Privacy policy
Last updated: 12 November 2026
This policy explains what personal data Finish by Five collects, why, and what your rights are.
Who we are
- Finish by Five is run by Luca Luis Paul Woolls de Freitas Costa, a sole trader based in the UK.
- We are the "controller" of your personal data.
- Contact: lucadecosta@gmail.com
- Postal address: Finish by Five, c/o ENL Marketing Ltd, Suite A, 82 James Carter Road, Mildenhall, IP28 7DE
- ICO registration number: [ICO NUMBER]
What we collect
When you sign up for the free prompt sheet
- Your name and email address.
- Your trade, if you tell us.
When you buy the course, the Trade Pack or a done-for-you package
- Your name, email address and billing address.
- What you bought, when, and how much you paid.
- Payment is handled by Stripe. We never see or store your full card details.
When you apply for Build
- Your name, email, business name and type of business.
- Your phone number, if you give it.
- Your answers about team size, what takes your time, and budget.
- We store these in MailerLite, in a separate list. We don't add you to our marketing emails unless you sign up for them yourself.
When you use the website
- Your login email, and which lessons you have opened.
- Technical data such as your IP address, browser and device.
- Cookies. See our cookie notice.
When you email us
- Your message and anything you include in it.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Give you access to the course and anything else you buy | Contract |
| Take payment and handle refunds | Contract |
| Keep financial records for tax | Legal obligation |
| Send the free prompt sheet and our follow-up emails | Consent |
| Review your Build application and contact you about it | Steps before a contract |
| Reply to your questions | Legitimate interests |
| Keep the website secure and prevent fraud | Legitimate interests |
| Measure our ads and improve the website | Consent (via cookies) |
You can stop our marketing emails at any time. Use the unsubscribe link in any email, or email us.
Who we share it with
We only share data with services that help us run the business:
- Stripe — payments.
- MailerLite — email sending.
- Vercel — website hosting.
- Supabase — the members area and login.
- Resend — login emails.
- Bunny.net — course video hosting.
- Meta (Facebook and Instagram) — ad measurement, only if you accept marketing cookies.
- Our accountant, and HMRC where the law requires it.
We do not sell your data.
Data sent outside the UK
- Some of these services store data outside the UK, including in the EU and the USA.
- Where they do, they use legal safeguards approved under UK law, such as the UK International Data Transfer Addendum or the UK–US data bridge.
How long we keep it
- Customer and payment records: 6 years after the end of the tax year, as HMRC requires.
- Course access: for as long as the course runs, or until you ask us to close your account.
- Email list: until you unsubscribe. After that we keep only your email address, so we don't email you again.
- Build applications that don't go ahead: 12 months.
Your rights
You have the right to:
- See the data we hold about you.
- Have it corrected.
- Have it deleted.
- Restrict or object to how we use it.
- Get a copy in a format you can take elsewhere.
- Withdraw consent at any time.
To use any of these, email lucadecosta@gmail.com. We reply within one month.
Complaints
If you're unhappy with how we handle your data, please tell us first.
You can also complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
Changes
We may update this policy. The date at the top shows the latest version.