FinPostExpress

FinPost Express Privacy Policy

Last updated: October 14, 2026

This Privacy Policy explains how FinPost Express handles personal data for parcel forwarding from Finland, purchase assistance enquiries and receipt of agreed parcels at a Finnish address through finpostexp.com.

When you use the Website and FinPost Express services, personal data is processed in accordance with the EU General Data Protection Regulation (GDPR), applicable Finnish legislation and this Policy.

1. Data Controller

The data controller is:

FinPost Express
Email for data protection inquiries: [email protected]

A dedicated Data Protection Officer (DPO) has not been appointed at this time; all personal data requests should be sent to the email address above.

2. Personal Data We Collect

When placing an order and using the Website, we may collect:

  • Identification data: first name and last name of the sender and recipient;
  • Contact data: email address, phone number, sender and recipient addresses;
  • Parcel data: description of contents, weight, value, destination country;
  • Additional service enquiries: product links, retailer and order details, and information you include in your message;
  • Customs data: for international shipping, destination customs authorities may require additional information about the sender, recipient and parcel contents (in some cases, identity document data);
  • Payment data: payment transaction data via PayPal or payment card (Visa). Full bank card data is processed directly by the payment system/acquirer and is not stored on FinPost Express servers;
  • Technical data: IP address, device type and browser, cookie data (see Section 7).

3. Purpose of Processing

We process personal data for the following purposes:

  • processing, confirmation, and fulfillment of parcel forwarding orders;
  • reviewing purchase assistance and Finnish parcel address enquiries and agreeing on service terms;
  • customs clearance in the destination country;
  • payment processing and fraud prevention;
  • communicating with the customer regarding the order (status, delays, delivery issues);
  • compliance with legal requirements, including sanctions and export control;
  • operating the Website and providing technical support.
  • measuring visits and successful requests using Google Analytics with your consent.

4. Legal Basis for Processing

Personal data processing is based on:

  • contractual and pre-contractual measures — for reviewing requests, agreeing terms and providing services;
  • legal obligation — for compliance with customs, tax, and sanctions requirements;
  • legitimate interest — for fraud prevention, Website security, and service improvement;
  • consent — for optional cookies and marketing communications (if applicable).

5. Data Recipients

To provide our services, we may share personal data with the following categories of recipients:

  • Logistics and postal partners that carry out physical transportation and delivery in the destination country;
  • Retailers — only when an agreed purchase requires sharing information needed to place the order;
  • Customs authorities of the origin and destination countries — to the extent required for customs clearance;
  • Payment systems (PayPal, payment acquirer for Visa cards) — for payment processing;
  • Government and regulatory authorities — upon lawful request, including for sanctions compliance;
  • Technical service providers (hosting, Website support) acting on our behalf.
  • Telegram Bot API: order or enquiry data is sent through Telegram for internal operational notifications.
  • Google Analytics: website visit and event statistics with your consent. Order form data and messages are not sent to analytics.

We do not sell personal data to third parties and do not share it for purposes unrelated to service provision without the user's separate consent.

6. International Data Transfers

Standard parcel delivery covers the destinations listed on this site. For agreed purchase assistance, we also review shipment to other countries worldwide. Where the destination is outside the European Economic Area (EEA), information necessary about the recipient and item may be shared with logistics partners and customs authorities in that country.

Such transfers are carried out to the extent necessary for contract fulfillment and customs clearance, in accordance with applicable GDPR requirements for cross-border data transfers.

Data submitted through the order and contact forms is also sent through the Telegram Bot API for internal notifications and may be processed by Telegram outside the EEA. See Telegram's Privacy Policy for details.

7. Cookies and Local Storage

The Website uses technical storage for its operation and optional analytics cookies:

  • NEXT_LOCALE: remembers the site language during your browser session when needed for language selection;
  • finpost_form in localStorage: saves a draft of your order form in your browser. It is removed after successful submission or when you reset the form. You can also delete it in your browser settings.
  • finpost_analytics_consent: stores your Google Analytics choice for up to 180 days;
  • _ga and _ga_*: Google Analytics cookies for counting users and sessions, set after consent with a configured lifetime of up to 180 days. They are deleted when consent is withdrawn.

Google Analytics loads only after you allow analytics. We collect page views, devices, referral sources and successful request events. Names, phone numbers, addresses, parcel contents and message text are not included in events. Advertising personalization is disabled. Google processes data according to its privacy policy. Google Search Console separately provides Google search impression and click statistics.

You can change your choice via “Cookie settings” in the footer of any page. Rejecting analytics does not affect ordering or language selection. You can also delete cookies and local data in your browser settings. The custom analytics system is disabled; its old cookies are cleared on visits.

8. Data Retention

Personal data is retained for the period necessary to fulfill the order, resolve potential disputes, and as required by applicable accounting, tax, and customs legislation. After the required period, data is deleted or anonymized.

9. Data Security

FinPost Express takes reasonable technical and organizational measures to protect personal data from unauthorized access, loss, alteration, or disclosure, including restricting access to data and using secure data transmission channels.

10. User Rights

Under the GDPR, you have the right to:

  • access your personal data and obtain a copy;
  • request correction of inaccurate data;
  • request deletion of data (“right to be forgotten”), provided this does not conflict with FinPost Express's legal obligations;
  • restrict processing;
  • object to processing based on legitimate interest;
  • receive your data in a structured format (data portability);
  • withdraw consent at any time if processing is based on consent;
  • file a complaint with the supervisory authority — the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

To exercise these rights, contact us at [email protected].

11. Children

FinPost Express services are intended for individuals over 18 years of age. We do not knowingly collect personal data from minors.

12. Policy Changes

FinPost Express reserves the right to update this Policy periodically. The current version is always published on the Website with the update date. Significant changes will be additionally communicated to users.

13. Contact

For all questions related to personal data processing, please contact:
FinPost Express
Email: [email protected]