for your data
FinnishLine Growth Oy (Business ID 3209925-2), Helsinki, Finland, is the controller for personal data collected through this website. Its Indian sister company, FinnishLine Edugrowth Private Limited (CIN U85500PB2023PTC060092), Mohali, Punjab, processes the same data when counselling students in South Asia.
There is no statutory Data Protection Officer. Write to contact@finnishline.co with “Data protection” in the subject line and it reaches the people who can act on it.
What we collect, and when
We collect only what you type into a form. There is no account, no login and no tracking profile built from your browsing.
| What | When | Why |
|---|---|---|
| Name, email address, phone number, country | When you submit the contact or application form | To reply to you and to assess whether a programme fits |
| Your education history, intended programme, English test status, funds position | When you submit the application form | To tell you honestly which programmes you are eligible for |
| Anything you write in the message field | When you choose to write it | Because you asked us to read it |
| The page you submitted from, and the time | Automatically, with the form | So we know what you were looking at when you asked |
| Server log data held by our hosting provider, including IP address | On every page request | Security and abuse prevention, by the host rather than by us |
We do not ask for passport numbers, financial account details or identity-document numbers through this website. If a form ever appears to ask you for those, it is not ours.
The legal basis for each use
Under the EU General Data Protection Regulation we must name a lawful basis for every use. Ours:
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and counsel you on programmes | Article 6(1)(b) — steps taken at your request before entering a contract |
| Keep a record of the enquiry in our enquiries sheet | Article 6(1)(f) — our legitimate interest in running an orderly admissions pipeline |
| Send you the confirmation email with your reference | Article 6(1)(b) — it is part of answering the request you made |
| Pass your details to a university when you ask us to apply on your behalf | Article 6(1)(b), and Article 6(1)(a) consent where the university asks for more than the application requires |
| Keep records we are required by Finnish or Indian law to keep | Article 6(1)(c) — legal obligation |
We do not use your data for advertising, we do not profile you, and we make no automated decisions that produce legal effects for you. A person reads every enquiry.
Where your data actually goes
Being specific here matters more than listing categories, so:
- Google Workspace (Google Ireland Limited). Form submissions are written to a Google Sheet and the confirmation emails are sent through Gmail. Google acts as our processor.
- Our hosting provider. Pages are served from a content delivery network, which processes request logs including IP addresses for security and delivery.
- Google Fonts. The site currently loads two typefaces from Google's font service, which means your browser makes a request to Google when a page loads. We are self-hosting these to remove that request — see the open items below.
- FinnishLine Edugrowth Private Limited, India. Our counsellors in Mohali see enquiries so they can answer them.
- Universities you apply to. Only when you have asked us to submit an application, and only what that university's process requires.
We do not sell personal data. We do not share it with advertising networks. We have never done either and there is no business reason we would.
Transfers outside the EEA
Your data reaches India, which the European Commission has not found to provide an adequate level of data protection. That transfer is covered by Standard Contractual Clauses between FinnishLine Growth Oy and FinnishLine Edugrowth Private Limited, supported by access controls limiting the enquiries sheet to named staff.
This arrangement is being formalised and reviewed. Until that review is complete we are telling you plainly that the transfer happens rather than implying it does not.
How long we keep it
| Record | Kept for |
|---|---|
| An enquiry that does not become an application | 24 months from last contact, then deleted |
| An application we submitted on your behalf | 6 years from the end of the admissions cycle, for accounting and dispute records |
| Confirmation and correspondence emails | In line with the record they relate to |
| Server and security logs | As retained by our hosting provider, typically under 30 days |
If you ask us to delete your data sooner, we do, except where we are legally required to keep a record — and in that case we tell you which record and why.
Your rights
If you are in the EU or EEA, the GDPR gives you the rights set out on our GDPR and your rights page, including access, correction, erasure, restriction, portability and objection. That page also explains how to exercise them and how to complain to the Finnish Data Protection Ombudsman.
We extend the same handling to everyone who contacts us, wherever you live. It would be odd to do otherwise.
Cookies
This website sets no advertising or analytics cookies. See the Cookie Policy for what is stored in your browser and why.
Children
This website is intended for people applying to higher education and is not directed at children under 16. We do not knowingly collect their data. If you believe a child has sent us information, write to us and we will delete it.
Security, honestly stated
Enquiries are held in a Google Workspace account with access limited to named staff and two-factor authentication required. Traffic to this site is encrypted in transit.
No system is perfect and we are not going to claim ours is. If we discover a breach affecting your rights we will notify the Finnish Data Protection Ombudsman within 72 hours and tell you directly where the regulation requires it.
Changes to this policy
Last updated 12 October 2026. If we change how we use your data in a way that affects you, we will update this page and change the date. Material changes will be flagged on the page itself.
Questions about anything on this page? contact@finnishline.co