Privacy policy

This notice explains how Rin Academy handles your personal data and the rights you have over it. We process data under the EU General Data Protection Regulation (GDPR) and Finnish data protection law. For cookies specifically, see our Cookie policy.

Who is responsible (data controller)

Rin Academy Oy, registered in Oulu, Finland, is the controller of your personal data. You can reach us about privacy at hello@rinacademy.com. We have not appointed a Data Protection Officer, as we are not legally required to; privacy questions go to the address above.

What we collect and why, and our legal basis

We only collect what we need to run the service. For each purpose, the legal basis under GDPR Article 6 is shown.

• Account details (name, email, password). To create and secure your account and sign you in. Basis: performance of our contract with you.
• Placement answers (level, discipline, experience, goals). To suggest a suitable cohort and adapt your sessions. Basis: performance of our contract.
• Enrolment, attendance, feedback and error log. To deliver your programme and track your progress. Basis: performance of our contract.
• Session recordings. To give feedback and build your error log. Basis: performance of our contract; we rely on your consent where a recording is not strictly necessary, and you may ask us not to record.
• Purchase and invoice records (credits bought, invoices). To take payment and meet accounting and tax obligations. Basis: performance of our contract and our legal obligations.
• Messages between you and your instructor. To support your learning. Basis: performance of our contract. Message contents are end-to-end encrypted.
• Emails we send (verification, reminders, receipts). To operate your account. Basis: performance of our contract; any purely optional updates rely on your consent.

Do you have to provide it

Account and payment details are needed to provide the service; without them we cannot give you an account or a cohort seat. Placement answers and recordings help us teach you well, but you can limit these and we will tell you what that affects.

Who we share it with

We do not sell your data. We share it only with:

• Your instructor and cohort. Other participants of a session can see your name and role in that session.
• Your employer, if they bought your seat: they see attendance and progress, never your recordings or private feedback.
• Service providers (processors) who process data on our behalf under contract: hosting and database (Supabase, Vercel), email delivery (Resend), and video meetings (Google). They may act only on our instructions.
• Authorities, where the law requires it.

International transfers

Some of our providers may process data outside the European Economic Area. Where they do, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses, so your data keeps an equivalent level of protection. Ask us for details at any time.

How long we keep it

We keep your account data while your account is active. Invoice and accounting records are kept for as long as Finnish tax law requires (generally several years). Recordings and the error log are kept for the duration of your programme and a reasonable period afterwards so you can still refer back to them, then deleted. When you close your account we delete or anonymise your data, except records we must keep by law.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we process it;
• receive your data in a portable format;
• withdraw any consent at any time, without affecting past processing.

To exercise any of these, email hello@rinacademy.com. We respond within one month.

Complaints

If you think we have handled your data wrongly, please contact us first so we can put it right. You also have the right to lodge a complaint with the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi), or with the authority in your country of residence.

Automated decisions

We do not make decisions about you by purely automated means, and we do not profile you for advertising.

Changes

If we change this notice in a way that affects you, we will update the date above and, where appropriate, tell you directly.