Teoriavalmis privacy notice

• ✓
  Account and communication

  Personal data includes your account identity, email address, sign-in status and access rights, so that we know who may use which practice content.

• ✓
  Free trial and selected category

  The free trial stores the licence category chosen by the user, the start and end time of the trial, the trial status, progress in the limited content and any later conversion into access to the whole category.

• ✓
  Category licence and paid access

  For a paid purchase, we store the buyer’s name, confirmed email address, country and postcode, selected product and price, agreement and consent details, payment and refund references, and the category and validity dates of access. Card details and online banking credentials are not stored in Teoriavalmis. For a guardian’s purchase, the buyer and learner are linked separately; the learner does not receive the guardian’s payment details, and the buyer does not receive the learner’s answers.

• ✓
  Practice data

  We store progress, the parts of the study material you have read, the version of the time requirement derived from the material's length and whether it has been met, the longest active reading time in a single visit, answer history, Questions results and practice exam results. We do not store mouse movements, keystrokes or raw scroll logs.

• ✓
  Question analytics

  Personal answer history belongs to the learner's own space in the service. Administrators may use aggregated question statistics, or question statistics separated from users' identifying data, to assess the quality and difficulty of questions and to identify unclear points.

• ✓
  Marketing consent

  When the category is chosen for the trial, we may store whether consent to marketing emails was given, where it was given, the consent text used and when it was recorded.

• ✓
  Feedback from your profile

  When you send feedback from the My profile page, we store the message (up to 1,000 characters), the time it was sent, its forwarding status and which account it came from. Your email address is not stored in the database with the feedback; it is added only to the message forwarded to the administrators.

• ✓
  Trial feedback survey

  For an answer to the survey shown at the end of the trial, we store the date of the answer, the option chosen and an optional comment. The answer is not linked to your account, your email address or the exact time it was sent. Your account only records that the survey has already been shown, so that it is not shown again. Do not include personal data in the comment.

• ✓
  Reports, logs and the Learning Guarantee

  Question reports, records of administrative actions, audit and security logs, and the handling records of any Learning Guarantee request help us correct content, protect the service and resolve support requests.

1. Contract and use of the serviceProcessing of the account, trial access, category licence, progress, answer history and Questions results is necessary for Teoriavalmis to provide the digital service you have requested.
2. Legitimate interestSecurity logs, investigation of misuse, handling of question reports and feedback, replying to feedback, general server-side usage figures and question analytics support the security, quality and development of the service. You can object to processing based on legitimate interest by contacting the controller.
3. ConsentUsage measurement with Google Analytics 4 and marketing emails require separate consent. Advertising storage, Google Signals, User-ID, Google Ads linking, remarketing audiences and advertising conversion APIs are not used.
4. Legal obligationsData relating to accounting, consumer protection, possible complaints and requests from authorities is processed to the extent that those obligations require.

On the list of trial leads, administrators can see the account's email address, the chosen licence category, the trial status, its end time, the most recent activity and whether consent to marketing emails has been given.

In licence, support and Learning Guarantee cases, administrators can check access rights, the progress relevant to the support request, passed practice exam attempts, security logs and the information needed to make a decision.

The list is used for follow-up and manual support. The service includes no lead scoring and no automated marketing emails.

Feedback sent from the My profile page is used to develop the service and to reply to the person who sent it. No more than five pieces of feedback can be sent from the same account per day. Sent feedback is not shown to anyone in the app, including the sender.

Feedback is forwarded on a schedule, usually once a night, to a private Slack channel for the Teoriavalmis administrators. The message shows when the feedback was sent, your account's email address at the time of forwarding and the text of the feedback. The email address is retrieved from the account details only when the feedback is forwarded, so that we can reply to it.

Answers to the trial feedback survey are forwarded to the same channel without account or email details.

• ✓
  Essential service data

  Account, session, trial access, licence, progress, answer history, Questions results and security logs are part of how the requested service works.

• ✓
  Learning quality analytics

  Question statistics are used in aggregate or without users' identifying data to improve the quality of the content, not for marketing profiling of individual learners.

• ✓
  General server usage statistics

  Netlify compiles general aggregate data on the server, such as page loads, the most popular pages and traffic sources. Teoriavalmis does not set an analytics cookie or its own visitor identifier in your browser for this purpose. IP address and device data that form part of an ordinary web request are nevertheless processed briefly to deliver and protect the service.

• ✓
  Optional Google Analytics

  Google Analytics 4 loads only when you select Allow Google Analytics. It measures views of permitted public pages and the start of a trial. When payments are enabled, it also measures the start of checkout and confirmed purchases. Purchase data includes the access package, value excluding tax, tax, currency and a random payment transaction identifier to prevent duplicate purchase records. The buyer’s details and the order’s web address are not sent. The app’s study, administration and content pages, questions, answers, email addresses, and user or trial identifiers are not sent to Google. Advertising-related storage and personalisation remain blocked.

Teoriavalmis’s technical service providers may process data only to provide the service. The service uses Netlify to deliver the web service, Supabase for authentication, the database and private file storage, Brevo for sign-in messages, Slack to relay feedback to administrators and, with consent, Google Analytics 4 for usage measurement. When payments are introduced, Visma Pay processes payments and Brevo delivers the buyer’s agreement and receipt messages. Agreement and financial documents are stored in a private document archive. These providers receive the data needed for their tasks. Introducing payments does not change marketing consent.

Personal data is not sold or disclosed to marketing networks. If data is transferred outside the EU/EEA, the basis and safeguards for the transfer are checked before production use.

Opens and link clicks in agreement and receipt messages are measured as anonymised aggregate statistics in Brevo. Messages may contain tracking pixels and links routed through a measurement service. The measurements are not used to profile individual recipients. Sending and delivery data is processed separately to ensure delivery.

1. Learning progress and performance dataKept for no more than 12 months after access ends, unless erasure is requested earlier or another basis for processing applies.
2. Accounts, trial access and licencesKept for no more than 24 months after the most recent sign-in or the end of the most recent access, whichever is later, unless legislation or an open support case requires longer retention.
3. Marketing consent eventsKept for as long as is required to demonstrate consent, to respect its withdrawal or for communication logs. Consent can be withdrawn at any time.
4. Purchases and accounting recordsDeleting an account does not delete receipts, payment and refund records or their supporting agreement evidence that must be retained by law. Supporting documents and correspondence relating to business transactions are retained for at least six years from the end of the year in which the relevant financial year ended. Accounting records are retained for at least ten years from the end of the financial year. Material supporting an entry in a later financial year is also retained for the period required by that entry. Only authorised persons can access the material.
5. Expired unpaid ordersPersonal data and agreement documents for an order that has definitely ended without payment are deleted in daily automated runs 12 calendar months after the order ended. Because of payment safety checks, deletion is normally completed within two days of that limit. An unclear payment or an open dispute is resolved before deletion. When data is restored from a backup, expired personal data is deleted before the data is put back into use. This deletion does not cover statutory financial records for paid purchases.
6. FeedbackFeedback sent from the profile remains linked to the account in the database after it has been forwarded and is deleted when the account is deleted. The copy forwarded to Slack is deleted within 12 months at the latest. Deleting the account does not automatically delete the Slack copy; you can also request its deletion. Responses to the trial feedback survey are deleted within 12 months at the latest. They are not linked to the account, so they are not deleted with it.
7. Audit and security logsMay be kept for no more than 24 months to investigate misuse, protect the service and verify administrative actions.
8. Question error reportsThe report’s free text and technical reporter identifier are deleted within 12 months at the latest. Counts relating to the question and error category may be retained without identifiers to monitor content quality. When account deletion is requested, personal data in the account’s reports is deleted separately.
9. General usage figures and analyticsTrial and licence numbers are calculated from the service's actual access records. The event-level retention period in Google Analytics 4 is 14 months. Netlify's server-side site aggregates and infrastructure logs follow the provider's current retention periods.
10. Learning Guarantee materialLearning Guarantee requests are handled through the support email info@teoriavalmis.fi. The raw result image or screenshot is deleted no later than 30 days after the decision. Metadata about the decision may be kept for no more than 24 months for auditing, refunds and support.

Send a Learning Guarantee request to the support email address info@teoriavalmis.fi. In your message, state your driving licence category, the date and time of the official theory test in Finnish time (Europe/Helsinki), evidence of the failed result, the compensation requested and a short description of the topic or section where you need support.

Cover your personal identity code and any other unnecessary identifiers before sending the attachment. Do not send questions, answer options or any other content from the official theory test.

You can request access to your data, rectification of inaccurate data, erasure of data or restriction of processing, object to processing, or ask about transferring your data by sending a message to info@teoriavalmis.fi.

Not all data can be erased immediately if an open support case, an investigation of misuse, an accounting obligation, a consumer dispute or another statutory ground requires it to be kept.

If you are not satisfied with the response, you can contact the Office of the Data Protection Ombudsman.