This Privacy Policy is prepared in accordance with the EU General Data Protection Regulation (2016/679, “GDPR”) and the Finnish Data Protection Act (1050/2018).
In this Privacy Policy, we explain what types of personal data we may collect about you when you order free or paid products or services, subscribe to our content, or contact us through our websites (hereinafter collectively referred to as the “Service”), and how such data is processed.
By using the Service, you agree to the processing of your personal data in accordance with this Privacy Policy.
01Data Controller
Smart Mentoring Oy
Business ID: 3112138-2
Eerikinkatu 32–36, 00180 Helsinki, Finland
02Contact Person for Data Protection Matters
Marianne Lehikoinen
Eerikinkatu 32–36, 00180 Helsinki, Finland
[email protected]
03Register Name
Smart Mentoring Customer and Marketing Register.
04Associated Websites
- www.careergirl.fi
- www.smartmentoring.com
- www.mariannelehikoinen.fi
05Purpose and Legal Basis for Processing
We process personal data for the following purposes:
- Managing and developing customer relationships
- Delivering and billing products and services
- Providing customer support
- Sending newsletters, offers, and marketing communications
- Conducting surveys, campaigns, and events
The legal bases for processing are:
- Contract performance (Article 6(1)(b) GDPR)
- Consent (Article 6(1)(a) GDPR)
- Legal obligation (Article 6(1)(c) GDPR, e.g. accounting obligations)
- Legitimate interest (Article 6(1)(f) GDPR, e.g. direct marketing to existing customers)
06Data Categories Processed
Customer Data Register
- Name, email, phone number
- Billing and delivery details
- Contract and order history
- Communication records
- National identity number — processed only where necessary for invoicing or legally required identification (Finnish Data Protection Act 1050/2018, Section 29)
Newsletter Subscriber Register
- Name and email address
- Subscription preferences and engagement history
Event and Coaching Recordings
- Voice and video recordings from online meetings, with prior consent
We do not store users’ credit card or banking details on our servers.
07Sources of Data
- Information provided by the customer at the time of purchase or registration
- Newsletter subscription forms on our websites
- Data generated during the use of our services (e.g. event participation, meeting recordings)
08Retention of Data
Personal data is retained only as long as necessary for the purposes described above, after which it is deleted or anonymized.
- Customer contracts and billing data: 7 years (as required by the Finnish Accounting Act)
- Newsletter subscriber data: until consent is withdrawn
- Meeting recordings: retained for the duration of the active customer relationship until the customer requests the deletion of their personal data
- Customer data and communications: retained for the duration of the active customer relationship until the customer requests the deletion of their personal data
09Disclosure and Transfer of Data
We do not sell personal data to third parties. Data may be disclosed to service providers acting on our behalf, strictly under data processing agreements.
Personal data may be transferred outside the EU/EEA when using third-party tools. Such transfers are based on the EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs) to ensure adequate protection.
Examples of processors
Used for managing newsletters and email marketing. It processes personal data such as names, email addresses, and engagement information (opens, clicks). ActiveCampaign may transfer data outside the EU/EEA, in which case transfers are based on the EU–US Data Privacy Framework and, where applicable, the EU Standard Contractual Clauses (SCCs).
More information: ActiveCampaign GDPRUsed for email communication and document and file management. It may process customer contact details and contract-related documents. Data may be transferred outside the EU/EEA, based on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: Google Cloud PrivacyUsed for targeted advertising and marketing analytics. These platforms may receive limited personal data (e.g. hashed email addresses) to create audiences and measure advertising effectiveness. Transfers outside the EU/EEA are based on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: Meta Privacy, Google PrivacyProcesses personal data necessary for payment transactions, such as payment method and transaction reference details. Smart Mentoring does not store card details in its own systems. Stripe may transfer data outside the EU/EEA, relying on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: Stripe Privacy PolicyUsed for invoicing and financial management. It processes billing and contract-related customer data on behalf of Smart Mentoring. Data is stored within the EU/EEA and is not transferred outside the EU/EEA.
More information: Netvisor PrivacyUsed for customer relationship management, communications, and marketing automation. It may process personal data such as names, email addresses, phone numbers, and customer communications. Data may be transferred outside the EU/EEA, relying on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: GoHighLevel PrivacyUsed for tracking and analyzing marketing activities. It may collect data such as website visitor information, email addresses, and purchase history for attribution and targeted marketing. Data may be transferred outside the EU/EEA, relying on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: Hyros PrivacyUsed for analytics and video meeting recordings. It may process personal data such as audio, video, and communication metadata. Data may be transferred outside the EU/EEA, based on the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.
More information: Fathom PrivacyUsed for internal communication and team collaboration. It may process personal data such as names, email addresses, messages, and file attachments. Slack may transfer data outside the EU/EEA, relying on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: Slack Privacy PolicyUsed to help prepare client materials, messages, and content. It may process business and contact information to the extent it is provided for processing. Claude does not have standing access to our systems — access is granted separately for each specific purpose. Data may be transferred outside the EU/EEA, based on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (SCCs).
More information: Anthropic Privacy PolicyUsed to manage customer data, notes, and internal materials. It may contain name, contact, and contract information, as well as national identity numbers related to invoicing. Data may be transferred outside the EU/EEA, based on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses (SCCs).
More information: Notion Privacy PolicyUsed for LinkedIn outreach and lead management. It may process name, title, and company information.
More information: Waalaxy Privacy PolicyUsed for the electronic signing of contracts. It processes the name and contact details of signatories, the contract documents themselves, and — for advanced or qualified signatures — national identity numbers and dates of birth. Most processing takes place within the EU/EEA, but SignHero uses sub-processors including Stripe (payment processing) and SendGrid (email delivery), both located in the United States. To that extent, data may be transferred outside the EU/EEA, based on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs).
More information: SignHero Privacy Policy & Data Processing Addendum10Use of Artificial Intelligence in Personal Data Processing
We use AI-assisted tools (such as Claude by Anthropic) to help prepare client materials and communications. AI is used to compile, compare, and draft content — final decisions and content are always reviewed by a human. AI tools do not have standing access to our systems; access is granted separately for each specific task. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.
Where a client shares information about their own customers during sessions or messages (e.g. names or call recordings), we aim to minimize the extent to which such third-party personal data reaches our AI tools.
11Data Security
- Access to personal data requires a username and password.
- Data is stored in secure systems with encryption where applicable.
- Only authorized personnel have access to registers.
12Rights of the Data Subject
Under GDPR, you have the following rights:
- Right to access your data (Art. 15)
- Right to rectify inaccurate data (Art. 16)
- Right to erasure — “right to be forgotten” (Art. 17)
- Right to restrict processing (Art. 18)
- Right to data portability (Art. 20)
- Right to object to processing, including direct marketing (Art. 21)
- Right to withdraw consent at any time (Art. 7)
You may exercise your rights by contacting us at [email protected]. We will respond within one month.
If you believe that your rights under data protection law have been violated, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland.
13Cookies
Our websites use cookies and similar technologies to:
- Enable site functionality
- Analyze visitor statistics
- Provide targeted advertising
We request your explicit consent for non-essential cookies (marketing and analytics) via a cookie banner. You can change or withdraw your consent at any time through your browser settings or the cookie banner.
Disabling cookies may affect the website’s functionality.
14Recording of Coaching Sessions and Meetings
- Certain sessions may be recorded for quality assurance, training, or contractual purposes.
- Recordings may contain personal data (voice, image, chat messages).
- Recordings are stored securely and not shared with third parties unless required by law.
- Participants are informed in advance, and consent is requested. If you do not wish to be recorded, please notify us before the meeting.
15Earnings Disclaimer
Our services aim to provide tools and strategies for personal and professional growth. We do not guarantee specific business or financial outcomes. Any income examples are illustrative only. Your results depend on your own efforts, market conditions, and other factors beyond our control.
16Contact
For questions about privacy or this register, please contact
[email protected]