Privacy Policy

1. Who we are

MyData Global is an international nonprofit, whose mission is to empower individuals by improving their right to self-determination regarding their personal data.

Our office address is:
MyData Global ry
Maria 01
Lapinlahdenkatu 16
00180 Helsinki
Finland

Our website address is: https://www.mydata.org.

2. Websites within scope

The following websites are within scope for this privacy notice:

• MyData Global organisation: www.mydata.org
• Any subdomains of mydata.org, such as 2022.mydata.org, online2020.mydata.org
• Older conference sites: mydata2019.org, mydata2018.org, mydata2017.org, mydata2016.org

We consider these websites to be EU-based websites; see section 4 below for more information on non-EU data storage.

3. Collection of personal data

We collect personal data from you for one or more of the following purposes:

• To provide you with information that you have requested (such as conference updates through our newsletter);
• To initiate and complete commercial transactions with you, or the entity that you represent, for the purchase of products and/or services (such as conference passes);
• To fulfil a contract that we have entered into with you or with the entity that you represent (such as partnership agreements);
• To manage any communication between you and us (such as replying to contact form submissions).

4. Storage of personal data

MyData Global ry is an EU-domiciled organisation whose primary offices are in Finland. Personal data may be nevertheless transferred outside the European Union or the European Economic Area.

• Our websites are hosted in the EU. In addition to our EU-based staff, they may be accessed by staff and/or volunteers based outside of the EU if deemed necessary.
• This website and the member registry are hosted in the Netherlands by Greenhost BV.
• Other services we use to process personal information of members: Google Workspace (privacy policy), Slack (privacy policy), Airtable (privacy policy), Typeform (privacy policy).
• We use an ethical analytics tool, Matomo Analytics Ethical Stats (more information), to understand how visitors are accessing our website so that we can improve the user experience. This is installed within our website and does not use external hosting. All analytics data is stored within our own website and no data is shared with any third parties under any circumstances. You can opt out using the form at the bottom of this page.
• Our local hubs may use their own tools to process member data that members have agreed to share with the hubs.
• Our payment processors and banking arrangements are provided by Nordea, Procountor, Holvi, Stripe and Transferwise.
• Individual register descriptions define how we collect, store and/or process personal information.
• Data is stored for the minimum time necessary and at most, for 1 (one) year from last interaction with the collected data.

5. Lawful basis for the processing of personal data

Our organisation’s infrastructure means that all personal data is processed on common platforms. We have processes in place to make sure that only those people related to the organisation (staff, board, steering group), who need to access your data can do so. By default, only the organisations’ staff have access to all collected personal data and others, such as board and steering group members, as well as our volunteers, are granted access on an as-needed basis.

Some data may be shared with third parties and, where this happens, this is always indicated in the relevant registry description.

Before we ask for your data, we always apply the following tests to determine whether it is appropriate:

• Purpose test – why are we collecting this data?
• Necessity test – is it essential that we collect this data?

We collect the following types of personal information on the legal grounds of legitimate interests, contractual performance, and/or consent where applicable:

6. Your rights as a data subject

As a data subject whose personal information we hold, you have certain rights. If you wish to exercise any of these rights, please email datarequest(at)mydata.org or use the information supplied in the Contact us section on our website. In order to process your request, we will need to verify your identity.

Your rights are as follows:

7. Security measures

We have what we believe are appropriate security controls in place to protect personal data. Risk assessment, including assessing risks to the rights and freedoms of data subjects, is at the heart of our project. We do not, however, have any control over what happens between your device and the boundary of our information infrastructure. You should be aware of the many information security risks that exist and take appropriate steps to safeguard your own information. We accept no liability in respect of breaches that occur beyond our sphere of control.

8. Complaints

Should you wish to discuss a complaint, please feel free to contact us using the details provided above. All complaints will be treated in a confidential manner.

Should you feel unsatisfied with our handling of your data, or about any complaint that you have made to us about our handling of your data, you are entitled to escalate your complaint to a supervisory authority within the European Union.

9. Contact us

Any comments, questions or suggestions about this privacy notice or our handling of your personal data should be emailed to hello(at)mydata.org

Alternatively, you can contact us at our office using the following postal address:

Data Protection Officer
MyData Global ry
Maria 01
Lapinlahdenkatu 16
00180 Helsinki
Finland