Privacy Notice

1. Data controller

FINIDC is a Finnish nonprofit association. FINIDC has not appointed a separate Data Protection Officer. Privacy questions may be sent to the email address above.

2. Why we process personal data

FINIDC uses registration information to:

• understand participants' interests, skills, professional backgrounds and needs;
• contact people about relevant community activities, meetings and events;
• help people looking for work, friends, ideas, cooperation or volunteering opportunities;
• support community participation between Finnish and international backgrounds;
• plan and improve FINIDC's nonprofit activities;
• respond to access, correction, consent-withdrawal and deletion requests; and
• protect and operate the registration service securely.

Registration does not guarantee employment, friendship, membership, placement, funding or any other specific opportunity. FINIDC does not sell personal data or use it for unrelated commercial advertising.

3. Data we collect

Depending on what you provide, FINIDC may process:

• name, telephone number and email address;
• profession, current situation and additional profession information;
• city, interests and preferred language;
• registration, consent and update dates;
• communications about your registration or privacy requests; and
• limited technical information needed for security, such as temporary request counters used to prevent automated or excessive submissions.

Name, profession or current situation, consent, and at least one contact method are required. Other fields are optional unless clearly marked. Please do not enter health information, political opinions, religious beliefs, identity numbers, banking information, passport information or other sensitive information.

4. Legal basis

The principal legal basis is your consent under Article 6(1)(a) of the EU General Data Protection Regulation. You give consent by accepting this notice and submitting the form. You may withdraw consent at any time by emailing info@finidc.org. Withdrawal does not affect processing lawfully carried out before withdrawal.

FINIDC may retain limited information where required by law or necessary to establish, exercise or defend legal claims.

5. How we use and share data

Only authorised FINIDC representatives who need the information for the purposes in this notice may access registration data. FINIDC may contact you about activities or opportunities reasonably connected with the interests you selected.

FINIDC does not sell or rent personal data. Information may be disclosed if required by applicable law, a court or a competent authority.

6. Technical service providers

The service uses Cloudflare infrastructure, including Cloudflare Workers, Cloudflare D1, Cloudflare Access and security controls. Cloudflare processes technical and stored information as necessary to provide, protect and operate these services.

GitHub stores the application source code and runs the deployment process. Registration records are not intentionally stored in the public GitHub repository.

7. International transfers

Some service providers may process information outside Finland or the European Economic Area. Where required, transfers must rely on an applicable lawful mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

8. Retention and deletion

Personal data is kept for no longer than 12 months from the date of registration. If you request deletion earlier, FINIDC will delete it as soon as reasonably possible after verifying your identity.

At the end of the retention period, personal data will be securely deleted or irreversibly anonymised unless continued retention is required by law. FINIDC may retain a minimal record of a privacy request where necessary to demonstrate that the request was completed.

9. Security

FINIDC uses reasonable technical and organisational safeguards, including:

• encrypted HTTPS connections;
• restricted administrator access through Cloudflare Access;
• separation of the public form and protected administration service;
• input validation, request-rate controls and anti-automation measures;
• database access controls and security response headers; and
• restricted caching and indexing of administration pages.

No internet service can be guaranteed to be completely risk-free.

10. Cookies and automated decisions

The public registration page does not intentionally use advertising cookies, analytics cookies or behavioural tracking. Authentication cookies are used only for authorised administrators accessing the protected management service.

FINIDC does not make decisions producing legal or similarly significant effects solely by automated means. The system does not perform automated employment selection.

11. Your rights

Subject to applicable GDPR conditions, you may request:

• confirmation and access to your personal data;
• correction of inaccurate or incomplete information;
• deletion or restriction of processing;
• withdrawal of consent;
• data portability where applicable; and
• the opportunity to object where a right to object applies.

Send requests to info@finidc.org. FINIDC may ask for reasonable information to verify identity and will normally respond within one month.

12. Complaints

You may contact FINIDC first so that concerns can be addressed promptly. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland.

13. Children

FINIDC does not intentionally request unnecessary personal data from children. A child or young person who is uncertain about submitting personal data should ask a parent, guardian or trusted adult for assistance. A parent or guardian may contact FINIDC about a child's personal data.

14. Changes and contact

FINIDC may update this notice when its activities, legal obligations or technical services change. The current version and effective date will remain available through this registration service.

For questions, corrections, withdrawal of consent or deletion requests, email info@finidc.org.