Register and Privacy Notice

This is the register and privacy notice of the ADRA Finland Foundation, prepared in accordance with the Finnish Personal Data Act, Sections 10 and 24, and the EU General Data Protection Regulation (GDPR). Prepared on 30 March 2020.

1. Data Controller

ADRA Finland Foundation Ketarantie 4 E, 33680 Tampere 040 099 2953 www.adra.fi

2. Contact Person Responsible for the Register

Martynas Baltiejus martynas@adra.fi

040 777 5297

3. Name of the Register

Sympatia-Keräys

4. Donating

You can choose either a one-time donation or a monthly donation. You can also choose a specific project or activity as the donation cause. No more than 10 percent of the donated amount is used for fundraising costs.

When you choose a monthly donation, the amount you have selected will be charged from the bank or credit card account you have provided on the 6th day of each month.

5. Payment

Payments for donations made on the website are processed by Verifone Bluecommerce, which is registered in the payment institution register maintained by the Finnish Financial Supervisory Authority. Payments are made through Verifone’s online service, and Verifone Oy will appear as the recipient of the payment on the bank statement or invoice. Verifone transfers the donations received through the service to the ADRA Finland Foundation.

Payment is secure, as all information related to the payment transaction is transmitted using an encrypted connection, so no external party can view the payment details.

Read more about Verifone: https://www.verifone.com/fi/fi/verifone-ecommerce

Payment Methods

On the donation page, you can pay through the Bluecommerce service using online banking credentials, a digital wallet, or payment cards (credit/debit). The following payment methods are available: Osuuspankki, Nordea, Danske Bank, Oma Säästöpankki, Säästöpankki, Aktia, local cooperative banks, S-Pankki, Handelsbanken, Ålandsbanken, MobilePay, Masterpass, as well as Visa, Visa Debit, Visa Electron, MasterCard, and Debit MasterCard cards.

The Siirto service is also available. Payment is completed by phone.

6. Legal Basis and Purpose of Processing Personal Data

The purpose of the register is to maintain the supporter register of the Sympatia Ingathering. People included in the register may be contacted in order to manage the supporter relationship, and to market or provide information about the activities and campaigns of the Sympatia Ingathering by phone, email, online advertising, or postal mail.

Personal data is stored and processed carefully and securely, as required by the EU General Data Protection Regulation (GDPR).

Supporters have the right to request the review, correction, and deletion of their personal data from the register. To exercise the right of access, the registered person must contact the customer service of the data controller.

Customer data in the register is not disclosed to external parties. Personal data is processed within the limits permitted and required by law. Personal data is processed only by the employees of the ADRA Finland Foundation or by employees of limited service providers. These service providers include the suppliers of our customer systems or website platform.

7. Data Content of the Register

The data stored in the register includes:

The supporter’s first and last name, contact details, billing information and payment history, permissions or restrictions regarding contact, and regular sources of information.

The personal data in the register is obtained when the supporter relationship begins and during the relationship, based on information provided by the supporter to the data controller. A supporter relationship begins when the supporter provides their information while participating in activities on the Sympatia Ingathering website or at events, or when the supporter becomes a monthly supporter of the Sympatia Ingathering or makes a one-time donation on the website.

8. Regular Sources of Information

The information stored in the register is obtained from the customer, for example through messages sent via online forms, by email, by phone, through social media services, from agreements, customer meetings, and other situations in which the customer provides their information.

9. Regular Disclosure of Data and Transfer of Data Outside the EU or EEA

Data is not disclosed or transferred outside the EU or EEA.

10. Principles of Register Protection

Any manual material is stored in a locked space accessible only to specifically authorized persons. Digital material can only be accessed by an authorized employee or partner using a personal username and password. Access rights are granted at different levels, and each user is given access that is sufficient for carrying out their duties but as limited as possible.

Register data is stored only in electronic form.

When data is transferred over a network, it is protected using SSL or SSH technology. The server hardware of the register is maintained according to good maintenance practices. Instructions have been provided for the use of the register. Access to the database containing register data is restricted through both network technology and personal usernames and passwords.

The data controller corrects data in accordance with Section 29 of the Finnish Personal Data Act. Requests for correction of data must be addressed to the contact person responsible for register matters.

Maintenance partners are required to apply continuous high-security processing practices. Backups are protected and maintained consistently with the information systems.

Access rights to the register are limited to a restricted group of employees whose duties include using the system. In addition, a limited group of service developers has access to the register.

11. Right of Access and Right to Request Correction of Data

Every person included in the register has the right to review the data stored about them and to request the correction of any incorrect data or the completion of any incomplete data. If a person wishes to review the data stored about them or request its correction, the request must be sent in writing to the data controller.

The data controller may, if necessary, ask the person making the request to verify their identity. The data controller will respond to the customer within the time specified in the EU General Data Protection Regulation, usually within one month.

12. Other Rights Related to the Processing of Personal Data

A person included in the register has the right to request the deletion of personal data concerning them from the register, also known as the “right to be forgotten.” Registered persons also have other rights under the EU General Data Protection Regulation, such as the right to restrict the processing of personal data in certain situations.

Requests must be sent in writing to the data controller. The data controller may, if necessary, ask the person making the request to verify their identity. The data controller will respond to the customer within the time specified in the EU General Data Protection Regulation, usually within one month.