Privacy statements

 

Gutsy Go ry’s website privacy statement

Gutsy Go activity and Gutsy Go Event weeks privacy statement (Scroll down) 

 

Gutsy Go ry’s website privacy statement

18.3.2021

1. General

Protecting your privacy and personal data is important to us at Gutsy Go ry (“Gutsy”). This privacy statement describes what personal data Gutsy collects through its website, for what purposes it uses it, and how personal data is protected. The privacy statement also describes your rights as a data subject and how you can contact Gutsy with questions about the processing of personal data.

Gutsy processes personal data in accordance with this privacy statement and applicable data protection legislation.

As a general rule, you may use our website without providing your personal data.

However, you may be asked to provide your personal data, such as your name or email address, for example, when subscribing to a newsletter or logging in to the website. The data we collect for visitor tracking is typically non-personally identifiable. However, this data may also become associated with your personal data if you are logged in to your Google user account while browsing our website or if you end up visiting our site via an email link sent to you in person.

By using our website, you agree to our data processing and privacy practices as set forth in this privacy statement.

2. Registrar

Gutsy Go ry

Business ID 28693144

Address: Sturenkatu 16, FI-00510 Helsinki

3. Contact person in matters related to the register

Gutsy/ Johanna Vanttaja

email: privacy@gutsygo.fi

address: Sturenatu 16, FI-00510 Helsinki

4. Name of the register

Gutsy Go ry’s website data register, which contains the following sub-registers:

  1. Gutsy Go ry’s website user data register
  2. Gutsy Go ry’s licensee register
  3. Gutsy Go ry’s marketing and customer communications register

5. Purpose and legal basis of the processing of personal data

Personal data is processed

  1. For marketing purposes and to enable customer communication. For example, data can be analysed and processed to target marketing and communication and to develop the registrar’s business.
  1. To implement services. Your personal data is processed, for example, to enable the licensee to log in to the system and to identify the user. 
  1. To improve the website user experience and develop operations.

The processing of personal data is based on

  1. The legitimate interest of the registrar
  2. Contract
  3. Consent, contract and/or legitimate interest of the registrar

6. Register privacy statement

The following personal data may be stored in the register:

  1. Visitor’s IP address, time of visit, browser type, operating system, how the visitor came to the site (search engine, direct link, etc.), previous web pages used and visits to Gutsy’s website
  2. Name, email, job information (which school, which subject teacher)
  3. Name and email address

Photos and videos may be stored in the website register.

7. Regular data sources

The data in the register is generally obtained

    1. Automatically through cookies directly from the data subject him/herself
    2. Directly from the data subject him/herself after receiving the data from public data sources of the school he/she represents
    3. Directly from the data subject him/herself, for example in connection with a newsletter subscription

8. Regular disclosures

Data in the register is not regularly disclosed to third parties.

However, Gutsy may use service providers to assist in the processing of personal data for the purposes described in section 5 of this privacy statement. Gutsy has agreed to process personal data only with trusted service providers and partners who have in place appropriate technical and organizational measures to protect personal data.

Personal data is also processed by Google Analytics, which transfers the information to Google LLC.

9. Disclosure of data outside the EU or the EEA

As a general rule, personal data will not be transferred outside the EU or the European Economic Area.

In contrast, Gutsy uses Google Analytics and the MailChimp service platform on its website to transfer data about the use of the website to Google LLC and MailChimp LLC, which are part of the EU-US Privacy-Shield.

10.  Retention period of personal data

Personal data is only retained for the time necessary to fulfil the purpose for which the personal data are processed. The registrar will delete outdated and unnecessary personal data from the register on its own initiative.

    1. The data is only retained for as long as the purposes described in this privacy statement so require. A subscriber to a newsletter may announce that he/she will leave the list of recipients of the newsletter, in which case Gutsy will delete the data of the subscriber of that newsletter within a reasonable time.
    2. As a general rule, the data is retained for as long as the license agreement is in force. Upon termination of the agreement, personal data may be retained for as long as the parties have the possibility to bring legal actions against each other or for as long as the statutory obligation of the registrar so requires.
    3. As a general rule, the data is kept as long as the data subject belongs to the marketing target group. The data is then deleted. Data about the licensee is retained as noted in section b above.

11. Principles of register protection

Only the registrar and specifically designated persons have access to the register data. Only specifically designated persons have the right to process and maintain the data in the register. Those entitled to access the data are bound by confidentiality obligations.

Information systems and ICT equipment on which the data in the register is located are protected by a firewall and other technical measures. Manual material is stored in locked rooms.

12. Cookies and their use

We use cookies on our website (www.gutsygo.fi) to improve the user experience of our website and to provide better services.

12.1 What are cookies?

Cookies are small text files that the browser stores on the user’s device, either permanently or so that they are deleted after using the service. Data obtained through cookies includes, for example, the IP address of your computer, the type of browser, the time when you visited our website and from which website you came to our website.

Our website may also use third-party cookies. You can find information about these cookies on each party’s own website. For example, the Gutsy website uses Google Analytics tracking software. Google Analytics uses cookies for this purpose, whereby the data created through the cookies is transferred to Google.

Further information: Google privacy policy and Google Analytics privacy and security policies and MailChimp policies      

12.2 How to prevent the use of cookies?

We collect data about you through cookies if you have accepted it, for example by giving your consent or changing the settings of a web browser or other application. Many browsers automatically accept cookies.

If you want to prevent Gutsy from storing cookies, you can disable cookies by changing the settings of your web browser or other application. To prevent your data from being collected through Google Analytics, you can download the Google Analytics Opt-out Browser add-on. Please note that deleting cookies may interfere with your use of certain of our pages.

13. Rights of data subjects

13.1. Right of access to personal data

The data subject has the right to know what data about him/her has been stored in the register or that the register does not contain data about him/her.

The data subject must submit a request for inspection with a signed document or an equally certified document. The request is addressed to the register contact person. The inspection request is free of charge up to once a year (12 months).

13.2. Right to request rectification of data

The data subject has the right to request the registrar to correct inaccurate or incorrect data concerning him/her.

The request for rectification must be made in writing and in a sufficiently specific manner to comply with the request: the request must include at least the name of the data subject, inaccurate or incorrect data and supplemented or corrected data. The request is made with a signed document or an equally certified document. The request is addressed to the register contact person at privacy@gutsygo.fi.

13.3. Right to request restriction of processing or deletion of data

The data subject’s right to request the restriction of processing or the deletion of data is not an absolute right, but the data subject can only exercise these rights in limited situations.

The data subject has the right to request the restriction of the processing of personal data, for example in a situation where the data subject is awaiting a response from the registrar to a request to rectify or delete his/her data.

The data subject has the right to request the registrar to delete his/her data, for example if 1) personal data are no longer needed for the purpose for which they were collected or processed or 2) the data subject withdraws his/her consent and there is no other legal basis for processing the personal data.

A request to restrict the processing or delete data shall be addressed to the contact person of the register. If the data subject’s data request on his/her rights is not granted, the person shall be given a reasoned statement stating the reasons why the request has not been accepted.

13.4. Right to object the processing of data

The data subject has the right to object to the processing of personal data if, for example, the data subject considers that the registrar has processed his/her personal data unlawfully or that the registrar has no right to process some of his/her personal data.

A request to restrict the processing or delete data shall be addressed to the contact person of the register. If the data subject’s data request on his/her rights is not granted, the person shall be given a reasoned statement stating the reasons why the request has not been accepted.

13.5. Right to lodge a complaint to a supervisory authority

The data subject has the right to lodge a complaint to the supervisory authority if he/she considers that the registrar has not complied with the applicable data protection provisions in force.

14. Changes to the privacy statement

Gutsy reserves the right to update the statement to meet its legal obligations. Changes may be necessary, for example, due to changes in applicable legislation or changes in Gutsy’s operations.

Gutsy Go activity and Gutsy Go Event weeks privacy statement

Last updated on 18.3.2021

1. General

Protecting your privacy and personal data is important to Gutsy Go ry and Gutsy Media Oy (“Gutsy”).

Gutsy Go is a movement for courageous societal peace acts that gives young people the tools to do good deeds for their own community. Solutions are devised during event weeks in schools, after which the solutions are tangibly implemented.

The good deeds of young people are filmed and collected in digital form on the internet on the Gutsy Go platform to inspire others to take action to develop their neighbourhood. Gutsy Go Event weeks are carried out together with Gutsy Go ry, Gutsy Media Oy and various cities and educational bodies. 

This privacy statement describes what personal data Gutsy collects in connection with the Event weeks, for what purposes it uses it, and how personal data is protected. The privacy statement also describes your rights as a data subject and how you can contact Gutsy with questions about the processing of personal data.

In the event of a conflict between the different language versions of this privacy statement, the Finnish version shall prevail.

2. Joint registrars

Gutsy Go ry

Reg. ID: 2869314-4

Gutsy Media Oy

Business ID: 2743496-8

Sturenkatu 16, FI-00510 Helsinki

3. Contact person in matters related to the register

Johanna Vanttaja

privacy@gutsygo.fi

4. Name of the register

Gutsy Go activity and Event week data register, which contains the following sub-registers:

A) Media publications data register

b) School contact person register

c) Partner data register

5. Data content of the register

a) The following personal data may be stored in the data register of media publications

  • Photographs and/or video of the data subject 
  • First and last name of the data subject and/or that of the data subject guardian
  • Email address of the data subject and/or that of the data subject guardian
  • Phone number of the data subject
  • Class and school name of the data subject

a) The following personal data may be stored in the data register of school contact persons

  • Contact details of the school personnel (first and last name, email address, phone number) 

The following personal data may be stored in the data register of partners

    • Contact details of the contact persons of the city/place-specific business partners (first and last name, email address, phone number) 

6. Purpose and legal basis of the processing of personal data

a) Personal data is processed for the purpose of organizing the Gutsy Go activity and the Event week. Photos and videos are published on the Gutsy Go platform and other selected platforms so that anyone can be informed about opportunities to change their own neighbourhood and community and be inspired to take action themselves. Gutsy is responsible for not publishing photos or videos that are likely to cause damage or suffering to the subject of the photo.   

The processing of personal data is based on the data subject’s consent if the data subject is over 13 years of age and if it is concretely possible to obtain consent from the data subject. Personal data is not, in principle, processed for marketing purposes. If photos or videos are processed for marketing purposes, Gutsy must always separately seek consent from the data subject to do so. The processing of personal data may in some cases also be based on the legitimate interest of the registrar.

The processing of personal data with regard to the personal data of persons under 13 years of age is generally based on the consent of the data subject’s guardian. The processing of personal data may in some cases also be based on the legitimate interest of the registrar.

b) Personal data is processed in order to organize Gutsy Go activity and the Event week and to allow communication between Gutsy and the school. 

The processing of personal data is based on an agreement between Gutsy and the school involved in Gutsy Go activities and the Event week. Each person participating in the filming is asked for a written consent to the processing of personal data.

(c) Personal data is processed in order to plan, develop and organize Gutsy Go activities and the Event week and to enable cooperation and related communication. In addition, personal data is processed in accordance with Chapter 2, Section 4, Clauses 3) and 4) of the Data Protection Act. 

The processing of personal data is based on an agreement between Gutsy and the partner, as well as the Data Protection Regulation and the Data Protection Act.

According to Chapter 2, Section 4), Clauses 3) and 4) of the Data Protection Act (1050/2018), the registrar has the right to retain and use the filmed and stored material for social communication and research, for the preservation of cultural heritage material and for other purposes mentioned in the regulations.      

7. Regular data sources

a) The data in the register is, as a general rule, obtained from the data subject him/herself. Data on a person under the age of 13 is generally obtained from the data subject’s guardian. 

Permission to photograph, interview, and publish material on a digital platform or in other contexts is sought in writing prior to the start of each Event week. 

(b) The data in the register is, as a general rule, be obtained from the data subject him/herself in connection with the conclusion of the agreement and the related communications. In some cases, data about the data subject can also be obtained from public data sources of the school.

a) The data in the register is, as a general rule, obtained from the data subject him/herself. In some cases, data about the data subject can also be obtained from public data sources.

8. Regular transfers and disclosures

Register data, such as a video of the data subject, may be published on the Gutsy Go digital platform and/or other publication channels of Gutsy Media. 

Gutsy may use third-party service providers to assist in the processing of personal data for the purposes described in this privacy statement. Gutsy has agreed to process personal data only with trusted service providers and partners who have in place appropriate technical and organizational measures to protect personal data.

At the moment, personal data is processed on behalf of Gutsy by:

  • Google LLC (Google G Suite)
  • Wevideo inc.
  • Gutsy may also have other processors of personal data

Please note that the list of personal data processors may be updated as necessary.

9. Disclosure of data outside the EU or the EEA

Gutsy may transfer personal data to service providers acting on its behalf located outside the EU or EEA for the purposes described in this privacy statement. 

If personal data needs to be transferred outside the EU for the purposes set out in this privacy statement, Gutsy will ensure that: 

    • the transferee is Privacy Shield certified (US-based transferees);
    • the transfer takes place using model clauses published by the EU Commission; or
    • The EU Commission has confirmed adequate level of data protection for the country. 

10. Retention period of personal data

Personal data is retained for as long as is necessary to fulfil the purposes described in this privacy statement.

11. Principles of register protection

The data in the register can only be accessed by the registrar and specifically designated persons, as well as by the outsourced service provider as the data processor. Only designated persons have the right to process and maintain the data in the register. Users are also bound by professional secrecy. 

Information systems and ICT equipment on which the data in the register is located are protected by a firewall and other technical measures. ICT devices are located in a locked and supervised space and can only be accessed with personal usernames and passwords.

Manual material is stored in locked rooms.

12.  Rights of data subjects

12.1 Right of inspection of the data subject

The data subject has the right to know what data about him/her has been stored in the register or that the register does not contain data about him/her.

12.2 Data subject’s right to request the rectification of data 

The data subject has the right to request the registrar to correct inaccurate or incorrect data concerning him/her.

12.3 Right to request restriction of processing or deletion of data

The data subject’s right to request the restriction of processing or the deletion of data is not an absolute right, but the data subject can only exercise these rights in limited situations.

The data subject has the right to request the restriction of the processing of personal data, for example in a situation where the data subject is awaiting a response from the registrar to a request to rectify or delete his/her data.

The data subject has the right to request the registrar to delete his/her data, for example if 1) personal data are no longer needed for the purpose for which they were collected or processed or 2) the data subject withdraws his/her consent and there is no other legal basis for processing the personal data.

12.4 Right to object the processing of data

The data subject has the right to object to the processing of personal data if, for example, the data subject considers that the registrar has processed his/her personal data unlawfully or that the registrar has no right to process some of his/her personal data.

12.5 Right to withdraw consent

When personal data are processed on the basis of the data subject’s consent, the data subject has the right to withdraw his/her consent. 

12.6 Right to lodge a complaint to a supervisory authority

The data subject has the right to lodge a complaint to the supervisory authority if he/she considers that the registrar has not complied with the applicable data protection provisions in force.

13. Contact in matters related to the register

Gutsy undertakes, without undue delay, on its own initiative or at the request of a person entered in the register, to exercise the rights of the data subject described below. If the data subject’s data request on his/her rights is not granted, the person shall be given a reasoned statement stating the reasons why the request has not been accepted.

The data subject must prepare a request for his/her rights in sufficient detail to comply with the request. In addition, the data subject must be identified with sufficient certainty. Gutsy may ask the data subject to clarify the request for his/her rights or provide a more reliable statement of his/her identity. 

Request for the processing of personal data or the rights of the data subject is addressed to the contact person of the register by email at privacy@gutsygo.fi 

14. Changes to the privacy statement

Gutsy reserves the right to update the statement to meet its legal obligations. Changes may be necessary, for example, due to changes in applicable legislation or changes in Gutsy’s operations.